Mandrake Linux Security Advisory : mutt (MDKSA-2001:031)

A format string vulnerability was present in the IMAP code in versions of the mutt email client previous to 1.2.5. This had the effect that a compromised or malicious IMAP server could possibly execute code on the local machine. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : bash1 (MDKSA-2000:075)

The bash1 shell program has the same vulnerability that tcsh has and incorrectly creates temporary files without the OEXCL flag. This vulnerability does not exist in bash2 which uses the OEXCL flag when creating temporary files. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Mandrake Linux Security Advisory : xsoldier (MDKSA-2000:004)

A vulnerability in xsoldier will allow any user to exploit a buffer overflow. This user does not have to have a valid $DISPLAY to exploit this. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:043)

The exploit that was not fixed with the previous Zope hotfix involves the getRoles method of user objects contained in the default UserFolder implementation returning a mutable Python type. Because the mutable object is still associated with the persistent User object, users with the ability to...

Mandrake Linux Security Advisory : xlockmore (MDKSA-2000:011)

Xlock is an X11 utility used to lock X-Window displays until the password of the user running X is entered correctly. Of course, in order to perform the password-check xlock must be setuid root and have access to the shadowed passwd file. In the xlockmore distributions versions prior to 4.16.1, a...

Mandrake Linux Security Advisory : sysklogd (MDKSA-2000:050-1)

A problem exists with the kernel logging daemon klogd in the sysklogd package. A 'format bug' makes klogd vulnerable to local root compromise, as well as the possibility for remote vulnerabilities under certain circumstances, which are unprobable. There is also a more probable semi-remote exploit...

Mandrake Linux Security Advisory : nmh (MDKSA-2000:000)

The nmh package contains a security bug in MIME headers parsing which can be exploited to trick mhshow into executing arbitrary shell code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security...

Mandrake Linux Security Advisory : mgetty (MDKSA-2000:042)

There is a problem in the mgetty package, which contains a number of tools for sending and receiving faxes. The faxrunq tool uses a marker file in the /tmp directory, which is world-writable, in an insecure fashion. This problem, if exploited, allows malicious users to overwrite files on the syst...

Mandrake Linux Security Advisory : glibc (MDKSA-2000:045-1)

A bug was discovered in ld.so that could allow local users to obtain root privileges. The dynamic loader, ld.so, is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be...

Mandrake Linux Security Advisory : xemacs (MDKSA-2000:006)

From the Caldera advisory : under some circumstances, users are able to snoop on other users' keystrokes. This is a serious problems if you use modules that require e.g. input of passwords, such as MailCrypt. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Mandrake Linux Security Advisory : joe (MDKSA-2001:026)

The joe text editor looks for configuration files in the current working directory, the user's home directory, and finally in /etc/joe. A malicious user could create their own .joerc configuration file and attempt to get other users to use it. If this were to happen, the user could potentially...

Mandrake Linux Security Advisory : perl (MDKSA-2000:031)

There is a vulnerability that exists when using setuidperl together with the mailx program. In some cases, setuidperl will warn root that something has going on. The setuidperl program uses /bin/mail to send the message, as root, with the environment preserved. An undocumented feature of /bin/mai...

Mandrake Linux Security Advisory : jpilot (MDKSA-2000:081)

The jpilot program automatically creates a directory called .jpilot/ in the user's home directory with 777 world read/write/execute permissions. This directory is used to store all backups, configuration and synchronized Palm Pilot information. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mandrake Linux Security Advisory : linuxconf (MDKSA-2001:011)

WireX discovered a potential temporary file race problem in the vpop3d program in the linuxconf package. This update corrects the problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Adviso...

Mandrake Linux Security Advisory : rp-pppoe (MDKSA-2000:084)

rp-pppoe is a userspace PPPoE client mainly used with ADSL connections which require PPP. Versions prior to 2.5 have a security problem that, when exploited, causes the connection to be dropped. If rp-pppoe receives a crafted TCP segment with an option where the option-length field is zero illega...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:048)

"A problem exists with PHP3 and PHP4 scripts regarding RFC 1867-based file uploads. PHP saves uploaded files in a temporary directory on the server, using a temporary name that is referenced as the variable $FOO where 'FOO' is the name of the file input tag in the submitted form. Many PHP scripts...

Mandrake Linux Security Advisory : gnupg (MDKSA-2000:063-1)

A problem exists in all versions of GnuPG prior to and including 1.0.3. Because of this problem, GnuPG may report files which have been signed with multiple keys one or more of which may be incorrect to be valid even if one of the signatures is in fact valid. Update : The previous packages...

Mandrake Linux Security Advisory : nfs-utils (MDKSA-2000:021)

A bug recently discovered in the nfs-utils package can theoretically be used for gaining remote root access. While there are currently no known exploits for this bug, we recommend upgrading to the latest version which fixes the bug. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

Mandrake Linux Security Advisory : Mesa (MDKSA-2001:029)

Ben Collins identified a temporary file race in the Utah-glx component of the Mesa package which affects Linux-Mandrake 7.2. The /tmp/glxmemory file is created by Utah-glx and because it is not created securely could be used in a symlink attack which allows files to be overwritten the next time t...

Mandrake Linux Security Advisory : BitchX (MDKSA-2000:017)

A denial of service vulnerability exists in BitchX. Improper handling of incoming invitation messages can crash the client. Any user on IRC can send the client an invitation message that causes BitchX to segfault. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and packa...