Debian 2.2: DSA-098-1 Severe: Libgtop Unauthorized Access Vulnerability

Package : libgtop
Problem type : remote nobody exploit
Debian-specific: no

Two different problems where found in libgtop-daemon:

* The laboratory intexxia found a format string problem in the logging
code from libgtop_daemon. There were two logging functions which are
called when authorizing a client which could be exploited by a remote
user.

* Flavio Veloso found a buffer overflow in the function that authorizes
clients

Since libgtop_daemon runs as user nobody both bugs could be used
to gain access as the nobody user to a system running libgtop_daemon.

Both problems have been fixed in version 1.0.6-1.1 and we recommend
you upgrade your libgtop-daemon package immediately.

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

Debian GNU/Linux 2.2 alias potato
---------------------------------

Potato was released for alpha, arm, i386, m68k, powerpc and sparc.

Source archives:

MD5 checksum: 19c9689fb62dd1ab26dcfc0a2580280d

...