Showing all newswire headlines

View by date, instead?

« Previous ( 1 ... 7399 7400 7401 7402 7403 7404 7405 7406 7407 7408 7409 ... 7418 ) Next »

SuSE alert: vim/gvim

  • Mailing list (Posted by dave on Apr 10, 2001 5:48 AM EDT)
  • Story Type: Security; Groups: SUSE
The text editor vim, Vi IMproved, was found vulnerable to two security bugs. 1.) a tmp race condition 2.) vim commands in regular files will be executed if the status line of vim is enabled in vimrc Both vulnerabilities could be used to gain unauthorized access to more privileges.

SuSE alert: mc

  • Mailing list (Posted by dave on Apr 10, 2001 5:46 AM EDT)
  • Story Type: Security; Groups: SUSE
The Midnight Commander, mc(1), is a ncurses-based file manager. A local attacker could trick mc(1) into executing commands with the privileges of the user running mc(1) by creating malicious directory names. This attack leads to local privilege escalation.

Debian alert: New version of ntp released

  • Mailing list (Posted by dave on Apr 9, 2001 2:59 PM EDT)
  • Story Type: Security; Groups: Debian
Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL> reported that ntp daemons such as that released with Debian GNU/Linux are vulnerable to a buffer overflow that can lead to a remote root exploit. A previous advisory (DSA-045-1) partially addressed this issue, but introduced a potential denial of service attack. This has been corrected for Debian 2.2 (potato) in ntp version 4.0.99g-2potato2.

SuSE alert: xntp

  • Mailing list (Posted by dave on Apr 9, 2001 12:36 PM EDT)
  • Story Type: Security; Groups: SUSE
xntp is the network time protocol package widely used with many unix and linux systems for system time synchronization over a network. An exploit published by Przemyslaw Frasunek demonstrates a buffer overflow in the control request parsing code. The exploit allows a remote attacker to execute arbitrary commands as root. All versions as shipped with SuSE Linux are affected by the buffer overflow problem.

Slackware alert: buffer overflow fix for NTP

The version of xntp3 that shipped with Slackware 7.1 as well as the version that was in Slackware -current contains a buffer overflow bug that could lead to a root compromise. Slackware 7.1 and Slackware -current users are urged to upgrade to the new packages available for their release.

Red Hat alert: Network Time Daemon (ntpd) has potential remote root exploit

  • Mailing list (Posted by dave on Apr 8, 2001 1:25 PM EDT)
  • Story Type: Security; Groups: Red Hat
The Network Time Daemon (ntpd) supplied with all releases of Red Hat Linux is vulnerable to a buffer overflow, allowing a remote attacker to potentially gain root level access to a machine. All users of ntpd are strongly encouraged to upgrade.

Debian alert: ntp remote root exploit fixed

  • Mailing list (Posted by dave on Apr 5, 2001 6:48 AM EDT)
  • Story Type: Security; Groups: Debian
Przemyslaw Frasunek <venglin@FREEBSD.LUBLIN.PL> reported that ntp daemons such as that released with Debian GNU/Linux are vulnerable to a buffer overflow that can lead to a remote root exploit. This has been corrected for Debian 2.2 (potato) in ntp version 4.0.99g-2potato1.

Red Hat alert: Updated openssh packages available

  • Mailing list (Posted by dave on Apr 2, 2001 12:59 PM EDT)
  • Story Type: Security; Groups: Red Hat
Updated openssh packages are now available for Red Hat Linux 7. These packages fix an error in the supplied init script and PAM configuration file.

SuSE alert: joe

  • Mailing list (Posted by dave on Mar 28, 2001 1:28 AM EDT)
  • Story Type: Security; Groups: SUSE
A bug in joe(1), a userfriendly text editor, was found by Christer Öberg of Wkit Security AB a few weeks ago. After starting joe(1) it tries to open its configuration file joerc in the current directory, the users home directory and some other locations. joe(1) doesn't check the ownership of joerc when trying the current directory. An attacker could place a malicious joerc file in a public writeable directory, like /tmp, to execute commands with the privilege of any user (including root), which runs joe while being in this directory.

