Showing all newswire headlines

View by date, instead?

« Previous ( 1 ... 7417 7418 7419 7420 7421 7422 7423 7424 7425 7426 7427 ... 7439 ) Next »

Red Hat alert: New elm packages available for Red Hat Linux 5.2, 6.2, 7 and 7.1

  • Mailing list (Posted by dave on Jul 16, 2001 2:08 PM EDT)
  • Story Type: Security; Groups: Red Hat
New elm packages are available for Red Hat Linux 5.2, 6.2, 7 and 7.1. These packages fix a buffer overflow in the message-id handling.

Red Hat alert: New util-linux packages available to fix vipw permissions problems

  • Mailing list (Posted by dave on Jul 16, 2001 8:34 AM EDT)
  • Story Type: Security; Groups: Red Hat
New util-linux packages are available for Red Hat Linux 7.1. These packages fix a problem where vipw would leave the /etc/shadow file world-readable after editing it. It is recommended that all users update to the fixed packages. Also, if you have used vipw on Red Hat Linux 7.1 before, make sure to run (as root): chmod 0400 /etc/shadow

Debian alert: cfingerd remote exploit

  • Mailing list (Posted by dave on Jul 11, 2001 10:00 AM EDT)
  • Story Type: Security; Groups: Debian
Steven van Acker reported on bugtraq that the version of cfingerd (a configurable finger daemon) as distributed in Debian GNU/Linux 2.2 suffers from two problems:

Red Hat alert: New xloadimage packages available

  • Mailing list (Posted by dave on Jul 9, 2001 3:40 PM EDT)
  • Story Type: Security; Groups: Red Hat
These updated packages fix a buffer overflow in the faces reader. This is normally not a security problem; however, xloadimage is called by the 'plugger' program from inside Netscape to handle some image types. Hence, a remote site could cause arbitrary code to be executed as the user running Netscape. It is recommended that users of Netscape and plugger update to the fixed xloadimage packages. Plugger was shipped in Red Hat Powertools 6.2; if you have only installed packages from Red Hat Linux 6.2, you are not vulnerable to this exploit.

Red Hat alert: Updated xinetd package available for Red Hat Linux 7 and 7.1

  • Mailing list (Posted by dave on Jul 6, 2001 11:15 AM EDT)
  • Story Type: Security; Groups: Red Hat
A vulnerability has been found in xinetd's string handling.

SuSE alert: scotty

  • Mailing list (Posted by dave on Jul 2, 2001 8:25 AM EDT)
  • Story Type: Security; Groups: SUSE
Tkined's Scotty is a Tcl extension to build network management applications. Ntping, a ping/traceroute program, is part of the Scotty package. It's failure is to read a hostname as commandline option without checking the size. This leads to a bufferoverrun, that could be used to gain root privileges, because ntping is installed setuid root and is executeable by everyone.

SuSE alert: xinetd

  • Mailing list (Posted by dave on Jun 29, 2001 5:12 AM EDT)
  • Story Type: Security; Groups: SUSE
Zen-parse has reported a bug to Bugtraq which allows remote attackers to overflow a buffer in the logging routine of xinetd. During investigation we found that more problems exist within xinetd. Xinetd provides its own string-handling (snprintf()-like functions) routines and fails to handle length arguments of 0 properly. Instead of an immediate return it assumes 'no limit' for writing characters to the target-buffer. This can lead to overflows and arbitrary remote code-execution. Additionally xinetd now sets the correct umask before starting other deamons. Please update the packages immediately, kill the old deamon and start the new xinetd deamon with the

SuSE alert: samba

  • Mailing list (Posted by dave on Jun 29, 2001 4:56 AM EDT)
  • Story Type: Security; Groups: SUSE
Michal Zalewski discovered that a remote attacker can write to files owned by root if the samba config file /etc/smb.conf contains the %m macro to specify the logfile for logging access to the samba server. The %m macro substitutes the NetBIOS name - improper validation of this name allows an attacker to write to any file in the system.

Red Hat alert: New Samba packages available for Red Hat Linux 5.2, 6.2, 7 and 7.1

  • Mailing list (Posted by dave on Jun 26, 2001 3:15 AM EDT)
  • Story Type: Security; Groups: Red Hat
New Samba packages are available for Red Hat Linux 5.2, 6.2, 7 and 7.1. These packages fix a security problem with remote clients giving special NetBIOS names to the server. It is recommended that all Samba users upgrade to the fixed packages. Please note that the packages for Red Hat Linux 6.2 require an updated logrotate package.

