Mandrake Linux Security Advisory : nmh (MDKSA-2000:000)

The nmh package contains a security bug in MIME headers parsing which can be exploited to trick mhshow into executing arbitrary shell code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : joe (MDKSA-2001:026)

The joe text editor looks for configuration files in the current working directory, the user's home directory, and finally in /etc/joe. A malicious user could create their own .joerc configuration file and attempt to get other users to use it. If this were to happen, the user could potentially...

Mandrake Linux Security Advisory : xemacs (MDKSA-2000:006)

From the Caldera advisory : under some circumstances, users are able to snoop on other users' keystrokes. This is a serious problems if you use modules that require e.g. input of passwords, such as MailCrypt. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : xlockmore (MDKSA-2000:011)

Xlock is an X11 utility used to lock X-Window displays until the password of the user running X is entered correctly. Of course, in order to perform the password-check xlock must be setuid root and have access to the shadowed passwd file. In the xlockmore distributions versions prior to 4.16.1, a...

Mandrake Linux Security Advisory : bash1 (MDKSA-2000:075)

The bash1 shell program has the same vulnerability that tcsh has and incorrectly creates temporary files without the OEXCL flag. This vulnerability does not exist in bash2 which uses the OEXCL flag when creating temporary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : xsoldier (MDKSA-2000:004)

A vulnerability in xsoldier will allow any user to exploit a buffer overflow. This user does not have to have a valid $DISPLAY to exploit this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : traceroute (MDKSA-2000:053)

There is a bug in the traceroute program which causes segfaults and which could potentially be exploited to provide root privilege because the traceroute command is suid root. There are no known exploits currently, but users are encouraged to upgrade. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : Mesa (MDKSA-2001:029)

Ben Collins identified a temporary file race in the Utah-glx component of the Mesa package which affects Linux-Mandrake 7.2. The /tmp/glxmemory file is created by Utah-glx and because it is not created securely could be used in a symlink attack which allows files to be overwritten the next time t...

Mandrake Linux Security Advisory : diffutils (MDKSA-2001:008-1)

WireX discovered a potential temporary file race condition in the sdiff program within the diffutils package. This update corrects the problem. Update : The previous updates had a conflicting man page with the man-pages package which prevented MandrakeUpdate from updating the package. %NASLMINLEV...

Mandrake Linux Security Advisory : pam (MDKSA-2000:082-1)

The pamlocaluser module, which is a part of the pam package, contains a buffer overflow vulnerability. This module is not used in any default configuration and for a user to be exploited, they would have to manually insert it into a configuration file in the /etc/pam.d directory. Update : The pam...

Mandrake Linux Security Advisory : mc (MDKSA-2000:078)

A problem was found in the cons.saver program by Maurycy Prodeus. The cons.saver program is a screensaver for the console that is included in the mc package. cons.saver does not check if it is started with a valid stdout, which combined with a bug in its check to see if its argument is a tty it...

Mandrake Linux Security Advisory : xemacs (MDKSA-2001:019)

Previous versions of XEmacs had a problem with the gnuserv application. Versions prior to 21.1.14 could allow arbitrary code to be executed by overrunning the magic cookie buffer, as well as accepting the prefix of valid magic cookies i.e. '12' is accepted if the cookie is '12345678'. %NASLMINLEV...

Mandrake Linux Security Advisory : eperl (MDKSA-2001:027)

Several potential buffer overflows in the ePerl package have been found by Fumitoshi Ukai and Denis Barbier. When eperl is installed setuid root, it can switch to the UID/GID of the script's owner. Although Linux-Mandrake does not ship the program setuid root, this is a useful feature which some...

Mandrake Linux Security Advisory : joe (MDKSA-2000:072)

When exiting joe in a non-standard way such as a system crash, closing an xterm, or a network connection going down, joe will unconditionally append its open buffers to the file DEADJOE. This can be exploited by the creation of DEADJOE symlinks in directories where root would normally use joe. In...

Mandrake Linux Security Advisory : gpm (MDKSA-2001:006)

WireX discovered a potential temporary file condition in the gpm program. This update corrects the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2001:006. The text...

Mandrake Linux Security Advisory : usermode (MDKSA-2000:020)

A bug existed in the usermode package that permitted users to reboot or halt the system without having root access. This update removes those files associated with allowing users access to reboot, shutdown, halt, or poweroff the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : mozilla (MDKSA-2002:074)

Numerous security fixes are available in Mozilla 1.0.1. For a detailed list, refer to the 'Recently fixed security issues' page on the Mozilla website see the first reference. All users are encouraged to upgrade to this latest stable 1.0.x release of Mozilla. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : gnorpm (MDKSA-2000:055)

Versions of GnoRPM prior to 0.95 used files in the /tmp directory in an insecure manner. If GnoRPM is run as root, a local user can exploit this behaviour to trick GnoRPM into writing to arbitrary files anywhere on the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : gpm (MDKSA-2000:025)

Many security flaws existed in the gpm package, which is used to control the mouse in a terminal outside of X Windows. As well, a denial of service attack via /dev/gpmctl is possible. All security issues with the gpm package have been addressed with this update. %NASLMINLEVEL 70300 C Tenable...

Mandrake Linux Security Advisory : BitchX (MDKSA-2000:079)

Two bugs exist in the BitchX IRC client. A possible stack overflow condition exists if a malformed DNS answer is processed by the client, and the second bug allows this malformed DNS record to be embedded in a valid DNS packet. Without the second bug, the malformed DNS record wouldn't be processe...