SuSE alert: eperl

  • Mailing list (Posted by dave on Mar 28, 2001 1:27 AM EDT)
  • Story Type: Security; Groups: SUSE
The ePerl program is a interpreter for the Embedded Perl 5 Language. It's main purpose is to serve as Webserver scripting language for dynamic HTML page programming. Besides this it could also serve as a standalone Unix filter. Fumitoshi Ukai and Denis Barbier have found several potential buffer overflows, which could lead to local privilege escalation if installed setuid (note: it's not installed setuid per default) or to remote compromise.

Red Hat alert: Updated Kerberos 5 and pam_krb5 packages available

  • Mailing list (Posted by dave on Mar 27, 2001 11:24 AM EDT)
  • Story Type: Security; Groups: Red Hat
Updated Kerberos 5 packages are now available for Red Hat Linux 6 and 7. These packages fix a vulnerability in the handling of Kerberos IV ticket files. Updated pam_krb5 packages are now available for Red Hat Linux 7.

Red Hat alert: Updated openssh packages available

  • Mailing list (Posted by dave on Mar 27, 2001 11:24 AM EDT)
  • Story Type: Security; Groups: Red Hat
Updated openssh packages are now available for Red Hat Linux 7. These packages reduce the amount of information a passive attacker can deduce from observing an encrypted session.

SuSE alert: nkitb/nkitserv

  • Mailing list (Posted by dave on Mar 23, 2001 12:39 AM EDT)
  • Story Type: Security; Groups: SUSE
Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default.

SuSE alert: pop

  • Mailing list (Posted by dave on Mar 22, 2001 10:48 AM EDT)
  • Story Type: Security; Groups: SUSE
The eMail access daemons imapd(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated.

SuSE alert: nkitb/nkitserv

  • Mailing list (Posted by dave on Mar 22, 2001 9:50 AM EDT)
  • Story Type: Security; Groups: SUSE
Two parts of the nkitb/nkitserv package are vulnerable to security related bugs. in.ftpd(8): A one-byte bufferoverflow was discovered in the OpenBSD port of the FTP daemon in.ftpd(8) several weeks ago. This bug could just be triggered by authenticated users, which have write access. This bug is believed to not be exploitable under Linux. However, we prefer to provide a fixed update package to make sure that the daemon is on the safe side. in.ftpd(8) will be invoked by inetd(8) and is activated by default.

SuSE alert: impad

  • Mailing list (Posted by dave on Mar 22, 2001 7:35 AM EDT)
  • Story Type: Security; Groups: SUSE
The eMail access daemons impad(8), ipop2d(8) and ipop3d(8) of SuSE 6.1 are vulnerable to several buffer overflows. Due to a misconfiguration these vulnerbilities could be triggered remotely after a user had been authenticated.

Red Hat alert: Updated licq packages fixing security problems available

  • Mailing list (Posted by dave on Mar 22, 2001 4:15 AM EDT)
  • Story Type: Security; Groups: Red Hat
Updated Red Hat Powertools 6.2 packages fixing two security problems in licq are available.

Red Hat alert: Updated vim packages available

  • Mailing list (Posted by dave on Mar 21, 2001 2:53 PM EDT)
  • Story Type: Security; Groups: Red Hat
Updated vim packages fixing a security problem are available.

Red Hat alert: Updated licq packages fixing security problems available

  • Mailing list (Posted by dave on Mar 21, 2001 2:49 PM EDT)
  • Story Type: Security; Groups: Red Hat
Updated Red Hat Linux 7 packages fixing two security problems in licq are available.

Red Hat alert: Updated sudo packages fixing buffer overrun available

  • Mailing list (Posted by dave on Mar 21, 2001 2:31 PM EDT)
  • Story Type: Security; Groups: Red Hat
An overrunnable buffer exists in sudo versions prior to 1.6.3p6

« Previous ( 1 ... 7399 7400 7401 7402 7403 7404 7405 7406 7407 7408 7409 ... 7418 ) Next »