Showing all newswire headlines

There are two problems with the gzip archiving program; the first is a crash when an input file name is over 1020 characters, and the second is a buffer overflow that could be exploited if gzip is run on a server such as an FTP server. The patch applied is from the gzip developers and the problems have been fixed in the latest beta.

New rsync packages are available; these fix a remotely exploitable problem in the I/O functions. These include the security patch from the recently released rsync-

Basically, this is the same Security Advisory as DSA 072-1, but for jgroff instead of groff. The package jgroff contains a version derived from groff that has japaneze character sets enabled. This package is available only in the stable release of Debian, patches for japanese support have been merged into the main groff package.

The enscript program does not create temporary files in a secure fashion and as such could be abused if enscript is run as root.

Sebastian Krahmer of the SuSE Security Team performed an audit on the rsync tool and discovered that in several places signed and unsigned numbers were mixed, with the end result being insecure code. These flaws could be abused by remote users to write 0 bytes into rsync's memory and trick rsync into executing arbitrary code on the server. It is recommended that all Mandrake Linux users update rsync immediately. As well, rsync server administrators should seriously consider making use of the "use chroot", "read only", and "uid" options as these can significantly reduce the impact that security problems in rsync (or elsewhere) have on the server.

Sebastian Krahmer found several places in rsync (a popular tool to synchronise files between machines) where signed and unsigned numbers were mixed which resulted in insecure code. This could be abused by remote users to write 0-bytes in rsync's memory and trick rsync into executing arbitrary code.

The rsync program allows users and administrators to synchronize files and whole directory structures on different machines. It is common practise to allow remote users to mirror ftp servers via anonymous rsync access. There exist several signedness bugs within the rsync program which allow remote attackers to write 0-bytes to almost arbitrary stack-locations, therefore being able to control the programflow and obtaining a shell remotely. These bugs have been fixed.

A security vunlerability in the Linux CIPE (VPN tunnel) implementation has been fixed.

Updated OpenLDAP packages are now available for Red Hat Linux 7, 7.1, and 7.

This updated at package fixes two minor problems and one major problem where the environment can get wiped out prior to the execution of a scheduled command. For versions of Red Hat Linux prior to 7.2, this package also fixes a potential security vulnerability which can result in heap corruption (Red Hat Linux 7.2 is not vulnerable to this security exploit).

A problem exists in the jmcce program that is used for Chinese text on the console. jmcce is installed setuid root and places log files in /tmp; because jmcce does not perform suitable checking on the files it writes to and because it uses a predictable logfile name, an attacker could exploit this to arbitrarily overwrite any file on the system.

New packages are now available to address security issues with the at scheduler program (found in Slackware 8.0's bin.tgz package), sudo, and xchat.

In Debian Security Advisory DSA-089-1 we reported that icecast-server has several security problems. For details please see that advisory.

The version of enscript (a tool to convert ASCII text to different formats) has been found to create temporary files insecurely.

zen-parse discovered a problem in the at command containing an extra call to free() which can lead to a segfault with a carefully crafted, but incorrect, format. This is caused due to a heap corruption that can be exploited under certain circumstances because the at command is installed setuid root. Thanks to SuSE for an additional security improvement that ads the O_EXCL (exclusive) option to the open(2) system call inside the at code.

Updated enscript packages that fix insecure handling of temporary files are available.

Basically, this is the same Security Advisory as DSA 102-1, except that the uploaded binary packages really fix the problem this time. Unfortunately the bugfix from DSA 102-1 wasn't propagated properly due to a packaging bug. While the file parsetime.y was fixed, and yy.tab.c should be generated from it, yy.tab.c from the original source was still used. This has been fixed now.

zen-parse discovered a problem in versions 1.4.2 and 1.4.3 of xchat that could allow a malicious user to send commands to the IRC server they are on which would take advantage of the CTCP PING reply handler in xchat. This could be used for denial of service, channel takeovers, and other similar attacks. The problem exists in 1.6 and 1.8 versions, however it is controlled by the "percascii" variable which defaults to 0. It "percascii" is set to 1, the problem is exploitable. This vulnerability has been fixed upstream in version 1.8.7.

Matthew S. Hallacy discovered that ProFTPD was not forward resolving reverse-resolved hostnames. A remote attacker could exploit this to bypass ProFTPD access controls or have false information logged. Frank Denis discovered that a remote attacker could send malicious commands to the ProFTPD server and it would force the process to consume all CPU and memory resources available to it. This DoS vulnerability could bring the server down with repeated attacks. Finally, Mattias found a segmentation fault problem that is considered by the developers to be unexploitable.

Joost Pol reported a remotely exploitable buffer overflow in the mutt email client. It is recommended that all mutt users upgrade their packages immediately. Update: The previous packages released for 8.x were unable to recall postponed messages due to an incorrect patch. These new packages also provide the compressed folders patch that was unavailable when MDKSA-2002:002 was announced.