SuSE 10 Security Update : opie (ZYPP Patch Number 7595)

This update fixes off-by-one errors in opiesu CVE-2011-2489 and missing setuid return value checks in opielogin. CVE-2011-2490 This update also removes the setuid bit from opiesu program. If you rely on the setuid bit on opiesu, add the following line to /etc/permissions.local : /usr/bin/opiesu...

SuSE 11.1 Security Update : opie (SAT Patch Number 4815)

This update fixes off-by-one errors in opiesu CVE-2011-2489 and missing setuid return value checks in opielogin. CVE-2011-2490 This update also removes the setuid bit from opiesu program. If you rely on the setuid bit on opiesu, add the following line to /etc/permissions.local : /usr/bin/opiesu...

CVE-2011-2489

Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted command line...

CVE-2011-2490

opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes...

Design/Logic Flaw

opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes...

CVE-2011-2489

Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted command line...

Buffer overflow

Multiple off-by-one errors in opiesu.c in opiesu in OPIE 2.4.1-test1 and earlier might allow local users to gain privileges via a crafted command line...

CVE-2011-2490

opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes...

CVE-2011-2490

opielogin.c in opielogin in OPIE 2.4.1-test1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by arranging for an account to already be running its maximum number of processes...

CVE-2011-2489

The connected records confirm CVE-2011-2489 affects the opiesu binary in OPIE 2.4.1-test1 and earlier, caused by multiple off-by-one errors in opiesu.c that could allow local privilege escalation. Affected products include openSUSE/SUSE releases (opie package) with fixes shipped as opie-4812 and ...

CVE-2011-2490

CVE-2011-2490 affects OPIE’s opielogin in opie 2.4.1-test1 and earlier, where it does not check the return value of setuid(), enabling local privilege escalation for an account already at its max number of processes. Connected SUSE/openSUSE advisories (e.g., openSUSE-SU-2011:0848-1) and related N...

opie security vulnerabilities

Privilege escalation, off-by-one buffer overflow...

[SECURITY] [DSA 2281-1] opie security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2281-1 [email protected] http://www.debian.org/security/ Steffen Joeris July 21, 2011 http://www.debian.org/security/faq -...

Debian DSA-2281-1 : opie - several vulnerabilities

Sebastian Krahmer discovered that opie, a system that makes it simple to use One-Time passwords in applications, is prone to a privilege escalation CVE-2011-2490 and an off-by-one error, which can lead to the execution of arbitrary code CVE-2011-2489 . Adam Zabrocki and Maksymilian Arciemowicz al...

[SECURITY] [DSA 2281-1] opie security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2281-1 [email protected] http://www.debian.org/security/ Steffen Joeris July 21, 2011 http://www.debian.org/security/faq -...

DSA-2281-1 opie - several

Bulletin has no description...

Nmap NSE net: ftp-libopie

Checks if an FTPd is prone to CVE-2010-1938 OPIE off-by-one stack overflow, a vulnerability discovered by Maksymilian Arciemowicz and Adam 'pi3' Zabrocki. See the advisory at http://nmap.org/r /fbsd-sa-opie. Be advised that, if launched against a vulnerable host, this script will crash the FTPd...

Nmap NSE net: ftp-libopie

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

FreeBSD : FreeBSD -- OPIE off-by-one stack overflow (768cfe70-ca40-11df-aade-0050568f000c)

A programming error in the OPIE library could allow an off-by-one buffer overflow to write a single zero byte beyond the end of an on-stack buffer. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML...

Multiple Vendors OPIE Off-By-One Stack Buffer Overflow (CVE-2010-1938)

"One time Passwords In Everything" OPIE is a Unix-like login and password package installed on the server and the client which makes untrusted networks safer against password-sniffing packetanalysis software. The OPIE package is sometimes used by FTP servers to provide security for an FTP session...