SuSE Essential and Critical Security Patch Updates - Page 781

SuSE: 'glibc/bind' Buffer overflow vulnerability

data:image/svg+xml,%3Csvg%20xmlns=%22http://www.w3.org/2000/svg%22%20viewBox=%220%200%20100%20100%22%3E%3C/svg%3E

A vulnerability has been discovered in some resolver library functions. The affected code goes back to the resolver library shipped as part of BIND4; code derived from it has been included in later BIND releases as well as the GNU libc.

LinuxSecurity.com Team
Jul 10, 2002

SuSE: bind, glibc: buffer overflow

LinuxSecurity.com Team
Jul 09, 2002

SuSE: 'openssh' Input Validation Vulnerability

In order to provide properly functioning packages for our products, we have decided to return to the commonly known stable version 2.9.9p2 with the necessary patch to fix the vulnerability for the SuSE Linux distributions 6.4 up to 7.3 and for our server products.

LinuxSecurity.com Team
Jul 02, 2002

SuSE: 'openssh' Remote Vulnerability

Theo de Raadt announced that the OpenBSD team is working with ISSon a remote exploit for OpenSSH. No details on the type of vulnerability are available at this time, but everyone is advised to upgrade to version 3.3.

LinuxSecurity.com Team
Jun 25, 2002

SuSE: OpenSSH Advisory Update

LinuxSecurity.com Team
Jun 25, 2002

SuSE: buffer overflow in httpd

There is a bug in the way the Apache web server handles HTTP requests that use "chunked mode".

LinuxSecurity.com Team
Jun 19, 2002

SuSE: Discontinued Support for version 6.4

SuSE has announced that they will be discontinuing support for SuSE Linux version 6.4 after June 17, 2002.

LinuxSecurity.com Team
Jun 11, 2002

SuSE: 'bind9' Remote DoS vulnerability

here is a bug in the BIND9 name server that is triggered when processing certain types of DNS replies. When this happens an assertion will fail, and named will log a message to the system log before exiting.

LinuxSecurity.com Team
Jun 06, 2002

SuSE: 'tcpdump/libpcap' Buffer overflow vulnerability

Tcpdump decodes certain packets such as AFS requests in a wrong way resulting in a buffer overflow.

LinuxSecurity.com Team
May 29, 2002

SuSE: 'dhcp' Format string vulnerability

A remote exploitable format string vulnerability was found in the logging routines of the dynamic DNS code of dhcpd. This vulnerability allows an attacker, usually within the LAN served by the DHCP server, to get remote root access to the host running dhcpd.

LinuxSecurity.com Team
May 22, 2002

SuSE: 'lukemftp' Remote command execution vulnerability

A buffer overflow could be triggered by an malicious ftp server while the client parses the PASV ftp command. An attacker who control an ftp server to which a client using lukemftp is connected can gain remote access to the clients machine with the privileges of the user running lukeftp.

LinuxSecurity.com Team
May 16, 2002

SuSE: 'shadow/pam-modules' Privilege escalation vulnerability

The SuSE Security Team discovered a vulnerability that allows local attackers to destroy the contents of these files or to extend the group privileges of certain users. This is possible by setting evil filesize limits before invoking one of the programs modifying the system files.

LinuxSecurity.com Team
May 16, 2002

SuSE: 'sysconfig' Remote command execution

It is possible for remote attackers to feed this script with evil data via spoofed DHCP replies for example. This way ifup-dhcp could be tricked into executing arbitrary commands as root.

LinuxSecurity.com Team
May 08, 2002

SuSE: 'imlib' Remote privilege escalation vulnerability

An attacker could send a maliciously formated image file to trigger a Denial-of-Service attack or even execute arbitrary code on the victim's machine.

LinuxSecurity.com Team
May 07, 2002

SuSE: 'sudo' Local privilege escalation vulnerability

The input used to create the password prompt is user controlled and not properly length-checked before copied to certain heap locations. This allows local attackers to overflow the heap of sudo, thus executing arbitrary commands as root.

LinuxSecurity.com Team
Apr 30, 2002

SuSE: 'radiusd-cistron' Buffer overflow vulnerability

Within the cistron package, a buffer overflow in the digest calculation function and miscalculations of attribute lengths have been fixed which could allow remote attackers to execute arbitrary commands on the system running the radius server.

LinuxSecurity.com Team
Apr 29, 2002

SuSE: 'ucdsnmp' Denial of service vulnerability

Several bugs could be triggered in the ucd-snmpd code by using this testing suite. These bugs lead to remote denial-of-service attacks and may possibly exploited to break system security remotely.

LinuxSecurity.com Team
Apr 08, 2002

SuSE: 'zlib/libz' Data corruption vulnerability, Part II

An error in a decompression routine can corrupt the internal data structures of malloc by a double call to the free() function. If the data processed by the compression library is provided from an untrusted source, it may be possible for an attacker to interfere with the process using the zlib routines.

LinuxSecurity.com Team
Mar 11, 2002

SuSE: 'libz/zlib' Data corruption, Part I

LinuxSecurity.com Team
Mar 11, 2002

SuSE: openssh off-by-one bug

Joost Pol discovered an off-by-one bug in a routine in the openssh code for checking channel IDs.

LinuxSecurity.com Team
Mar 07, 2002