Mandrake Linux Security Advisory : mm (MDKSA-2002:045)

Marcus Meissner and Sebastian Krahmer discovered a temporary file vulnerability in the mm library which is used by the Apache webserver. This vulnerability can be exploited to obtain root privilege if shell access to the apache user typically apache or nobody is already obtained. %NASLMINLEVEL...

Mandrake Linux Security Advisory : cups (MDKSA-2001:048)

The version of cups shipped with Linux-Mandrake 8.0 has a problem where when a user prints a multi-page PostScript file with embedded pictures, the pages following the first with the picture are all printed on the same page, one on top of the other. From multi-page Abiword files only text only th...

Mandrake Linux Security Advisory : fileutils (MDKSA-2002:031)

Wojciech Purczynski reported a race condition in some utilities in the GNU fileutils package that may cause root to delete the entire filesystem. This only affects version 4.1 stable and 4.1.6 development versions, and the authors have fixed this in the latest development version. %NASLMINLEVEL...

Mandrake Linux Security Advisory : gdm (MDKSA-2001:070)

A buffer overrun exists in the XDMCP handling code used in gdm. By sending a properly crafted XDMCP message, it is possible for a remote attacker to execute arbitrary commands as root on the susceptible machine. By default, XDMCP is disabled in gdm.conf on Mandrake Linux. %NASLMINLEVEL 70300 C...

Mandrake Linux Security Advisory : webmin (MDKSA-2001:059)

Recently, Caldera found that when webmin starts a system daemon from the web frontend it does not clear its environment variables. Since these variables contain the authorization of the administrator, any daemon would also get these variables. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mandrake Linux Security Advisory : ethereal (MDKSA-2003:067)

Several vulnerabilities in ethereal were discovered by Timo Sirainen. Integer overflows were found in the Mount and PPP dissectors, as well as one-byte buffer overflows in the AIM, GIOP Gryphon, OSPF, PPTP, Quake, Quake2, Quake3, Rsync, SMB, SMPP, and TSP dissectors. These vulnerabilities were...

Mandrake Linux Security Advisory : apache2 (MDKSA-2004:043)

A memory leak in modssl in the Apache HTTP Server prior to version 2.0.49 allows a remote denial of service attack against an SSL-enabled server. The updated packages provide a patched modssl to correct these problems. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Mandrake Linux Security Advisory : mod_ssl (MDKSA-2004:054)

A stack-based buffer overflow exists in the sslutiluuencodebinary function in sslenginekernel.c in modssl for Apache 1.3.x. When modssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN. The provided...

Mandrake Linux Security Advisory : libxml2 (MDKSA-2004:018)

A flaw in libxml2 versions prior to 2.6.6 was found by Yuuichi Teranishi. When fetching a remote source via FTP or HTTP, libxml2 uses special parsing routines that can overflow a buffer if passed a very long URL. In the event that the attacker can find a program that uses libxml2 which parses...

Mandrake Linux Security Advisory : apache2 (MDKSA-2004:055)

A stack-based buffer overflow exists in the sslutiluuencodebinary function in sslutil.c in Apache. When modssl is configured to trust the issuing CA, a remote attacker may be able to execute arbitrary code via a client certificate with a long subject DN. The provided packages are patched to preve...

Mandrake Linux Security Advisory : gnupg (MDKSA-2001:045)

GnuPG version 1.0.5 has been released that fixes a few security problems, including a vulnerability that makes it easier for an attacker to recover your private key if they are able to steal your keyring. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks...

Mandrake Linux Security Advisory : enscript (MDKSA-2002:010)

The enscript program does not create temporary files in a secure fashion and as such could be abused if enscript is run as root. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...

Mandrake Linux Security Advisory : ethereal (MDKSA-2004:002)

Two vulnerabilities were discovered in versions of Ethereal prior to 0.10.0 that can be exploited to make Ethereal crash by injecting malformed packets onto the wire or by convincing a user to read a malformed packet trace file. The first vulnerability is in the SMB dissector and the second is in...

Mandrake Linux Security Advisory : rsync (MDKSA-2004:042)

Rsync before 2.6.1 does not properly sanitize paths when running a read/write daemon without using chroot, allows remote attackers to write files outside of the module's path. The updated packages provide a patched rsync to correct this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mandrake Linux Security Advisory : squid (MDKSA-2002:027)

A security issue has recently been found and fixed in the Squid-2.X releases up to and including 2.4.STABLE4. Error and boundary conditions were not checked when handling compressed DNS answer messages in the internal DNS code lib/rfc1035.c. A malicous DNS server could craft a DNS reply that caus...

Mandrake Linux Security Advisory : screen (MDKSA-2003:113)

A vulnerability was discovered and fixed in screen by Timo Sirainen who found an exploitable buffer overflow that allowed privilege escalation. This vulnerability also has the potential to allow attackers to gain control of another user's screen session. The ability to exploit is not trivial and...

Mandrake Linux Security Advisory : mgetty (MDKSA-2003:053-1)

Two vulnerabilities were discovered in mgetty versions prior to 1.1.29. An internal buffer could be overflowed if the caller name reported by the modem, via Caller ID information, was too long. As well, the faxspool script that comes with mgetty used a simple permissions scheme to allow or deny f...

Mandrake Linux Security Advisory : webmin (MDKSA-2002:033)

A vulnerability exists in all versions of Webmin prior to 0.970 that allows a remote attacker to login to Webmin as any user. All users of Webmin are encouraged to upgrade immediately. Users of Mandrake Linux 8.0 and earlier will need to install some additional perl modules for this new version o...

Mandrake Linux Security Advisory : LPRng (MDKSA-2002:042)

Matthew Caron pointed out that using the LPRng default configuration, the lpd daemon will accept job submissions from any remote host. These updated LPRng packages modify the job submission policy in /etc/lpd.perms to refuse print jobs from remote hosts by default. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : xchat (MDKSA-2002:051)

In versions of the xchat IRC client prior to version 1.8.9, xchat does not filter the response from an IRC server when a /dns query is executed. xchat resolves hostnames by passing the configured resolver and hostname to a shell, so an IRC server may return a malicious response formatted so that...