Alerts This Week
Warning Icon 1 560
Alerts This Week
Warning Icon 1 560

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":548,"type":"x","order":1,"pct":78.51,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.3,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.87,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.32,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -5 articles for you...
87

Debian: DSA-2592-1 Critical Elinks Remote Credential Delegation Issue

Marko Myllynen discovered that elinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate. For the stable distribution (squeeze), this problem has been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2592-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Moritz Muehlenhoff December 28, 2012 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : elinks Vulnerability : programming error Problem type : remote Debian-specific: no CVE ID : CVE-2012-4545 Marko Myllynen discovered that elinks, a powerful text-mode browser, incorrectly delegates user credentials during GSS-Negotiate. For the stable distribution (squeeze), this problem has been fixed in version 0.12~pre5-2+squeeze1. Since the initial Squeeze release Xulrunner needed to be updated and the version currently in the archive is incompatible with Elinks. As such, Javascript support needed to be disabled (only a small subset of typical functionality was supported anyway). It will likely be re-enabled in a later point update For the testing distribution (wheezy), this problem has been fixed in version 0.12~pre5-9. For the unstable distribution (sid), this problem has been fixed in version 0.12~pre5-9. We recommend that you upgrade your elinks packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The Debian Security Notice DSA-2592-2 pertains to a vulnerability in elinks that allows remote exploitation through faulty authentication delegation.. Debian Security, elinks Update, Remote Issue, User Credentials, Text-mode Browser. . Severity: Critical. LinuxSecurity.comTeam

Calendar 2 Dec 28, 2012 Critical Debian
200

Scientific Linux: CVE-2011-2192 Moderate: curl Credential Delegation Issue

Moderate: curl security update. Date: Tue, 5 Jul 2011 16:30:45 -0500 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA Moderate: curl on SL4.x, SL5.x, SL6.x i386/x86_64 Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it." MIME-Version: 1.0 Synopsis: Moderate: curl security update Issue date: 2011-07-05 CVE Names: CVE-2011-2192 cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. It was found that cURL always performed credential delegation when authenticating with GSSAPI. A rogue server could use this flaw to obtain the client's credentials and impersonate that client to other servers that are using GSSAPI. (CVE-2011-2192) All running applications using libcurl must be restarted for the update to take effect. SL 4.x SRPMS: curl-7.12.1-17.el4.src.rpm i386: curl-7.12.1-17.el4.i386.rpm curl-devel-7.12.1-17.el4.i386.rpm x86_64: curl-7.12.1-17.el4.i386.rpm curl-7.12.1-17.el4.x86_64.rpm curl-devel-7.12.1-17.el4.x86_64.rpm SL 5.x SRPMS: curl-7.15.5-9.el5_6.3.src.rpm i386: curl-7.15.5-9.el5_6.3.i386.rpm curl-devel-7.15.5-9.el5_6.3.i386.rpm x86_64: curl-7.15.5-9.el5_6.3.i386.rpm curl-7.15.5-9.el5_6.3.x86_64.rpm curl-devel-7.15.5-9.el5_6.3.i386.rpm curl-devel-7.15.5-9.el5_6.3.x86_64.rpm SL 6.x SRPMS: curl-7.19.7-26.el6_1.1.src.rpm i386: curl-7.19.7-26.el6_1.1.i686.rpm libcurl-7.19.7-26.el6_1.1.i686.rpm libcurl-devel-7.19.7-26.el6_1.1.i686.rpm x86_64: curl-7.19.7-26.el6_1.1.x86_64.rpm libcurl-7.19.7-26.el6_1.1.i686.rpm libcurl-7.19.7-26.el6_1.1.x86_64.rpm libcurl-devel-7.19.7-26.el6_1.1.i686.rpm libcurl-devel-7.19.7-26.el6_1.1.x86_64.rpm - Scientific Linux Development Team . Discover recent security updates addressing moderate curl vulnerabilities in Scientific Linux, crucial for protecting against credential delegation and ensuring secure communications. curl Update, Scientific Linux Security, Moderate Issues, Credential Delegation, GSSAPIExploit. . LinuxSecurity.com Team

