CVE-2001-1190

CVE-2001-1190 concerns Mandrake Linux 8.1 where the default PAM files used by the passwd program do not support MD5 passwords. The root cause stated in connected advisories is the lack of MD5 support in the default PAM configuration, which can yield weaker password security than intended. The evi...

mutt remote exploit patched

An exploitable overflow has been found in the address handling code of the mutt mail client version 1.2.5i supplied with Slackware 8.0. A new mutt-1.2.5.1 has been released which addresses this problem, and packages are now available for Slackware 8.0 and -current. We urge all Slackware users to...

sendmail and procmail update

An input validation error in sendmail has been discovered by Cade Cairns of SecurityFocus. This problem can be exploited by local users to gain root access. It is not exploitable by remote attackers without shell access. New packages based on sendmail.8.11.6 have been prepared for Slackware 7.1 a...

CVE-2001-0497

dnskeygen in BIND 8.2.4 and earlier, and dnssec-keygen in BIND 9.1.2 and earlier, set insecure permissions for a HMAC-MD5 shared secret key file used for DNS Transactional Signatures TSIG, which allows attackers to obtain the keys and perform dynamic DNS updates...

NetWin Authentication Module 3.0b password storage vulnerabilities / buffer overflows

NetWin Authentication Module 3.0b password storage vulnerabilities / buffer overflows AFFECTED SYSTEMS NWAuth module as used by DMail, SurgeFTP, others... cfr www.netwinsite.com I've tested SurgeFTP in particular The source code for NWAuth 2.0 can be found at...

PT-2001-1707 · Isc · Bind

Name of the Vulnerable Software and Affected Versions: BIND versions 8.2.4 and earlier BIND versions 9.1.2 and earlier Description: The issue allows attackers to obtain HMAC-MD5 shared secret keys used for DNS Transactional Signatures TSIG due to insecure permissions set by dnskeygen in BIND 8 an...

Security Update: [CSSA-2001-SCO.6] UnixWare: statd buffer overflow

To: [email protected] [email protected] [email protected] Caldera International, Inc. Security Advisory Subject: UnixWare: statd buffer overflow Advisory number: CSSA-2001-SCO.6 Issue date: 2001 July 2 Cross reference: 1. Problem Description The nfs daemo...

Security Update: [CSSA-2001-SCO.2] UnixWare - su buffer overflow

To: [email protected] [email protected] Caldera International, Inc. Security Advisory Subject: UnixWare - su buffer overflow Advisory number: CSSA-2001-SCO.2 Issue date: 2001 June, 26 Cross reference: 1. Problem Description The su command is vulnerable to a comman...

ISS Advisory: BIND Inadvertent Local Exposure of HMAC-MD5 (TSIG) Keys

TO UNSUBSCRIBE: email "unsubscribe alert" in the body of your message to [email protected] Contact [email protected] for help with any problems! --------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Internet Security Systems Security...

Security Advisories

TurboLinux Security Announcement Package: dialog Vulnerable Packages: All Turbolinux versions previous to 0.9a-2 Date: 05/03/2001 5:00 PDT Affected TurboLinux platforms: TL Server 6.5, TL Workstation 6.1 Turbolinux versions 6.0.5 and earlier TurboLinux Advisory ID: TLSA2001006 Credits: Reported b...

[TL-Security-Announce] fetchmail-5.5.0-3.i386.rpm TLSA2000024-1

TurboLinux Security Announcement Package: fetchmail-5.5.0-2 and earlier Date: Wednesday December 27 5:00 PDT 2000 Affected TurboLinux versions:TL 6.1 WorkStation, All TurboLinux versions 6.0.5 and earlier TurboLinux Advisory ID: TLSA2000024-1 Credits: This bug was reported by Red Hat on November...

[SECURITY] New version of ghostscript released

------------------------------------------------------------------------ Debian Security Advisory [email protected] http://www.debian.org/security/ Wichert Akkerman November 23, 2000 - ------------------------------------------------------------------------ Package : gs Problem type : symlink...

CVE-2000-0301

Ipswitch IMAIL server 6.02 and earlier allows remote attackers to cause a denial of service via the AUTH CRAM-MD5 command...

CVE-2000-0301

CVE-2000-0301 affects Ipswitch IMAIL server 6.02 and earlier. The issue enables remote attackers to cause a denial of service by sending the AUTH CRAM-MD5 command, impacting availability. The record lists a network-exposed attack with no authentication and a partial availability impact (CVSS v2 b...

: glibc 2.1.3 vulnerabilities patched

Three locale-related vulnerabilities with glibc 2.1.3 were recently reported on BugTraq. These vulnerabilities could allow local users to gain root access. Users of Slackware 7.0, 7.1, and -current are strongly urged to upgrade to the new glibc packages in the -current branch...

MDKSA-2000:034 MandrakeUpdate update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: MandrakeUpdate Date: August 12th, 2000 Advisory ID: MDKSA-2000:034 Affected versions: 6.0, 6.1, 7.0, 7.1 Problem Description: There is a possible race condition in MandrakeUpdate that has the...

MDKSA-2000:028 kon2 update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Linux-Mandrake Security Update Advisory Package name: kon2 Date: August 1st, 2000 Advisory ID: MDKSA-2000:028 Affected versions: 7.0, 7.1 Problem Description: There is a vulnerable suid program called fld. This program accepts option input from a text...

Re: IMAIL (Ipswitch) DoS with Eudora (Qualcomm)

I'm the lead developer for Windows Eudora here at Qualcomm, and I've been the one who has investigated these issues of SMTP authentication with IPSwitch's IMail server. Here's some details that may be helpful for IMail users: The problem is with IMail SMTP server versions 6.02 and below. When the...

CVE-2000-0301

Ipswitch IMAIL server 6.02 and earlier allows remote attackers to cause a denial of service via the AUTH CRAM-MD5 command...

CVE-2000-0093

The CVE-2000-0093 entry concerns Red Hat installations that use DES-encrypted passwords via crypt() for the initial password instead of MD5. Affected component is the initial password handling in Red Hat setups; root cause is the use of DES crypt() rather than a stronger hash. Documents explicitl...