Mandrake 6.1/7.0/7.1 /perl http Directory Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1678/info The default configuration files for versions of modperl shipped with Mandrake Linux 6.1 through 7.1 contain a misconfiguration that can be a security concern in some situations. The /perl directory is part of th...

Mandrake Linux Security Advisory : kdesu (MDKSA-2000:008)

A vulnerability in kdesud will allow any user to exploit a buffer overflow. This user then can have a root group access on the machine, by exploiting a bug in the kdesud program. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandrake Linux Security Advisory : slrn (MDKSA-2001:028)

A buffer overflow exists in versions of the slrn news reader prior to 0.9.6.3pl4 as reported by Bill Nottingham. This problem exists in the wrapping/unwrapping functions and a long header in a message might overflow a buffer which could result in execution of arbitrary code encoded in the message...

Mandrake Linux Security Advisory : pam (MDKSA-2000:029)

There is a problem with the pamconsole module that incorrectly identifies remote X logins for displays other than :0 for example, :1, :2, etc. as being local displays, thus giving control of the console to the remote user. Because the remote user has control of the console they are able to issue...

Mandrake Linux Security Advisory : openldap (MDKSA-2000:003)

OpenLDAP follows symbolic links when creating files. The default location for these files is /usr/tmp, which is a symlink to /tmp, which in turn is a world-writable directory. Local users can destroy the contents of any file on any mounted filesystem. %NASLMINLEVEL 70300 C Tenable Network Securit...

Mandrake Linux Security Advisory : inn (MDKSA-2000:023)

A vulnerability exists when verifycancels is enabled in /etc/news/inn.conf. This vulnerability could be used to gain root access on any system with inn installed. This new version also does not install inews as setgid news or rnews as setuid root. Many other security paranoia fixes have been made...

Mandrake Linux Security Advisory : ghostscript (MDKSA-2000:074)

The ghostscript package uses mktemp instead of mkstemp to create temporary files. It also uses improper LDRUNPATH values, which causes it to search for libraries in the current directory. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

Mandrake Linux Security Advisory : timed (MDKSA-2001:034)

The time server daemon, timed, tries to synchronize the local host time with the time of other machines on a local area network. A bug in timed, as reported by the FreeBSD Security Officer, that could be triggered remotely can crash the time server daemon. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : xinetd (MDKSA-2002:053)

A vulnerability was discovered by Solar Designer in xinetd. File descriptors for the signal pipe that were introduced in version 2.3.4 are leaked into services started by xinetd, which can then be used to talk to xinetd, resulting in a crash of xinetd. %NASLMINLEVEL 70300 C Tenable Network...

Mandrake Linux Security Advisory : kon2 (MDKSA-2000:028)

There is a vulnerable suid program called fld. This program accepts option input from a text file and it is possible to input arbitrary code into the stack, thus spawning a root shell. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Mandrake Linux Security Advisory : xlockmore (MDKSA-2000:038)

A bug exists in previous versions of xlockmore with display name passing '%d' as the display name. This bug is corrected in this version. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisor...

Mandrake Linux Security Advisory : gnupg (MDKSA-2000:087)

When importing keys from public key servers, GnuPG will import private keys also known as secret keys in addition to public keys. If this happens, the user's web of trust becomes corrupt. Additionally, when used to check detached signatures, if the data file being checked contains clearsigned dat...

Mandrake Linux Security Advisory : mod_php3 (MDKSA-2000:062)

PHP version 3 which ships with Linux-Mandrake are vulnerable to format string attacks due to logging functions that make improper use of the syslog and vsnprintf functions. This renders PHP3-enabled servers vulnerable to compromise by remote attackers. This attack is only effective on PHP...

Mandrake Linux Security Advisory : php (MDKSA-2001:013)

There are two security problems with php4 as shipped in Linux-Mandrake 7.2. It is possible to specify PHP directives on a per-directory basis under Apache and a remote attacker could carefully craft an HTTP request that would cause the next page to be served with the wrong values for these...

Mandrake Linux Security Advisory : ncurses (MDKSA-2001:052)

An overflowable buffer in the part of the ncurses library that handles cursor movement existed in versions of ncurses prior to 5.2. Attackers could force a privileged application to use their own termcap file containing a special terminal entry which would trigger the overflow, allowing them to...

Mandrake Linux Security Advisory : mgetty (MDKSA-2001:009)

WireX discovered a potential temporary file race condition in the mgetty program. All versions of mgetty prior to 1.1.24 are vulnerable. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...

Mandrake Linux Security Advisory : ed (MDKSA-2000:076)

Alan Cox discovered that GNU ed a classed line editor tool creates temporary files unsafely. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory MDKSA-2000:076. The text itself is copyrigh...

Mandrake Linux Security Advisory : licq (MDKSA-2001:032-1)

Versions of Licq prior to 1.0.3 have a vulnerability involving the way Licq parses received URLs. The received URLs are passed to the web browser without any sanity checking by using the system function. Because of the lack of checks on the URL, remote attackers can pipe other commands with the...

Mandrake Linux Security Advisory : Zope (MDKSA-2000:083)

There is an issue involving security registration of 'legacy' names for certain object constructors such as the constructors for DTML Method Objects. Security was not being applied correctly for the legacy names, making it possible to call those constructors without the permissions that should ha...

Mandrake Linux Security Advisory : imwheel (MDKSA-2000:001)

A security bug was found in imwheel; the bug can be exploited to provide local users with root access. Version 0.9.8 fixes this problem. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Mandrake Linux Security Advisory...