Debian Essential And Critical Security Patch Updates - Page 299

New version of proftpd fixes remote exploits

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

The proftpd version that was distributed in Debian GNU/Linux 2.1 had several buffer overruns that could be exploited by remote attackers. A short list of problems: * user input was used in snprintf() without sufficient checks * there was an overflow in the log_xfer() routine * you could overflow a buffer by using very long pathnames

LinuxSecurity.com Team
Dec 13, 1999

New versions of lpr released

The version of lpr that was distributed with Debian GNU/Linux 2.1 suffers from a couple of problems: * there was a race in lpr that could be exploited by users to print files they can not normally read * lpd did not check permissions of queue-files. As a result by using the -s flag it could be tricked into printing files a user can otherwise not read

LinuxSecurity.com Team
Dec 13, 1999

New version of nis released

The nis package that was distributed with Debian GNU/Linux 2.1 has a couple of problems: * ypserv allowed any machine in the NIS domain to insert new tables * rpc.yppasswd had a bufferoverflow in its MD5 code * rpc.yppasswd allowed users to change the GECOS and loginshell entries of other users

LinuxSecurity.com Team
Dec 13, 1999

New version of amd fixes remote exploit, take 2

The version of amd that was distributed with Debian GNU/Linux 2.1 is vulnerable to a remote exploit. This was fixed in version 23.0slink1. However that fix contained an error which has been fixed in version upl102-23.slink2.

LinuxSecurity.com Team
Dec 13, 1999

New version of mirror fixes remote exploit

We have received reports that the version of mirror as distributed in Debian GNU/Linux 2.1 could be remotely exploited. When mirroring a remote site the remote site could use filename-constructions like " .." that would case mirror to work one level above the target directory for the mirrored files.

LinuxSecurity.com Team
Dec 13, 1999

New version of amd fixes remove exploit

The version of amd that was distributed with Debian GNU/Linux 2.1 is vulnerable to a remote exploit. Passing a big directory name to amd its logging code would overflow a buffer which could be exploited. This has been fixed in version 23.0slink1.

LinuxSecurity.com Team
Dec 13, 1999

New versions of cron fixes possible root exploit

Red Hat has recently released a Security Advisory (RHSA-1999:030-01) covering a reverse denial of service bug in the vixie cron package. As user you could restart sendmail even if the host should not receive mail through the SMTP port.

LinuxSecurity.com Team
Dec 13, 1999

New versions of epic4 fixes possible DoS vulnerability

We have received a report from the author of epic4 covering a denial of service vulnerability. All versions of epic4 between version pre1.034 (including) and version pre2.004-19990718 (excluding) are vulnerable. They contain code which makes epic4 walk off of a string, causing the client to crash and possibly display arbitrary characters on the terminal.

LinuxSecurity.com Team
Dec 13, 1999

New versions of trn fixes /tmp race

All former versions of trn used a hardcoded filename in /tmp as temporary storage. If the file already exists as symbolic link to users files they will be overwritten.

LinuxSecurity.com Team
Dec 13, 1999

New versions of man2html fixes postinst glitch

Former versions of man2html uses a static file in /tmp for writing. This can lead into overwriting system files if a malicious user has created a symbolic link to it before upgrading man2html.

LinuxSecurity.com Team
Dec 13, 1999

Current versions of seyon may contain malicious code

One year ago, we have received a report from SGI that a vulnerability has been discovered in the seyon program which can lead to a root compromise. Any user who can execute the seyon program can exploit this vulnerability.

LinuxSecurity.com Team
Dec 13, 1999

New versions of smtp-refuser fixes security hole

This bug was experienced in May 1999 but wasn't reported on this channel yet. Former versions of the smtp-refuser package came with unchecked logging facility to /tmp/log. This allowed deleting arbitrary, root-owned files by any user who has write access to /tmp

LinuxSecurity.com Team
Dec 13, 1999

New versions of termcap-compat fixes buffer overflow

We have received a report that former versions of libtermcap contained an exploitable buffer overflow. Debian itself is not exploitable by this bug since termcap was abandoned in favour of terminfo long ago. However, if you have compiled your own programs using termcap or have installed third party programs that depend on libtermcap and run as root they are exploitable.

LinuxSecurity.com Team
Dec 13, 1999

New versions of rsync fixes security hole

This is an old report from May 1999 but it wasn't reported on this channel yet.

LinuxSecurity.com Team
Dec 13, 1999

new version isdnutils fixes exploitable xmonisdn

We have received reports that the version of xmonisdn as distributed in the isndutils package from Debian GNU/Linux 2.1 has a security problem.

LinuxSecurity.com Team
Dec 13, 1999

New versions of cfingerd fixes root exploit

We have received a report that the all versions of cfingerd prior to 1.4.0 and 1.3.2-18.1 are vulnerable to a root exploit - as posted on bugtraq.

LinuxSecurity.com Team
Dec 13, 1999

New versions of mailman fixes cookie attack

We have become aware that the version mailman as supplied in Debian GNU/Linux 2.1 has a problem with verifying list administrators. The problem is that the cookie value generation used was predictable, so using forged authentication cookies it was possible to access the list administration webpages without knowing the proper password.

LinuxSecurity.com Team
Dec 13, 1999

New version of man-db fixes symlink attack in zsoelim

We have received reports that the man-db package as supplied in Debian GNU/Linux 2.1 has a vulnerability in the zsoelim program: it was vulnerable to a symlink attack. This has been fixed in version 2.3.10-69FIX.1

LinuxSecurity.com Team
Dec 13, 1999

New version of kernel-image for sparc fixes DoS attack

As is widely known by now the Linux 2.2.x kernels had a problem with parsing IP options, which made them susceptible to a DoS attack.

LinuxSecurity.com Team
Dec 13, 1999

New version if ipopd prevents exploit

We have received reports that the version of the imap suite in Debian GNU/Linux 2.1 has a vulnerability in its POP-2 daemon, which can be found in the ipopd package. Using this vulnerability it is possible for remote users to get a shell as user "nobody" on the server.

LinuxSecurity.com Team
Dec 13, 1999