Debian alert: samba remote file append/creation problem

  • Mailing list (Posted by dave on Jun 23, 2001 7:08 AM EDT)
  • Story Type: Security; Groups: Debian
Michal Zalewski discovered that samba does not properly validate NetBIOS names from remote machines.

Red Hat alert: New updated XFree86 packages available

  • Mailing list (Posted by dave on Jun 22, 2001 1:35 PM EDT)
  • Story Type: Security; Groups: Red Hat
New updated XFree86 3.3.6 packages are available for Red Hat Linux 7.1, 7.0, and 6.2 which contain many security updates, bug fixes, and updated drivers for various different families of video hardware including: S3 Savage, S3 Trio64, S3 ViRGE, Intel i810/i815, ATI Rage Mobility Mach64, and numerous other driver fixes and improvements.

Red Hat alert: Kernel: FTP iptables vulnerability in 2.4 kernel and general bug fixes

  • Mailing list (Posted by dave on Jun 22, 2001 10:30 AM EDT)
  • Story Type: Security; Groups: Red Hat
A security hole has been found that does not affect the default configuration of Red Hat Linux, but it can affect some custom configurations of Red Hat Linux 7.1. The bug is specific to the Linux

Debian alert: two xinetd problems

  • Mailing list (Posted by dave on Jun 17, 2001 7:47 AM EDT)
  • Story Type: Security; Groups: Debian
zen-parse reported on bugtraq that there is a possible buffer overflow in the logging code from xinetd. This could be triggered by using a fake identd that returns special replies when xinetd does an ident request.

Debian alert: rxvt buffer overflow

  • Mailing list (Posted by dave on Jun 16, 2001 11:41 AM EDT)
  • Story Type: Security; Groups: Debian
Samuel Dralet reported on bugtraq that version 2.6.2 of rxvt (a VT102 terminal emulator for X) have a buffer overflow in the tt_printf() function. A local user could abuse this making rxvt print a special string using that function, for example by using the -T or -name command-line options. That string would cause a stack overflow and contain code which rxvt will execute.

Debian alert: multiple gnupg problems

  • Mailing list (Posted by dave on Jun 16, 2001 9:57 AM EDT)
  • Story Type: Security; Groups: Debian
The version of GnuPG (GNU Privacy Guard, an OpenPGP implementation) as distributed in Debian GNU/Linux 2.2 suffers from two problems:

Debian alert: fetchmail buffer overflow

  • Mailing list (Posted by dave on Jun 16, 2001 8:15 AM EDT)
  • Story Type: Security; Groups: Debian
Wolfram Kleff found a problem in fetchmail: it would crash when processing emails with extremely long headers. The problem was a buffer overflow in the header parser which could be exploited.

Red Hat alert: LPRng fails to drop supplemental group membership

  • Mailing list (Posted by dave on Jun 12, 2001 12:29 PM EDT)
  • Story Type: Security; Groups: Red Hat
When LPRng drops uid and gid, it fails to drop membership in its supplemental groups.

Debian alert: man-db symlink attack

  • Mailing list (Posted by dave on Jun 12, 2001 6:43 AM EDT)
  • Story Type: Security; Groups: Debian
Luki R. reported a bug in man-db: it did handle nested calls of drop_effective_privs() and regain_effective_privs() correctly which would cause it to regain privileges to early. This could be abused to make man create files as user man.

Debian alert: exim printf format attack

  • Mailing list (Posted by dave on Jun 9, 2001 3:46 PM EDT)
  • Story Type: Security; Groups: Debian
Megyer Laszlo found a printf format bug in the exim mail transfer agent. The code that checks the header syntax of an email logs an error without protecting itself against printf format attacks.

Red Hat alert: Updated GnuPG packages available

  • Mailing list (Posted by dave on Jun 7, 2001 12:04 PM EDT)
  • Story Type: Security; Groups: Red Hat
Updated GnuPG packages are now available for Red Hat Linux 6.2, 7, and 7.1. These updates include fixes for the recently-discovered format string vulnerability.

« Previous ( 1 ... 7417 7418 7419 7420 7421 7422 7423 7424 7425 7426 7427 ... 7439 ) Next »