SSA-2002-0731201128

The Slackware Linux Project: Slackware Security Advisories Slackware Security Advisories News Security Advisories /...

Security updates for Slackware 8.1

Several security updates are now available for Slackware 8.1, including updated packages for Apache, glibc, modssl, openssh, openssl, and php. Here are the details from the Slackware 8.1 ChangeLog: ---------------------------- Tue Jul 30 19:45:52 PDT 2002 patches/packages/apache-1.3.26-i386-2.tgz...

SSA-2002-0626204548

The Slackware Linux Project: Slackware Security Advisories Slackware Security Advisories News Security Advisories /...

cvs recompiled against updated zlib + /tmp fix

New cvs packages are available to fix security problems. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Mon Mar 11 17:54:12 PST 2002 patches/packages/cvs.tgz: Patched to link to the shared zlib on the system instead of statically linking to the included zlib...

rsync update fixes security problems

New rsync packages are available to fix security problems. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Mon Mar 11 15:09:26 PST 2002 patches/packages/rsync.tgz: Upgraded to rsync-2.5.3. This fixes two security problems: Make sure that supplementary groups...

rsync update fixes security problems

New rsync packages are available to fix a security problem. Here's the information from the Slackware 8.0 ChangeLog: Fri Jan 25 14:25:51 PST 2002 patches/packages/rsync.tgz: Fixed a security hole by upgrading to rsync-2.4.8pre1. This is the relevant information from the rsync NEWS file: SECURITY...

sniffit-exp1.txt

/ Remote overflow in sniffit.0.3.7.beta tested on slackware 7.1 found/coded by g463 -18th january 2002- The vulnerability is triggered when the option -L is called from the command line with 'normmail' ie : ./sniffit -c ./sampleconfigfile -L normmail It calls a piece of code where the buffer is...

Pine update fixes insecure URL-handling

Pine 4.44 packages are now available to fix a problem with insecure URL handling. Here's the information from the Slackware 8.0 ChangeLog: Sat Jan 12 13:05:33 PST 2002 patches/packages/pine.tgz: Fix a security problem with pine by upgrading to pine4.44. More details from the Pine Announcement Lis...

glibc glob overflow patched

A buffer overflow has been found in the glob3 function in glibc. Fixed packages for Slackware 8.0 are now available. Here's the information from the Slackware 8.0 ChangeLog: Fri Jan 11 14:07:07 PST 2002 patches/packages/glibc.tgz, patches/packages/glibcso.tgz: Fixed a buffer overflow in the glob3...

mutt remote exploit patched

An exploitable overflow has been found in the address handling code of the mutt mail client version 1.2.5i supplied with Slackware 8.0. A new mutt-1.2.5.1 has been released which addresses this problem, and packages are now available for Slackware 8.0 and -current. We urge all Slackware users to...

UseLogin.txt

-- OpenSSH UseLogin bug proof of concept exploit -- by WaR / http://www.genhex.org -- Intro -- I was very curious in finding out how to exploit this problem. Although I don't think anyone uses this feature, I looked into the matter anyway. Here it goes. It was tested on the following platforms: -...

New bugs discovered!

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ ++++++++++++++GOBBLES+SECURITY+RESEARCH+TEAM+INCORPORATED++++++++++++++ ALERT! ALERT! MUCH NEW BUFFEROVERFLOW FOUND IN /BIN/GZIP! ALERT! ALERT! +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Researche...

CVE-1999-1445

Vulnerability details available for CVE-1999-1445: affected software includes imapd and ipop3d running on Slackware 3.4 and 3.3 with shadowing enabled (and possibly other OSes). The issue allows remote attackers to trigger a core dump by sending a short sequence of USER and PASS commands that do ...

CVE-1999-1186

CVE-1999-1186 concerns rxvt (terminal emulator) when compiled with the PRINT_PIPE option on certain Linux distros (e.g., Slackware 3.0, RedHat 2.1). The vulnerability arises from the -print-pipe parameter, which allows a local user to specify a malicious program, potentially gaining root privileg...

CVE-1999-1445

Vulnerability in imapd and ipop3d in Slackware 3.4 and 3.3 with shadowing enabled, and possibly other operating systems, allows remote attackers to cause a core dump via a short sequence of USER and PASS commands that do not provide valid usernames or passwords...

CVE-1999-1489

Vulnerability summary: CVE-1999-1489 describes a buffer overflow in the TestChip function of XFree86 SuperProbe used on Slackware Linux 3.1 . The overflow enables local users to obtain root privileges by supplying a long -nopr argument. Nature and impact (as documented): Local privilege escalatio...

CVE-1999-1498

Slackware Linux 3.4 pkgtool is affected by a local vulnerability where a symlink attack on the reply file allows reading and writing to arbitrary files. Root cause: symlink manipulation enabling unintended access. Impact per the description: partial confidentiality and partial integrity; availabi...

CVE-1999-1434

Slackware Linux 3.2–3.5 is affected by CVE-1999-1434: the login process does not properly handle the error when /etc/group is missing, failing to drop privileges and potentially assigning root privileges to any local user who logs in. The connected documents confirm the affected OS versions and t...

CVE-1999-1489

Buffer overflow in TestChip function in XFree86 SuperProbe in Slackware Linux 3.1 allows local users to gain root privileges via a long -nopr argument...

CVE-1999-1422

The default configuration of Slackware 3.4, and possibly other versions, includes . dot, the current directory in the PATH environmental variable, which could allow local users to create Trojan horse programs that are inadvertently executed by other users...