Showing all newswire headlines
View by date, instead?« Previous ( 1 ... 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 ... 2182 ) Next »
Debian alert: New heimdal packages fix authentication failure
A cryptographic weakness in version 4 of the Kerberos protocol allows
an attacker to use a chosen-plaintext attack to impersonate any
principal in a realm. Additional cryptographic weaknesses in the krb4
implementation permit the use of cut-and-paste attacks to fabricate
krb4 tickets for unauthorized client principals if triple-DES keys are
used to key krb4 services. These attacks can subvert a site's entire
Kerberos authentication infrastructure.
Mandrake alert: Updated glibc packages fix vulnerabilities in RPC XDR decoder
An integer overflow was discovered by eEye Digital Security in the xdrmem_getbytes() function of glibc 2.3.1 and earlier. This function is part of the XDR encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause buffer overflows and could possibly be exploited to execute arbitray code.
Mandrake alert: Updated netpbm packages fix math overflow errors
Several math overflow errors were found in NetPBM by Al Viro and Alan Cox. While these programs are not installed suid root, they are often used to prepare data for processing. These errors may permit remote attackers to cause a denial of service or execute arbitrary code in any programs or scripts that use these graphics conversion tools.
Mandrake alert: Updated openssl packages fix RSA-related insecurities
Researchers discovered a timing-based attack on RSA keys that OpenSSL is generally vulnerable to, unless RSA blinding is enabled. Patches from the OpenSSL team have been applied to turn RSA blinding on by default.
Mandrake alert: Updated rxvt packages fix escape sequence insecurities
Digital Defense Inc. released a paper detailing insecurities in various terminal emulators, including rxvt. Many of the features supported by these programs can be abused when untrusted data is displayed on the screen. This abuse can be anything from garbage data being displayed to the screen or a system compromise.
SuSE alert: kernel
The Linux kernel has a security flaw in all versions used on SuSE products excluding the upcoming SuSE Linux 8.2 distribution. The flaw is known as ptrace/modprobe bug: The local attacker can use ptrace and attach to a modprobe process that is spawned if the user triggers the loading of a kernel module using the kmod kernel module subsystem. This can be done by asking for network protocols that are supplied by kernel modules which are not loaded (yet). The vulnerability allows the attacker to execute arbitrary commands as root.
Debian alert: New mutt packages fix arbitrary code execution
Core Security Technologies discovered a buffer overflow in the IMAP
code of Mutt, a text-oriented mail reader supporting IMAP, MIME, GPG,
PGP and threading. This problem allows a remote malicious IMAP server
to cause a denial of service (crash) and possibly execute arbitrary
code via a specially crafted mail folder.
Red Hat alert: New samba packages fix security vulnerabilities
Updated samba packages are now available to fix security vulnerabilities
found during a code audit.
[Updated 24 March 2003]
Updated samba packages for Red Hat Linux 6.2, 7, and 7.1 are now included.
These packages contain Samba version
Red Hat alert: Updated Evolution packages fix multiple vulnerabilities
Updated Evolution packages are available which fix several vulnerabilities.
[Updated 22 March 2003]
New packages are included for Red Hat Linux 7.3 as the previous erratum
packages lost support for SSL.
Debian alert: New lpr packages fix local root exploit
A buffer overflow has been discovered in lpr, a BSD lpr/lpd line
printer spooling system. This problem can be exploited by a local
user to gain root privileges, even if the printer system is set up
properly.
SuSE alert: mutt
Mutt is a text-based Mail User Agent (MUA). The IMAP-code of mutt is vulnerable to a buffer overflow that can be exploited by a malicious IMAP-server to crash mutt or even execute arbitrary code with the privileges of the user running mutt.
Debian alert: New krb5 packages fix several vulnerabilities
Several vulnerabilities have been discovered in krb5, an
implementation of MIT Kerberos.
Debian alert: New bonsai packages fix several vulnerabilities
Rémi Perrot fixed several security related bugs in the bonsai, the
Mozilla CVS query tool by web interface. Vulnerabilities include
arbitrary code execution, cross-site scripting and access to
configuration parameters. The Common Vulnerabilities and Exposures
project identifies the following problems:
SuSE alert: ethereal
Ethereal is a GUI for analyzing and displaying network traffic. Ethereal is vulnerable to a format string bug in it's SOCKS code and to a heap buffer overflow in it's NTLMSSP code. These bugs can be abused to crash ethereal or maybe to execute arbitrary code on the machine running ethereal.
SuSE alert: qpopper
The Post-Office-Protocol- (POP-) Server qpopper (version 4) was vulnerable to a buffer overflow. The buffer overflow occurs after authentication has taken place. Therefore pop-users with a valid account can execute arbitrary code on the system running qpopper. Depending on the setup, the malicious code is run with higher privileges.
SuSE alert: file
The file command can be used to determine the type of files. iDEFENSE published a security report about a buffer overflow in the handling-routines for the ELF file-format. In conjunction with other mechanisms like print-filters, cron-jobs, eMail-scanners (like AMaViS) and alike this vulnerability can be used to gain higher privileges or to compromise the system remotely.
Red Hat alert: Updated Evolution packages fix multiple vulnerabilities
Updated Evolution packages are available which fix several vulnerabilities.
Red Hat alert: New kernel 2.2 packages fix vulnerabilities
Updated kernel packages for Red Hat Linux 6.2 and 7.0 are now available
that fix several security vulnerabilities.
Red Hat alert: Updated glibc packages fix vulnerabilities in RPC XDR decoder
Updated glibc packages are available to fix an integer overflow in the XDR
decoder.
Debian alert: New lxr packages fix information disclosure
Upstream developers of lxr, a general hypertext cross-referencing
tool, have been alerted of a vulnerability that allows a remote
attacker to read arbitrary files on the host system as user www-data.
This could disclose local files that were not meant to be shared with
the public.
« Previous ( 1 ... 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 ... 2182 ) Next »