Mandrake Linux Security Advisory : glibc (MDKSA-2000:045-1)

A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...

Mandrake Linux Security Advisory : gpm (MDKSA-2000:002)

A security bug was found in gpm-root; the bug can be exploited to provide local users with root access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:002. The text itself ...

Mandrake Linux Security Advisory : lpr (MDKSA-2003:059)

A buffer overflow was discovered in the lpr printer spooling system that can be exploited by a local user to gain root privileges. This can be done even if the printer is configured properly. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plug...

Mandrake Linux Security Advisory : imwheel (MDKSA-2000:001)

A security bug was found in imwheel; the bug can be exploited to provide local users with root access. Version 0.9.8 fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...

Mandrake Linux Security Advisory : glibc (MDKSA-2001:012)

The LDPRELOAD variable in the GNU C Library is honoured normally even for SUID/SGID applications but removed afterwards from the environment if it does not contain '/' characters. There is a special check which only preloads found libraries if they have the SUID bit set. However, if a library has...

Mandrake Linux Security Advisory : sudo (MDKSA-2001:024-1)

A buffer overflow exists in the sudo program which could be used by an attacker to obtain higher privileges. sudo is a program used to delegate superuser privileges to ordinary users and only for specific commands. Update : The sudo package for 7.1 used the system-auth facility of newer pam...

Mandrake Linux Security Advisory : dump (MDKSA-2000:018)

There was the potential for a buffer overflow exploit in the restore program. This new version fixes this possible vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...

Mandrake Linux Security Advisory : sgml-tools (MDKSA-2001:030-1)

Insecure handling of temporary file permissions can lead to other users on a multi-user system being able to read the documents being converted. This is due to sgml-tools creating temporary files without any special permissions. The updated packages create a secure temporary directory first, whic...

Mandrake Linux Security Advisory : mgetty (MDKSA-2000:042)

There is a problem in the mgetty package, which contains a number of tools for sending and receiving faxes. The faxrunq tool uses a marker file in the /tmp directory, which is world-writable, in an insecure fashion. This problem, if exploited, allows malicious users to overwrite files on the syst...

Mandrake Linux Security Advisory : cdrecord (MDKSA-2000:009)

The linux cdrecord binary is vulnerable to a locally exploitable buffer overflow attack. When installed on a Linux-Mandrake distribution, it is by default setgid 'cdburner' which is a group, gid: 80, that is created for the application. The overflow condition is the result of no bounds checking o...

Mandrake Linux Security Advisory : perl-Digest-MD5 (MDKSA-2002:035)

A bug exists in the UTF8 interaction between the perl-Digest-MD5 module and perl that results in UTF8 strings having improper MD5 digests. The 2.20 version of the module corrects this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

Mandrake Linux Security Advisory : xlockmore (MDKSA-2000:011)

Xlock is an X11 utility used to lock X-Window displays until the password of the user running X is entered correctly. Of course, in order to perform the password-check xlock must be setuid root and have access to the shadowed passwd file. In the xlockmore distributions versions prior to 4.16.1, a...

Mandrake Linux Security Advisory : tcsh (MDKSA-2000:069)

A vulnerability exists with tcsh when using the in-here documents with the syntax. When doing this, tcsh uses a temporary file to store the data. Unfortunately, the temporary file is not created securely and standard symlink attacks can be used to make tcsh overwrite arbitrary files. %NASLMINLEVE...

Mandrake Linux Security Advisory : ypserv (MDKSA-2000:064)

A format string parsing bug exists in ypbind 3.3 if it is run in debug mode which leaks file descriptors under certain circumstances which can lead to a DoS. In addition, ypbind may suffer from buffer overflows. In the ypserv program, a buffer overflow and format bug exist if the build system doe...

Mandrake Linux Security Advisory : koffice (MDKSA-2005:056)

Previous updates to correct integer overflow issues affecting xpdf overlooked certain conditions when built for a 64 bit platform. formerly CVE-2004-0888. This also affects applications like koffice, that use embedded versions of xpdf. The updated packages are patched to deal with these issues...

Mandrake Linux Security Advisory : wu-ftpd (MDKSA-2003:080)

A vulnerability was discovered by Janusz Niewiadomski and Wojciech Purczynski in the wu-ftpd FTP server package. They found an off-by- one bug in the fbrealpath function which could be used by a remote attacker to obtain root privileges on the server. This bug can only be successfully accomplishe...

Mandrake Linux Security Advisory : mutt (MDKSA-2001:031)

A format string vulnerability was present in the IMAP code in versions of the mutt email client previous to 1.2.5. This had the effect that a compromised or malicious IMAP server could possibly execute code on the local machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : apache (MDKSA-2000:060-2)

The Apache web server comes with a module called modrewrite which is used to rewrite URLs presented by the client prior to further processing. There is a flaw in the modrewrite logic that allows an attacker to view arbitrary files on the server system if they contain regular expression references...

Mandrake Linux Security Advisory : fdutils (MDKSA-2000:005)

A vulnerability in fdmount will allow any user to exploit a buffer overflow. This user, when he is in the floppy group, can have a root access on the machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake...

Mandrake Linux Security Advisory : bash1 (MDKSA-2000:075)

The bash1 shell program has the same vulnerability that tcsh has and incorrectly creates temporary files without the OEXCL flag. This vulnerability does not exist in bash2 which uses the OEXCL flag when creating temporary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...