Mandrake Linux Security Advisory : exmh (MDKSA-2001:015)

All versions of exmh prior to 2.3.1 use the /tmp directory for storing temporary files. This was done in an insecure manner as exmh did not check to ensure that nobody placed a symlink with the same name in /tmp in the meantime and thus was vulnerable to a symlink attack. This could lead to a...

Mandrake Linux Security Advisory : xinetd (MDKSA-2002:053)

A vulnerability was discovered by Solar Designer in xinetd. File descriptors for the signal pipe that were introduced in version 2.3.4 are leaked into services started by xinetd, which can then be used to talk to xinetd, resulting in a crash of xinetd. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : ntp (MDKSA-2001:036)

Przemyslaw Frasunek reported that ntp daemons such as ntp and xntp3 are vulnerable to a buffer overflow that can lead to a remote root exploit. Linux-Mandrake users are urged to upgrade ntp and xntp3 immediately. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packag...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:048)

"A problem exists with PHP3 and PHP4 scripts regarding RFC 1867-based file uploads. PHP saves uploaded files in a temporary directory on the server, using a temporary name that is referenced as the variable $FOO where 'FOO' is the name of the file input tag in the submitted form. Many PHP scripts...

Mandrake Linux Security Advisory : squid (MDKSA-2001:003)

WireX discovered a potential temporary file race condition in the way that squid sends out email messages notifying the administrator about updating the program. Usually this will only happen if you are running a development version of squid or if the clock on your system is incorrect. This probl...

Mandrake Linux Security Advisory : usermode (MDKSA-2000:020)

A bug existed in the usermode package that permitted users to reboot or halt the system without having root access. This update removes those files associated with allowing users access to reboot, shutdown, halt, or poweroff the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2000:014)

Wu-ftpd is vulnerable to a very serious remote attack in the SITE EXEC implementation. Because of user input going directly into a format string for a printf function, it is possible to overwrite important data, such as a return address, on the stack. When this is accomplished, the function can...

Mandrake Linux Security Advisory : nss_ldap (MDKSA-2000:066-1)

A race condition exists in versions of nssldap prior to version 121. On a system running nscd, a malicious user can cause the system to hang. Update : Due to a new packaging scheme, the updates have been re-released with the appropriate revision number. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : BitchX (MDKSA-2000:017)

A denial of service vulnerability exists in BitchX. Improper handling of incoming invitation messages can crash the client. Any user on IRC can send the client an invitation message that causes BitchX to segfault. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...

Mandrake Linux Security Advisory : tmpwatch (MDKSA-2000:056)

Previous versions of tmpwatch contained a local denial of service and root exploits. This is due to using the fork command to recursively process subdirectories which would allow a local user to perform a denial of service attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descripti...

Mandrake Linux Security Advisory : gpm (MDKSA-2001:006)

WireX discovered a potential temporary file condition in the gpm program. This update corrects the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2001:006. The text...

Mandrake Linux Security Advisory : rp-pppoe (MDKSA-2000:084)

rp-pppoe is a userspace PPPoE client mainly used with ADSL connections which require PPP. Versions prior to 2.5 have a security problem that, when exploited, causes the connection to be dropped. If rp-pppoe receives a crafted TCP segment with an option where the option-length field is zero illega...

Mandrake Linux Security Advisory : man (MDKSA-2000:015)

Internet Security Systems ISS X-Force has identified a vulnerability in the makewhatis Bourne shell script that ships with many Linux distributions. It is found in versions 1.5e and higher of man, and handles temporary files insecurely. Local users may gain a variety of privileges depending on th...

Mandrake Linux Security Advisory : perl (MDKSA-2000:031)

There is a vulnerability that exists when using setuidperl together with the mailx program. In some cases, setuidperl will warn root that something has going on. The setuidperl program uses /bin/mail to send the message, as root, with the environment preserved. An undocumented feature of /bin/mai...

Mandrake Linux Security Advisory : diffutils (MDKSA-2001:008-1)

WireX discovered a potential temporary file race condition in the sdiff program within the diffutils package. This update corrects the problem. Update : The previous updates had a conflicting man page with the man-pages package which prevented MandrakeUpdate from updating the package. %NASLMINLEV...

Mandrake Linux Security Advisory : MySQL (MDKSA-2001:014-1)

A security problem exists in all versions of MySQL after 3.23.2 and prior to 3.23.31. The problem is that the SHOW GRANTS command could be executed by any user making it possible for anyone with a MySQL account to get the crypted password from the mysql.user table. The new 3.23.31 version fixes...

Mandrake Linux Security Advisory : pam (MDKSA-2000:082-1)

The pamlocaluser module, which is a part of the pam package, contains a buffer overflow vulnerability. This module is not used in any default configuration and for a user to be exploited, they would have to manually insert it into a configuration file in the /etc/pam.d directory. Update : The pam...

Mandrake Linux Security Advisory : gnorpm (MDKSA-2000:055)

Versions of GnoRPM prior to 0.95 used files in the /tmp directory in an insecure manner. If GnoRPM is run as root, a local user can exploit this behaviour to trick GnoRPM into writing to arbitrary files anywhere on the system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : php (MDKSA-2001:013)

There are two security problems with php4 as shipped in Linux-Mandrake 7.2. It is possible to specify PHP directives on a per-directory basis under Apache and a remote attacker could carefully craft an HTTP request that would cause the next page to be served with the wrong values for these...

Mandrake Linux Security Advisory : pine (MDKSA-2000:073-1)

By adding specific headers to messages, the pine mail reader could be made to exit with an error message when users attempted to manipulate mail folders containing those messages. Update : The previous announcement did not make mention of another vulnerability in pine 4.21 and previous in that it...