Mandrake Linux Security Advisory : kernel (MDKSA-2004:001)

A flaw in bounds checking in mremap in the Linux kernel versions 2.4.23 and previous was discovered by Paul Starzetz. This flaw may be used to allow a local attacker to obtain root privilege. Another minor information leak in the RTC real time clock routines was fixed as well. All Mandrake Linux...

Mandrake Linux Security Advisory : ghostscript (MDKSA-2003:065)

A vulnerability was discovered in Ghostscript versions prior to 7.07 that allowed malicious postscript files to execute arbitrary commands even when -dSAFER is enabled. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Mandrake Linux Security Advisory : printer-drivers (MDKSA-2003:010)

Karol Wiesek and iDefense disovered three vulnerabilities in the printer-drivers package and tools it installs. These vulnerabilities allow a local attacker to empty or create any file on the filesystem. The first vulnerability is in the mtink binary, which has a buffer overflow in its handling o...

Mandrake Linux Security Advisory : kernel (MDKSA-2002:041)

A problem was discovered in the CIPE VPN tunnel implementation in the Linux kernel where a malformed packet could cause a crash. Andrew Griffiths discovered a vulnerability that allows remote machines to read random memory by utilizing a bug in the ICMP implementation of Linux kernels. This only...

Mandrake Linux Security Advisory : kernel22 (MDKSA-2003:039)

A number of vulnerabilities have been found in the Linux 2.2 kernel that have been addressed with the latest 2.2.25 release. A bug in the kernel module loader code could allow a local user to gain root privileges. This is done by a local user using ptrace and attaching to a modprobe process that ...

Authenticated Check : OS Name and Installed Package Enumeration

This plugin logs into the remote host using SSH, RSH, RLOGIN, Telnet, or local commands and extracts the list of installed packages. If using SSH, the scan should be configured with a valid SSH public key and possibly an SSH passphrase if the SSH public key is protected by a passphrase. TRUSTED...

Linux kernel do_mremap() call creates virtual memory area of 0 bytes in length

Overview There is a vulnerability in the Linux kernel memory management routines that allows local users to gain superuser privileges. Description The Linux kernel contains a vulnerability in the domremap call that allows software to create a virtual memory area VMA with a length of 0 bytes. This...

ISC BIND 8 vulnerable to cache poisoning via negative responses

Overview The BIND 8 name server contains a cache poisoning vulnerability that allows attackers to conduct denial-of-service attacks on specific target domains. Description Several versions of the BIND 8 name server are vulnerable to cache poisoning via negative responses. To exploit this...

CGI.pm vulnerable to Cross-site Scripting

Overview A vulnerability in the Common Gateway Interface CGI Perl module may allow an attacker to mount a cross-site scripting attack against a vulnerable system. Description The Common Gateway Interface, or CGI, is a standard for external gateway programs to interface with information servers su...

Xpede many vulnerabilities

Xpede C00kb00k // Note As mentionned below in the "vendor status" section, i did not get any reply after 3 mails, asking for acknowledgment and an amount of working time expected before an official patch release. Well, at that time i still have no idea if intellisol/workforceroi is currently...

[RHSA-2001:013-05] Three security holes fixed in new kernel

--------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Three security holes fixed in new kernel Advisory ID: RHSA-2001:013-05 Issue date: 2001-02-08 Updated on: 2001-02-08 Product: Red Hat Linux Keywords: sysctl ptrace mxcsr P4 Cros...

Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

Redhat Linux 6.x remote root exploit

Hi, Included below is an exploit for the recently exposed linux rpc.statd format string vulnerability0. I have tailored it towards current Redhat Linux 6.x installations. It can easily be incorporated into attacks against the other vulnerable Linux distributions. I am not a security expert, but...

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String (3)

Conectiva 4.x5.x Debian 2.x RedHat 6.x S.u.S.E 6.x7.0 Trustix 1.x - rpc.statd Remote Format String 3 // source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux...

Conectiva 4.x/5.x / Debian 2.x / RedHat 6.x / S.u.S.E 6.x/7.0 / Trustix 1.x - rpc.statd Remote Format String (3)

// source: https://www.securityfocus.com/bid/1480/info A vulnerability exists in the 'rpc.statd' program, which is part of the 'nfs-utils' package that is shipped with a number of popular Linux distributions. Because of a format-string vulnerability when calling the 'syslog' function, a remote...