Mandrake Linux Security Advisory : telnet (MDKSA-2001:068)

A buffer overflow exists in telnet which could provide root access to local users. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2001:068. The text itself is copyright C Mandri...

Mandrake Linux Security Advisory : glibc (MDKSA-2003:107)

A bug was discovered in the getgrouplist function in glibc that can cause a buffer overflow if the size of the group list is too small to hold all the user's groups. This overflow can cause segementation faults in various user applications, some of which may lead to additional security problems...

Mandrake Linux Security Advisory : evolution (MDKSA-2003:045)

Several vulnerabilities were discovered in the Evolution email client. These problems make it possible for a carefully constructed email message to crash the program, causing general system instability by starving resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive tex...

Mandrake Linux Security Advisory : sendmail (MDKSA-2003:028)

A vulnerability was discovered in sendmail by Mark Dowd of ISS X-Force that involves mail header manipulation that can result in a remote user gaining root access to the system running the vulnerable sendmail. Patches supplied by the sendmail development team have been applied to correct this...

Mandrake Linux Security Advisory : sysklogd (MDKSA-2004:038)

Steve Grubb discovered a bug in sysklogd where it allocates an insufficient amount of memory which causes sysklogd to write to unallocated memory. This could allow for a malicious user to crash sysklogd. The updated packages provide a patched sysklogd using patches from Openwall to correct the...

Mandrake Linux Security Advisory : lynx (MDKSA-2003:023)

A vulnerability was discovered in lynx, a text-mode web browser. The HTTP queries that lynx constructs are from arguments on the command line or the $WWWHOME environment variable, but lynx does not properly sanitize special characters such as carriage returns or linefeeds. Extra headers can be...

Mandrake Linux Security Advisory : proftpd (MDKSA-2004:041)

A portability workaround that was applied in version 1.2.9 of the ProFTPD FTP server caused CIDR based ACL entries in 'Allow' and 'Deny' directives to act like an 'AllowAll' directive. This granted FTP clients access to files and directories that the server configuration may have been explicitly...

Mandrake Linux Security Advisory : sox (MDKSA-2004:076)

Ulf Harnhammar discovered two buffer overflows in SoX. They occur when the sox or play commands handle malicious .WAV files. Versions 12.17.4, 12.17.3 and 12.17.2 are vulnerable to these overflows. 12.17.1, 12.17 and 12.16 are some versions that are not. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : xinetd (MDKSA-2001:055-1)

A bug exists in xinetd as shipped with Mandrake Linux 8.0 dealing with TCP connections with the WAIT state that prevents linuxconf-web from working properly. As well, xinetd contains a security flaw in which it defaults to a umask of 0. This means that applications using the xinetd umask that do...

Mandrake Linux Security Advisory : openssh (MDKSA-2001:081)

In some circumstances, the sshd server may not honor the 'from=' option that can be associated with a key in a user's /.ssh/authorizedkeys2 file if multiple keys are listed. This could allow key-based logins from hosts which should not be allowed access. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : groff (MDKSA-2002:012)

zen-parse discovered an exploitable buffer overflow in groff's preprocessor. If groff is invoked using the LPRng printing system, an attacker can gain rights as the 'lp' user. Likewise, this may be remotely exploitable if lpd is running and remotely accessible and the attacker knows the name of t...

Mandrake Linux Security Advisory : tar (MDKSA-2002:066)

A directory traversal vulnerability was discovered in GNU tar version 1.13.25 and earlier that allows attackers to overwrite arbitrary files during extraction of the archive by using a '..' dot dot in an extracted filename. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Mandrake Linux Security Advisory : samba (MDKSA-2003:044)

An exploitable buffer overflow was discovered in the Samba server that can lead to an anonymous remote root compromise. The Samba Team also discovered some potential overflows during an internal code audit which was done in response to the previously noted buffer overflow problem. All versions of...

Mandrake Linux Security Advisory : fetchmail (MDKSA-2001:063)

Wolfram Kleff reported recently that the fetchmail program would segfault when receiving emails with a very large 'To:' header. This is due to a buffer overflow within the header parsing code, which can be exploited remotely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive te...

Mandrake Linux Security Advisory : cvs (MDKSA-2003:112-1)

A vulnerability was discovered in the CVS server 1.11.10 where a malformed module request could cause the CVS server to attempt to create directories and possibly files at the root of the filesystem holding the CVS repository. Updated packages are available that fix the vulnerability by providing...

Mandrake Linux Security Advisory : kernel (MDKSA-2003:038-1)

A bug in the kernel module loader code could allow a local user to gain root privileges. This is done by a local user using ptrace and attaching to a modprobe process that is spawned if the user triggers the loading of a kernel module. A temporary workaround can be used to defend against this fla...

Mandrake Linux Security Advisory : openssl (MDKSA-2003:020)

In an upcoming paper, Brice Canvel EPFL, Alain Hiltgen UBS, Serge Vaudenay EPFL, and Martin Vuagnoux EPFL, Ilion describe and demonstrate a timing-based attack on CBC ciphersuites in SSL and TLS. New versions of openssl have been released in response to this vulnerability 0.9.6i and 0.9.7a. The...

Mandrake Linux Security Advisory : apache-mod_perl (MDKSA-2004:046-1)

Four security vulnerabilities were fixed with the 1.3.31 release of Apache. All of these issues have been backported and applied to the provided packages. Thanks to Ralf Engelschall of OpenPKG for providing the patches. Apache 1.3 prior to 1.3.30 did not filter terminal escape sequences from its...

Mandrake Linux Security Advisory : tcpdump (MDKSA-2003:027)

A vulnerability was discovered by Andrew Griffiths and iDEFENSE Labs in the tcpdump program. By sending a specially crafted network packet, an attacker is able to to cause tcpdump to enter an infinite loop. In addition, the tcpdump developers found a potential infinite loop when tcpdump parses...

Mandrake Linux Security Advisory : openssh (MDKSA-2001:092)

The new OpenSSH 3.0.2 fixes a vulnerability in the UseLogin option. By default, Mandrake Linux does not enable UseLogin, but if the administrator enables it, local users are able to pass environment variables to the login process. This update also fixes a security hole in the KerberosV support th...