Calendar 2 Jul 05, 2011 Scientific Linux
87

Debian: DSA-2271-1 High Severity: curl Credential Delegation

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2271-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Giuseppe Iuculano July 02, 2011 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : curl Vulnerability : improper delegation of client credentials Problem type : remote Debian-specific: no CVE ID : CVE-2011-2192 Debian Bug : #631615 Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is obviously a very sensitive operation, which should only be done when the user explicitly so directs. For the oldstable distribution (lenny), this problem has been fixed in version 7.18.2-8lenny5. For the stable distribution (squeeze), this problem has been fixed in version 7.21.0-2. For the testing distribution (wheezy), this problem has been fixed in version 7.21.6-2. For the unstable distribution (sid), this problem has been fixed in version 7.21.6-2. We recommend that you upgrade your curl packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . The Debian Security Advisory DSA-2271-1 tackles a severe vulnerability in curl about mismanaged credentialdelegation in GSSAPI, risking unauthorized access or privilege escalation. Curl Update, Debian Security, Credential Management, Remote Threat. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Jul 02, 2011 Important Debian
98

Red Hat Enterprise Linux 4 RHSA-2005:527-01 Moderate GSSAPI Credential Risk

Updated openssh packages that fix a security issue, bugs, and add support for recording login user IDs for audit are now available for Red Hat Enterprise Linux 4.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: openssh security update Advisory ID: RHSA-2005:527-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:527.html Issue date: 2005-10-05 Updated on: 2005-10-05 Product: Red Hat Enterprise Linux CVE Names: CAN-2005-2798 - ---------------------------------------------------------------------1. Summary: Updated openssh packages that fix a security issue, bugs, and add support for recording login user IDs for audit are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. An error in the way OpenSSH handled GSSAPI credential delegation was discovered. OpenSSH as distributed with Red Hat Enterprise Linux 4 contains support for GSSAPI user authentication, typically used for supporting Kerberos. On OpenSSH installations which have GSSAPI enabled, this flaw could allow a user who sucessfully authenticates using a method other than GSSAPI to be delegated with GSSAPI credentials. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-2798 to this issue. Additionally, the following bugs have been addressed: The ssh command incorrectly failed when it was issued by the root user with a non-default group set. Thesshd daemon could fail to properly close the client connection if multiple X clients were forwarded over the connection and the client session exited. The sshd daemon could bind only on the IPv6 address family for X forwarding if the port on IPv4 address family was already bound. The X forwarding did not work in such cases. This update also adds support for recording login user IDs for the auditing service. The user ID is attached to the audit records generated from the user's session. All users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command: up2date For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10 5. Bug IDs fixed (http://bugzilla.redhat.com/): 159331 - sshd update for new audit system 167444 - CAN-2005-2798 Improper GSSAPI credential delegation 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: 2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm i386: 4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm 77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm 76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm 45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm 32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm ia64: f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm 512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm 6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm 0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm 40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm ppc: e97bdb7f35c89a540f9c3204064c4b7e openssh-3.9p1-8.RHEL4.9.ppc.rpm 93dbfdb6052e0e4532d183b2dab9cb95 openssh-askpass-3.9p1-8.RHEL4.9.ppc.rpm 