Cfengine: RSA Authentication Heap Corruption

Background Cfengine is an agent/software robot and a high level policy language for building expert systems to administrate and configure large computer networks. Description Two vulnerabilities have been found in cfservd. One is a buffer overflow in the AuthenticationDialogue function and the...

[Full-Disclosure] [OpenPKG-SA-2004.036] OpenPKG Security Advisory (cvstrac)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org [email protected] [email protected] OpenPKG-SA-2004.036 06-Aug-2004 Package: cvstrac Vulnerability: arbitrary code execution OpenPKG...

CORE-2004-0705: Vulnerabilities in PuTTY and PSCP

Core Security Technologies Advisory http://www.coresecurity.com Vulnerabilities in PuTTY and PSCP Date Published: 2004-08-04 Last Update: 2004-08-04 Advisory ID: CORE-2004-0705 Bugtraq ID: None currently assigned. CVE Name: None currently assigned. Title: Vulnerabilities in PuTTY and PSCP Class:...

DSA-536 libpng - several vulnerabilities

Bulletin has no description...

RiSearch show.pl Arbitrary File Access

The remote host appears to be running RiSearch, a local search engine. This version contains an information disclosure vulnerability. Passing a local file URI to 'show.pl' reveals that file's contents. A remote attacker could use this information to read arbitrary files from the system, which cou...

RiSearch show.pl Open Proxy Relay

The remote host seems to be running RiSearch, a local search engine. There is a flaw in the CGI 'show.pl' which is bundled with this software that could allow an attacker to use the remote host as an open proxy by doing a request like :...

Polar HelpDesk Authentication Bypass

The remote server is running Polar HelpDesk. There is a flaw in the remote version of this software that may allow an attacker to bypass the authentication mechanism of this software and gain administrative access. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. UNTESTED...

Mandrake Linux Security Advisory : krb5 (MDKSA-2002:073-1)

A stack-based buffer overflow in the implementation of the Kerberos v4 compatibility administration daemon kadmind4 in the krb5 package can be exploited to gain unauthorized root access to a KDC host. Authentication to the daemon is not required to successfully perform the attack and according to...

Mandrake Linux Security Advisory : libneon (MDKSA-2004:032)

A number of various format string vulnerabilities were discovered in the error output handling of Neon, the HTTP and WebDAV client library, by Thomas Wana. These problems affect all versions of Neon from 0.19.0 up to and including 0.24.4. All users are encouraged to upgrade. All client software...

Mandrake Linux Security Advisory : samba (MDKSA-2003:032)

The SuSE security team, during an audit of the Samba source code, found a flaw in the main smbd code which could allow an external attacker to remotely and anonymously gain root privilege on a system running the Samba server. This flaw exists in all version of Samba 2.x up to and including 2.2.7a...

Mandrake Linux Security Advisory : pam_ldap (MDKSA-2003:088)

A bug was fixed in pamldap 162 with the pamfilter mechanism which is commonly used for host-based access restriction in environments using LDAP for authentication. Mandrake Linux 9.1 provided pamldap 161 which had this problem and as a result, systems relying on pamfilter for host-based access...

Mandrake Linux Security Advisory : kernel (MDKSA-2004:037)

A vulnerability was found in the framebuffer driver of the 2.6 kernel. This is due to incorrect use of the fbcopycmap function. CVE-2004-0229 A vulnerability has been found in the Linux kernel in the ipsetsockopt function code. There is an exploitable integer overflow inside the code handling the...

Mandrake Linux Security Advisory : kde (MDKSA-2003:004-1)

Multiple instances of improperly quoted shell command execution exist in KDE 2.x up to and including KDE 3.0.5. KDE fails to properly quote parameters of instructions passed to the shell for execution. These parameters may contain data such as filenames, URLs, email address, and so forth; this da...

Mandrake Linux Security Advisory : usermode (MDKSA-2003:031-1)

The /usr/bin/shutdown command that comes with the usermode package can be executed by local users to shutdown all running processes and drop into a root shell. This command is not really needed to shutdown a system, so it has been removed and all users are encouraged to upgrade. Please note that...

Mandrake Linux Security Advisory : rsync (MDKSA-2002:024)

Ethan Benson discovered a bug in rsync where the supplementary groups that the rsync daemon runs as such as root would not be removed from the server process after changing to the specified unprivileged uid and gid. This seems only serious if rsync is called using 'rsync --daemon' from the comman...

Mandrake Linux Security Advisory : sendmail (MDKSA-2003:092)

A buffer overflow vulnerability was discovered in the address parsing code in all versions of sendmail prior to 8.12.10 by Michal Zalewski, with a patch to fix the problem provided by Todd C. Miller. This vulnerability seems to be remotely exploitable on Linux systems running on the x86 platform;...

Mandrake Linux Security Advisory : openssl (MDKSA-2004:023)

A vulnerability was discovered by the OpenSSL group using the Codenomicon TLS Test Tool. The test uncovered a NULL pointer assignment in the dochangecipherspec function whih could be abused by a remote attacker crafting a special SSL/TLS handshake against a server that used the OpenSSL library in...

Mandrake Linux Security Advisory : cups (MDKSA-2003:001)

iDefense reported several security problems in CUPS that can lead to local and remote root compromise. An integer overflow in the HTTP interface can be used to gain remote access with CUPS privilege. A local file race condition can be used to gain root privilege, although the previous bug must be...

Mandrake Linux Security Advisory : dhcpcd (MDKSA-2003:003)

A vulnerability was discovered by Simon Kelley in the dhcpcd DHCP client daemon. dhcpcd has the ability to execute an external script named dhcpcd-.exe when an IP address is assigned to that network interface. The script sources the file /var/lib/dhcpcd/dhcpcd-.info which contains shell variables...

SoX: Multiple buffer overflows

Background SoX is a command line utility that can convert various formats of computer audio files in to other formats. Description Ulf Harnhammar discovered two buffer overflows in the sox and play commands when handling WAV files with specially crafted header fields. Impact By enticing a user to...