Debian DSA-205-1 : gtetrinet - buffer overflow

Steve Kemp and James Antill found several buffer overflows in the gtetrinet a multiplayer tetris-like game package as shipped in Debian GNU/Linux 3.0, which could be abused by a malicious server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-183-1 : krb5 - buffer overflow

Tom Yu and Sam Hartman of MIT discovered another stack-based buffer overflow in the kadmserwrapin function in the Kerberos v4 administration server. This kadmind bug has a working exploit code circulating, hence it is considered serious. The MIT krb5 implementation includes support for version 4,...

Debian DSA-101-1 : sudo - Local root exploit

Sebastian Krahmer from SuSE found a vulnerability in sudo which could easily lead into a local root exploit. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory DSA-101. The text itself is copyrig...

Debian DSA-198-1 : nullmailer - denial of service

A problem has been discovered in nullmailer, a simple relay-only mail transport agent for hosts that relay mail to a fixed set of smart relays. When a mail is to be delivered locally to a user that doesn't exist, nullmailer tries to deliver it, discovers a user unknown error and stops delivering...

Debian DSA-206-1 : tcpdump - denial of service

The BGP decoding routines for tcpdump used incorrect bounds checking when copying data. This could be abused by introducing malicious traffic on a sniffed network for a denial of service attack against tcpdump, or possibly even remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security...

Debian DSA-106-2 : rsync - remote exploit

Sebastian Krahmer found several places in rsync a popular tool to synchronise files between machines where signed and unsigned numbers were mixed which resulted in insecure code see securityfocus.com. This could be abused by remote users to write 0-bytes in rsync's memory and trick rsync into...

Debian DSA-190-1 : wmaker - buffer overflow

Al Viro found a problem in the image handling code use in Window Maker, a popular NEXTSTEP like window manager. When creating an image it would allocate a buffer by multiplying the image width and height, but did not check for an overflow. This makes it possible to overflow the buffer. This could...

Debian DSA-123-1 : listar - remote exploit

Janusz Niewiadomski and Wojciech Purczynski reported a buffer overflow in the addressmatch of listar a listserv style mailing-list manager. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Advisory...

Debian DSA-213-1 : libpng - buffer overflow

Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG Portable Network Graphics format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row...

Debian DSA-133-1 : apache-perl - remote DoS / exploit

Mark Litchfield found a denial of service attack in the Apache web-server. While investigating the problem the Apache Software Foundation discovered that the code for handling invalid requests which use chunked encoding also might allow arbitrary code execution. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-160-1 : scrollkeeper - insecure temporary file creation

Spybreak discovered a problem in scrollkeeper, a free electronic cataloging system for documentation. The scrollkeeper-get-cl program creates temporary files in an insecure manner in /tmp using guessable filenames. Since scrollkeeper is called automatically when a user logs into a Gnome session, ...

Debian DSA-113-1 : ncurses - buffer overflow

Several buffer overflows were fixed in the 'ncurses' library in November 2000. Unfortunately, one was missed. This can lead to crashes when using ncurses applications in large windows. The Common Vulnerabilities and Exposures project has assigned the name CAN-2002-0062 to this issue. This problem...

Debian DSA-128-1 : sudo - buffer overflow

fc found a buffer overflow in the variable expansion code used by sudo for its prompt. Since sudo is necessarily installed suid root a local user can use this to gain root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Debian DSA-096-2 : mutt - buffer overflow

Joost Pol found a buffer overflow in the address handling code of mutt a popular mail user agent. Even though this is a one byte overflow this is exploitable. This has been fixed upstream in version 1.2.5.1 and 1.3.25. The relevant patch has been added to version 1.2.5-5 of the Debian package...

Debian DSA-104-1 : cipe - DoS attack

Larry McVoy found a bug in the packet handling code for the CIPE VPN package: it did not check if a received packet was too short and could crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian Security Adviso...

Debian DSA-169-1 : htcheck - XSS

Ulf Harnhammar discovered a problem in ht://Check's PHP interface. The PHP interface displays information unchecked which was gathered from crawled external web servers. This could lead into a cross site scripting attack if somebody has control over the server responses of a remote web server whi...

Debian DSA-211-1 : micq - denial of service

Rudiger Kuhlmann, upstream developer of mICQ, a text based ICQ client, discovered a problem in mICQ. Receiving certain ICQ message types that do not contain the required 0xFE separator causes all versions to crash. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-177-1 : pam -- serious security violation

A serious security violation in PAM was discovered. Disabled passwords i.e. those with '' in the password file were classified as empty password and access to such accounts is granted through the regular login procedure getty, telnet, ssh. This works for all such accounts whose shell field in the...

Debian DSA-132-1 : apache-ssl - remote DoS / exploit

Mark Litchfield found a denial of service attack in the Apache web-server. While investigating the problem the Apache Software Foundation discovered that the code for handling invalid requests which use chunked encoding also might allow arbitrary code execution on 64 bit architectures...

Debian DSA-162-1 : ethereal - buffer overflow

Ethereal developers discovered a buffer overflow in the ISIS protocol dissector. It may be possible to make Ethereal crash or hang by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file. It may be possible to make Ethereal run...