Showing headlines posted by dave

ISS X-Force reported an overflow in BSD's lineprinter daemon shipped with the lprold package in SuSE Linux.

New Samba packages are available for Red Hat Linux 5.2, 6.2, 7, and 7.1. These packages fix a security problem with remote clients giving special NetBIOS names to the server. It is recommended that all Samba users upgrade to the fixed packages. Please note that the packages for Red Hat Linux 6.2 require an updated logrotate package. UPDATE: The packages for Red Hat Linux 5.2 have been updated. The original packages detected the availability of syscalls present in kernels newer than

New squid packages are available that fix a potential DoS in Squid's FTP handling code. It is recommened that squid users update to the fixed packages. The packages for Red Hat Linux 6.2 also fix the problem described in RHSA-2001:097-04; it was later discovered that Red Hat Linux 6.2 is vulnerable to the same problem in accelerator-only mode.

The initscript distributed with the setserial package (which is not installed or enabled by default) uses predictable temporary file names, and should not be used. setserial-

The initscript distributed with the setserial package (which is not installed or enabled by default) uses predictable temporary file names, and should not be used. setserial-

zen-parse has found a problem with Taylor UUCP as distributed with many GNU/Linux distributions. It was possible to make `uux' execute `uucp' with malicious commandline arguments which gives an attacker access to files owned by uid/gid uucp.

Byrial Jensen found a nasty problem in slrn (a threaded news reader). The notice on slrn-announce describes it as follows:

Vladimir Ivaschenko found a problem in squid (a popular proxy cache). He discovered that there was a flaw in the code to handle FTP PUT commands: when a mkdir-only request was done squid would detect an internal error and exit. Since squid is configured to restart itself on problems this is not a big problem.

Updated man packages fixing a local GID man exploit and a potential GID man to root exploit, as well as a problem with the man paths of Red Hat Linux 5.x and 6.x.

Updated man packages fixing a local GID man exploit and a potential GID man to root exploit, as well as a problem with the man paths of Red Hat Linux 5.x and 6.x.

The window manager Window Maker was found vulnerable to a buffer overflow due to improper bounds checking when setting the window title. An attacker can remotely exploit this buffer overflow by using malicious web page titles or terminal escape sequences to set a excessively long window title. This attack can lead to remote command execution with the privileges of the user running Window Maker.

Pavel Machek has found a buffer overflow in the `most' pager program. The problem is part of most's tab expansion where the program would write beyond the bounds two array variables when viewing a malicious file. This could lead into other data structures being overwritten which in turn could enable most to execute arbitrary code being able to compromise the users environment.

The updated bugzilla package fixes numerous security issues which were present in previous releases of bugzilla.

The updated bugzilla package fixes numerous security issues which were present in previous releases of bugzilla.

The updated bugzilla package fixes numerous security issues which were present in previous releases of bugzilla.

The updated bugzilla package fixes numerous security issues which were present in previous releases of bugzilla.

The Apache module mod_auth_mysql 1.4,which is shipped since SuSE Linux 7.1, was found vulnerable to possible bypass authentication by MySQL command injection. An adversary could insert MySQL commands along with a password and these commands will be interpreted by MySQL while mod_auth_mysql is doing the password lookup in the database. A positive authentication could be returned.

A security audit has been done by Solar Designer on xinetd, and the results are now being made available as a preemptive measure.

A security audit has been done by Solar Designer on xinetd, and the results are now being made available as a preemptive measure.

A security audit has been done by Solar Designer on xinetd, and the results are now being made available as a preemptive measure.