Debian DSA-357-1 : wu-ftpd - remote root exploit

iSEC Security Research reports that wu-ftpd contains an off-by-one bug in the fbrealpath function which could be exploited by a logged-in user local or anonymous to gain root privileges. A demonstration exploit is reportedly available. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Debian DSA-527-1 : pavuk - buffer overflow

Ulf Harnhammar discovered a vulnerability in pavuk, a file retrieval program, whereby an oversized HTTP 305 response sent by a malicious server could cause arbitrary code to be executed with the privileges of the pavuk process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-414-1 : jabber - denial of service

A vulnerability was discovered in jabber, an instant messaging server, whereby a bug in the handling of SSL connections could cause the server process to crash, resulting in a denial of service. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Debian DSA-400-1 : omega-rpg - buffer overflow

Steve Kemp discovered a buffer overflow in the commandline and environment variable handling of omega-rpg, a text-based rogue-style game of dungeon exploration, which could lead a local attacker to gain unauthorised access to the group games. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

Debian DSA-440-1 : linux-kernel-2.4.17-powerpc-apus - several vulnerabilities

Several local root exploits have been discovered recently in the Linux kernel. This security advisory updates the PowerPC/Apus kernel for Debian GNU/Linux. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update : - CAN-2003-0961 : An...

Debian DSA-406-1 : lftp - buffer overflow

Ulf Harnhammar discovered a buffer overflow in lftp, a set of sophisticated command-line FTP/HTTP client programs. An attacker could create a carefully crafted directory on a website so that the execution of an 'ls' or 'rels' command would lead to the execution of arbitrary code on the client...

Debian DSA-219-1 : dhcpcd - remote command execution

Simon Kelly discovered a vulnerability in dhcpcd, an RFC2131 and RFC1541 compliant DHCP client daemon, that runs with root privileges on client machines. A malicious administrator of the regular or an untrusted DHCP server may execute any command with root privileges on the DHCP client machine by...

Debian DSA-345-1 : xbl - buffer overflow

Another buffer overflow was discovered in xbl, distinct from the one addressed in DSA-327 CAN-2003-0451, involving the-display command line option. This vulnerability could be exploited by a local attacker to gain gid 'games'. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Debian DSA-501-1 : exim - buffer overflow

Georgi Guninski discovered two stack-based buffer overflows. They can not be exploited with the default configuration from the Debian system, though. The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with this update : - CAN-2004-0399 When...

Debian DSA-021-1 : apache - insecure tempfile bug, broken mod_rewrite

WireX have found some occurrences of insecure opening of temporary files in htdigest and htpasswd. Both programs are not installed setuid or setgid and thus the impact should be minimal. The Apache group has released another security bugfix which fixes a vulnerability in modrewrite which may resu...

Debian DSA-017-1 : jazip - buffer overflow

With older versions of jazip a user could gain root access for members of the floppy group to the local machine. The interface doesn't run as root anymore and this very exploit was prevented. The program now also truncates DISPLAY to 256 characters if it is bigger, which closes the buffer overflo...

Debian DSA-077-1 : squid - remote DoS

Vladimir Ivaschenko found a problem in squid a popular proxy cache. He discovered that there was a flaw in the code to handle FTP PUT commands: when a mkdir-only request was done squid would detect an internal error and exit. Since squid is configured to restart itself on problems this is not a b...

Debian DSA-333-1 : acm - integer overflow

acm, a multi-player aerial combat simulation, uses a network protocol based on the same RPC implementation used in many C libraries. This implementation was found to contain an integer overflow vulnerability which could be exploited to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network...

Debian DSA-012-1 : micq - remote buffer overflow

PkC has reported that there is a buffer overflow in sprintf in micq versions 0.4.6 and previous, that allows to a remote attacker able to sniff packets to the ICQ server to execute arbitrary code on the victim system. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Debian DSA-282-1 : glibc - integer overflow

eEye Digital Security discovered an integer overflow in the xdrmemgetbytes function which is also present in GNU libc. This function is part of the XDR external data representation encoder/decoder derived from Sun's RPC implementation. Depending upon the application, this vulnerability can cause...

Debian DSA-429-1 : gnupg - cryptographic weakness

Phong Nguyen identified a severe bug in the way GnuPG creates and uses ElGamal keys for signing. This is a significant security failure which can lead to a compromise of almost all ElGamal keys used for signing. This update disables the use of this type of key. %NASLMINLEVEL 70300 C Tenable Netwo...

Debian DSA-247-1 : courier-ssl - missing input sanitizing

The developers of courier, an integrated user side mail server, discovered a problem in the PostgreSQL auth module. Not all potentially malicious characters were sanitized before the username was passed to the PostgreSQL engine. An attacker could inject arbitrary SQL commands and queries exploiti...

Debian DSA-060-1 : fetchmail - buffer overflow

Wolfram Kleff found a problem in fetchmail: it would crash when processing emails with extremely long headers. The problem was a buffer overflow in the header parser which could be exploited. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Debian DSA-301-1 : libgtop - buffer overflow

The gtop daemon, used for monitoring remote machines, contains a buffer overflow which could be used by an attacker to execute arbitrary code with the privileges of the daemon process. If started as root, the daemon process drops root privileges, assuming uid and gid 99 by default. This bug was...

Debian DSA-398-1 : conquest - buffer overflow

Steve Kemp discovered a buffer overflow in the environment variable handling of conquest, a curses based, real-time, multi-player space warfare game, which could lead a local attacker to gain unauthorised access to the group conquest. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...