CVE-2000-0244

The Citrix ICA Independent Computing Architecture protocol uses weak encryption XOR for user authentication...

[SECURITY] Updated i386 package for sendmail

The version of sendmail that was listed in the earlier advisory today was compiled with the wrong version of libc. This has been corrected in version 8.9.3-3slink1.0.1 . wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Intel ia32 architecture:...

[SECURITY] New version of sendmail released

The version of sendmail that was distributed with Debian GNU/Linux 2.1 has a slight problem in the code to regenerate the aliases database. Sendmail allowed any user to run sendmail with the -bi option to reinitialize the aliases database. The user could then interrupt sendmail and leave the syst...

[SECURITY] New version of amd fixes remote exploit, take 2

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman October 18, 1999 - ------------------------------------------------------------------------ The version of amd that was...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

[SECURITY] New versions of man2html fixes postinst glitch

Former versions of man2html uses a static file in /tmp for writing. This can lead into overwriting system files if a malicious user has created a symbolic link to it before upgrading man2html. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you...

[SECURITY] New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten. We recommend you upgrade your man2html package as soon as possible. wget url will fetch the file for you dpkg -i file.deb will...

cfengine.symlink.txt

Date: Tue, 16 Feb 1999 01:12:20 +0100 From: Wichert Akkerman To: [email protected] Subject: SECURITY New versions of cfengine fixes symlink attack -----BEGIN PGP SIGNED MESSAGE----- The maintainer of Debian GNU/Linux cfengine package found a error in the way cfengine handles temporary files wh...

[SECURITY] New versions of cfingerd fixes root exploit

We have received a report that the all versions of cfingerd prior to 1.4.0 and 1.3.2-18.1 are vulnerable to a root exploit - as posted on bugtraq. We recommend you upgrade your cfingerd package immediately or disable ALLOWEXECUTION. The latter is turned off in the default Debian configuration. wg...

[SECURITY] New version of samba released

The version of samba as distributed in Debian GNU/Linux 2.1 has a couple of security problems: a Denial-of-Service attack against nmbd was possible it was possible to exploit smbd if you had a message command defined which used the %f or %M formatter. smbmnts check to see if a user is allowed to...

Subject: [SECURITY] New version of kernel-image for sparc fixes DoS attack

As is widely known by now the Linux 2.2.x kernels had a problem with parsing IP options, which made them susceptible to a DoS attack. The Debian GNU/Linux 2.1 release for the Sun sparc architecture uses such a kernel. If you are using such a system and havent upgraded the kernel yourself, we...

Solaris 2.67.08 - netpr Local Buffer Overflow (1)

Solaris 2.67.08 - netpr Local Buffer Overflow 1 // source: https://www.securityfocus.com/bid/1200/info A buffer overrun exists in the 'netpr' program, part of the SUNWpcu LP package included with Solaris, from Sun Microsystems. Versions of netpr on Solaris 2.6 and 7, on both Sparc and x86 have be...

[SECURITY] New version of procmail with security fixes

A new version of procmail has been released which fixes some new buffer overflows that were missed in version 3.13 . We recommend you upgrade your procmail package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.1 alias slink...

[SECURITY] new version of procmail with security fixes

A new version of procmail has been released which fixes a couple of buffer overflows and has extra security checks. We recommend you upgrade your procmail package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.1 alias slink...

[SECURITY] new version of procmail with security fixes

A new version of procmail has been released which fixes a couple of buffer overflows and has extra security checks. We recommend you upgrade your procmail package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.1 alias slink...

[SECURITY] New version of lsof fixes buffer overflow

We have received reports that the lsof package is distributed in Debian GNU/Linux 2.0 contains a buffer overflow. Using this overflow it is possible for local users to gain root-access. We have fixed this problem in version 4.37-3. We recommend you upgrade your lsof package immediately. wget url...

[SECURITY] New versions of cfengine fixes symlink attack

The maintainer of Debian GNU/Linux cfengine package found a error in the way cfengine handles temporary files when it runs the tidy action on homedirectories, which makes it suspectible to a symlink attack. The author has been notified of the problem but has not released a fix yet. We recommend y...

[SECURITY] New version of ssh may fix buffer overflows

There has been a lot of confusion over ssh lately: some people think their systems have been hacked through ssh, although nobody has been able to produce an exploit. To avoid any possible problems we have patched ssh to fix any possible buffer overruns. We think this will stop any attack that mig...

[SECURITY] New version of fte fixes access problems

We have found that the fte package as supplied in our slink frozen and potato unstable archives does not drop its root priviliges after initializing the virtual console device. This allows all users to read and write files with root priviliges, and execute all programs as root. A new package...

[SECURITY] New version of zgv fixes buffer overflows

We have received reports that the zgv package is vulnerable to buffer overflows. We recommend you upgrade your zgv package immediately. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. Debian GNU/Linux 2.0 alias hamm ------------------------------- This...