Queries to ISC BIND servers may disclose environment variables

Overview The Berkeley Internet Name Domain BIND is an implementation of the Domain Name System DNS by the Internet Software Consortium ISC. There is an information leakage vulnerability in BIND 4.9.x and 8.2.x, which may allow remote intruders to obtain information from systems running BIND...

[SECURITY] [DSA-017-1] New version of jazip released

---------------------------------------------------------------------------- Debian Security Advisory DSA-017-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 - ---------------------------------------------------------------------------- Package : jazip...

[SECURITY] [DSA-015-1] New version of sash released

---------------------------------------------------------------------------- Debian Security Advisory DSA-015-1 [email protected] http://www.debian.org/security/ Martin Schulze January 23, 2001 - ---------------------------------------------------------------------------- Package : sash...

FreeBSD-SA-01:10.bind

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-01:10 Security Advisory FreeBSD, Inc. Topic: bind remote denial of service Category: core, ports Module: bind Announced: 2001-01-23 Credits: Fabio Pietrosanti Affects:...

[SECURITY] [DSA-011-1] New version of mgetty released

Package: mgetty Vulnerability: insecure tempfile Debian-specific: no Immunix reports that mgetty does not create temporary files in a secure manner, which could lead to a symlink attack. This has been corrected in mgetty 1.1.21-3potato1 We recommend you upgrade your mgetty package immediately. wg...

Phorum common.php ForumLang Parameter Traversal Arbitrary File Access

The version of Phorum installed on the remote host lets an attacker read arbitrary files on the affected host with the privileges of the http daemon because it fails to filter input to the 'ForumLang' parameter of the 'support/common.php' script of directory traversal sequences. %NASLMINLEVEL 703...

1st Up Mail Server v4.1 Buffer Overflow Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 1st Up Mail Server v4.1 Buffer Overflow Vulnerability USSR Advisory Code: USSR-2000058 Public Disclosure Date: December 25, 2000 Vendors Affected: Upland Ltd http://www.upland.co.uk/ Systems Affected: 1st Up Mail Server v4.1 Problem: The Ussr Team has...

[SECURITY] [DSA-005-1] slocate local exploit

Package : slocate Problem type : local exploit Debian-specific: no Michel Kaempf reported a security problem in slocate a secure version of locate, a tool to quickly locate files on a filesystem on bugtraq which was originally discovered by zorgon. He discovered there was a bug in the database...

New version of elvis-tiny released

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Martin Schulze November 22, 2000 -...

DoS possibility in syslog-ng

BalaBit security advisory Advisory ID: BB-2000/01 Package: syslog-ng Versions affected: versions prior to and including 1.4.8 Problem type: remote DoS attack Date: 2000-11-22 1 Background syslog-ng is a portable syslog implementation. Its highlights include regexp based log selection, TCP transpo...

[SECURITY] New version of ethereal released

Package : ethereal Problem type : remote exploit Debian-specific: no hacksware reported a buffer overflow in the AFS packet parsing code in ethereal. Gerald Combs then found more overflows in the netbios and ntp decoding logic as well. An attacker can exploit those overflows by sending carefully...

Cgisecurity Quickstore Shopping cart

Now i already released this on my site but i forgot to post to bugtraq somehow. Vendor was contacted and i waited awhile for a response and got none back. Upgrade to the newest version for a fix. -zenomorph ps. check bugtraq for older holes in the same product Cgi Security Advisory 1...

[SECURITY] New version of modutils released

Package: modutils Vulnerability: local exploit Debian-specific: no Sebastian Krahmer found a problem in the modprobe utility that could be exploited by local users to run arbitrary commands as root if the machine is running a kernel with kmod enabled. The kmod kernel feature allows the kernel to...

[SECURITY] New Debian cron packages released

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Daniel Jacobowitz November 17, 2000 - ---------------------------------------------------------------------------- Package: cron Vulnerability:...

[SECURITY] New version of openssh released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 18, 2000 - ------------------------------------------------------------------------ Package : openssh Problem type :...

[SECURITY] New version of Debian bind packages released

Package: bind Vulnerability: remote Denial of Service Debian-specific: no Vulnerable: yes The version of BIND shipped with Debian GNU/Linux 2.2 is vulnerable to a remote denial of service attack, which can cause the nameserver to crash after accessing an uninitialized pointer. This problem is fix...

[SECURITY] New version of tcsh released

Package: tcsh Vulnerability: local exploit Debian-specific: no Proton reported on bugtraq that tcsh did not handle in-here documents correctly. The version of tcsh that is distributed with Debian GNU/Linux 2.2r0 also suffered from this problem. When using in-here documents using the syntax tcsh...

Verity UltraSeek 3.1.x Malformed URL Remote DoS

It is possible to make the remote UltraSeek server hang temporarily by requesting : /index.html?&col=&ht=0&qs=&qc=&pw=100%25&ws=0&nh=10&lk=1&rf=0&si=1&si=1&ql=../../../index An attacker may use this flaw to prevent this site from responding to valid client requests. %NASLMINLEVEL 70300 C Tenable...

[SECURITY] New version of Debian php4 packages released

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Daniel Jacobowitz October 14, 2000 - ---------------------------------------------------------------------------- Package: php4 Vulnerability:...

[SECURITY] New versions of sysklogd released

---------------------------------------------------------------------------- Debian Security Advisory [email protected] http://www.debian.org/security/ Michael Stone September 19, 2000 - ---------------------------------------------------------------------------- Package: sysklogd...