MDKSA-2001:043 - rpmdrake update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: rpmdrake Date: April 27th, 2001 Advisory ID: MDKSA-2001:043 Affected versions: 8.0 Problem Description: A temporary file vulnerability exists in rpmdrake. This updated rpmdrake corrects the problem...

(SRPRE00002) phpSecurePages 0.23 beta

================================================= Secure Reality Pty Ltd. Security Pre-Advisory 2 SRPRE00002 http://www.securereality.com.au ================================================= Title Remote command execution vulnerabilities in phpSecurePages Released 23/4/2001 This is a pre-release...

buffer overflow fix for NTP

The version of xntp3 that shipped with Slackware 7.1 as well as the version that was in Slackware -current contains a buffer overflow bug that could lead to a root compromise. Slackware 7.1 and Slackware -current users are urged to upgrade to the new packages available for their release. The...

Security Bulletin MS01-016

---------------------------------------------------------------------- Title: Malformed WebDAV Request Can Cause IIS to Exhaust CPU Resources Date: 08 March 2001 Software: IIS 5.0 Impact: Denial of Service Bulletin: MS01-016 Microsoft encourages customers to review the Security Bulletin at:...

[TL-Security-Announce] Sendmail-8.11.2-5 TLSA2001003-1

TurboLinux Security Announcement Vulnerable Packages: All versions previous to 8.11.2-5 Date: 02/21/2001 5:00 PDT Affected TurboLinux versions:TL 6.1 WorkStation, All TurboLinux versions 6.0.5 and earlier TurboLinux Advisory ID: TLSA2001003-1 Credits: Vulnerability discovered by Michal Zalewski o...

multiple vulnerabilities in bind 8.x

Multiple vulnerabilities exist in the versions of BIND found in Slackware 7.1 and -current. Users of BIND 8.x are urged to upgrade to 8.2.3 to fix these problems. More information can be found on the BIND website: http://www.isc.org/products/BIND/ ... and in the CERT Advisory CA-2001-02 - Multipl...

glibc 2.2 local vulnerability on setuid binaries

glibc-2.2 contains a local vulnerability that affects all setuid root binaries. Any user on affected systems will be able to read any file on the system through a simple process: The user sets the RESOLVHOSTCONF environment variable to the name of the file that they wish to read, then runs any...

dislocate 1.3 - Local i386

/ MasterSecuritY dislocate.c - Local i386 exploit in v1.3 Updated versions of this exploit and the corresponding advisory will be made available at: ftp://maxx.via.ecp.fr/dislocate/ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public...

MS Windows IIS Unicode Remote Transversal Bug (2)

Exploit for unknown platform in category remote exploits ================================================= MS Windows IIS Unicode Remote Transversal Bug 2 ================================================= /\ Microsoft IIS 4.0/5.0 Extended UNICODE Directory Traversal Exploit proof of theory exploi...

FreeBSD-SA-00:67.gnupg

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= FreeBSD-SA-00:67 Security Advisory FreeBSD, Inc. Topic: gnupg fails to correctly verify signatures Category: ports Module: gnupg Announced: 2000-11-10 Credits: Jim Small Affects: Ports...

buffer overflow vulnerability in Pine

Pine versions 4.21 and before contain a buffer overflow vulnerability which allows a remote user to execute arbitrary code on the local client by the sending of a special-crafted email message. The overflow occurs during the periodic "new mail" checking of an open folder. By upgrading to Pine 4.3...

tcsh: unsafe tempfile in << redirects

PROBLEM: /tmp echo 'hello world' rootfile /tmp chmod 600 rootfile /tmp ln -s rootfile sh$$ /tmp chown -h 666.666 sh$$ /tmp ls -l rootfile sh$$ -rw------- 1 root root 12 Oct 29 03:55 rootfile lrwxrwxrwx 1 666 666 8 Oct 29 03:56 sh12660 - rootfile /tmp cat BAR ? FOO ? BAR FOO o world /tmp ls -l...

Local /tmp vulnerability fixed in ppp-off

A local /tmp bug in the /usr/sbin/ppp-off program was found. This bug could allow a local user to corrupt system files. A fix has been made and an updated package is now available in the -current branch. The package described below will work for users of Slackware 7.0, 7.1, and -current...

root exploit with xlockmore fixed

A root exploit has been found in xlockmore packaged with Slackware. By providing a carefully crafted display variable to xlock, it is possible for a local attacker to gain root access. Anyone running xlock on a public machine should upgrade to this version of xlock or disable xlock altogether...

Denial of Service attack against computers running Microsoft NetMeeting

Diversified Software Industries, Inc. www.dsi-inc.net/dsi Security Advisory October 16, 2000 Denial of Service attack against computers running Microsoft NetMeeting 1. Description 2. Steps to reproduce exploit 3. Vendor status and solution 4. Disclaimer 5. Credits 6. About DSI...

MDKSA-2000:057 - openssh update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: openssh Date: October 10th, 2000 Advisory ID: MDKSA-2000:057 Affected versions: 7.0, 7.1 Problem Description: A problem exists with openssh's scp program. If a user uses scp to move files from a...

wu-ftpd advisory update

UPDATE: This announcement was first mailed out on 28-Sep-2000. It was later determined that incorrect 16-bit sums and 128-bit MD5 message digests were included in the announcement. The announcement below is identical to the one from yesterday, but it includes the correct verification data. We...

klogd Kernel Logger vulnerability and fix

A string format / buffer overflow bug has been discovered in klogd, the kernel logging daemon. Please upgrade to the new sysklogd 1.4 package available on the Slackware FTP site. ========================================================================= sysklogd 1.4 AVAILABLE - a1/sysklogd.tgz...

: xchat input validation bug fixed

An input validation bug was found to affect Slackware Linux 7.0, 7.1, and -current. The problem is described in detail at this site: http://www.securityfocus.com/bid/1601 Users of Slackware 7.0, 7.1, and -current are urged to upgraded to the xchat.tgz package available in the Slackware -current...

[SECURITY] glibc update for Debian GNU/Linux 2.1 (update)

Package: glibc Vulnerability: local exploit Debian-specific: no Recently two problems have been found in the glibc suite, which could be used to trick setuid applications to run arbitrary code. An earlier advisory listed the updates for Debian 2.2/potato. This advisory contains updates for Debian...