9e8e056a8677d7bdd45479be6c12f47d openssh-askpass-gnome-3.9p1-8.RHEL4.9.ppc.rpm 3af1774ffe5f61d7d0f89a1e0093bcff openssh-clients-3.9p1-8.RHEL4.9.ppc.rpm 3ec577e0d009372ed16343f8d7ddef4d openssh-server-3.9p1-8.RHEL4.9.ppc.rpm s390: dc7368330098bd6b02babcf62ae31773 openssh-3.9p1-8.RHEL4.9.s390.rpm bbe31ee642601ed16e64aebca844adf3 openssh-askpass-3.9p1-8.RHEL4.9.s390.rpm b45278314ff79575284af2a0ddf09f8f openssh-askpass-gnome-3.9p1-8.RHEL4.9.s390.rpm eb0871dc10d5eb1541f2bd240b86d1bb openssh-clients-3.9p1-8.RHEL4.9.s390.rpm fa1669804538da84a5b312d237eb65bc openssh-server-3.9p1-8.RHEL4.9.s390.rpm s390x: a26f854317e26af188704d5df98b302b openssh-3.9p1-8.RHEL4.9.s390x.rpm 7386e0e001ec6534c5666316f6ac1aa6 openssh-askpass-3.9p1-8.RHEL4.9.s390x.rpm 26e80a25582afc8665b853b9fd844907 openssh-askpass-gnome-3.9p1-8.RHEL4.9.s390x.rpm 65a0209831ac79f162f75e491ec7696a openssh-clients-3.9p1-8.RHEL4.9.s390x.rpm 2856776521344601307cdcbb9e6af2e6 openssh-server-3.9p1-8.RHEL4.9.s390x.rpm x86_64: 8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm 14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm 56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: 2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm i386: 4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm 77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm 76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm 45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm 32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm x86_64: 8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm 14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm 56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: 2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm i386: 4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm 77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm 76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm 45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm 32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm ia64: f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm 512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm 6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm 0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm 40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm x86_64: 8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm 14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm 56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: 2cbb0102ce3dc2c36c328819f8522bbc openssh-3.9p1-8.RHEL4.9.src.rpm i386: 4a5add7335d6b6bcf9a202e45e782eee openssh-3.9p1-8.RHEL4.9.i386.rpm 77cc6d8b6be9c613f80cd7d52c9f91e3 openssh-askpass-3.9p1-8.RHEL4.9.i386.rpm 76c9ac8255dbc25184887dd93cfdb047 openssh-askpass-gnome-3.9p1-8.RHEL4.9.i386.rpm 45350fbd7c5356467ebfc2e2a7bfc55a openssh-clients-3.9p1-8.RHEL4.9.i386.rpm 32e69cc88f09f6785badd3b82fdccb31 openssh-server-3.9p1-8.RHEL4.9.i386.rpm ia64: f27d73d28c920358dcb434c3ed8489cf openssh-3.9p1-8.RHEL4.9.ia64.rpm 512632b31d333408cf2e05a3e567e16a openssh-askpass-3.9p1-8.RHEL4.9.ia64.rpm 6771aafbd50b0ead67418404cbd63711 openssh-askpass-gnome-3.9p1-8.RHEL4.9.ia64.rpm 0355970673f296c38ee961549665b64d openssh-clients-3.9p1-8.RHEL4.9.ia64.rpm 40fa71b924423c63af6215255cc21198 openssh-server-3.9p1-8.RHEL4.9.ia64.rpm x86_64: 8e2c46e097fff0172553d821e6810f91 openssh-3.9p1-8.RHEL4.9.x86_64.rpm 14a78c2264965373c6c56d63f73f60e5 openssh-askpass-3.9p1-8.RHEL4.9.x86_64.rpm b799e4ed3d8d6aaf3439e06c5ee29b21 openssh-askpass-gnome-3.9p1-8.RHEL4.9.x86_64.rpm e15d265ea0f955724b27cb15f2230f4f openssh-clients-3.9p1-8.RHEL4.9.x86_64.rpm 56bab36b63f94a4adcaa79ef026df03e openssh-server-3.9p1-8.RHEL4.9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.cve.org/CVERecord?id=CAN-2005-2798 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . Canonical unveils a significant patch 2023:12345 to address vulnerabilities and bolster system monitoring for enhanced protection.. openssh Security, Red Hat Advisory, Audit Logging, Security Update, GSSAPI Fix. . Severity: Important. LinuxSecurity.com Team

Calendar 2 Oct 05, 2005 Important Red Hat
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":548,"type":"x","order":1,"pct":78.51,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.3,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.87,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.32,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here