Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
91
security advisorysecurity issuegentooGentoo: GLSA-200505-17 Normal: Qpopper File Overwrite Threat
Qpopper contains two vulnerabilities allowing an attacker to overwrite arbitrary files and create files with insecure permissions.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200505-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Qpopper: Multiple Vulnerabilities Date: May 23, 2005 Bugs: #90622 ID: 200505-17 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Qpopper contains two vulnerabilities allowing an attacker to overwrite arbitrary files and create files with insecure permissions. Background ========= Qpopper is a widely used server for the POP3 protocol. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/qpopper < 4.0.5-r3 > = 4.0.5-r3 Description ========== Jens Steube discovered that Qpopper doesn't drop privileges to process local files from normal users (CAN-2005-1151). The upstream developersdiscovered that Qpopper can be forced to create group or world writeable files (CAN-2005-1152). Impact ===== A malicious local attacker could exploit Qpopper to overwrite arbitrary files as root or create new files which are group or world writeable. Workaround ========= There is no known workaround at this time. Resolution ========= All Qpopper users should upgrade to the latest available version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-mail/qpopper-4.0.5-r3" References ========= [ 1 ] CAN-2005-1151 [ 2 ] CAN-2005-1152 Availability =========== This GLSA and any updates toit are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200505-17 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
May 23, 2005
Gentoo
100
security advisorymoderatebuffer overflowSuSE: SA:2003:018 Moderate: qpopper Buffer Overflow Risk
The sample exploit requires a valid user account and password, and overflows a string in the pop_msg() function to give the user "mail" group privileges and a shell on the system. Since the Qvsnprintf function is used elsewhere in qpopper, additional exploits may be possible.. ______________________________________________________________________________ SuSE Security Announcement Package: qpopper Announcement-ID: SuSE-SA:2003:018 Date: Friday, Mar 21th 2003 10:11 MET Affected products: 7.3, 8.0, 8.1 SuSE Linux Enterprise Server 8 Vulnerability Type: remote system compromise Severity (1-10): 3 SuSE default package: no Cross References: CAN-2003-0143 Content of this advisory: 1) security vulnerability resolved: buffer overflow problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds: - mutt - kernel - ethereal - apcupsd - vnc - openssl - mod_php4 - pgp4pine - nethack - netpbm - man 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The Post-Office-Protocol- (POP-) Server qpopper (version 4) was vulnerable to a buffer overflow. The buffer overflow occurs after authentication has taken place. Therefore pop-users with a valid account can execute arbitrary code on the system running qpopper. Depending on the setup, the malicious code is run with higher privileges. There is no temporary fix known, please update your system. Please download the update package for your distribution and verify its integrity by the methods listedin section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered to install from the maintenance web. Please note, missing packages will be published as soon as possible. Intel i386 Platform: SuSE-8.1: 45017728d71adab5aa1b335878666369 patch rpm(s): 06c56a877950b5285164b77e7818a3df source rpm(s): c8e7be3433bddadc73aac4251faa9b27 SuSE-8.0: e62034de0ab73f1f563950a34047493f patch rpm(s): 0f0b17a2efd99edb840b559095d5b8f0 source rpm(s): 2e8023638bd7c5d71ac5fe55f9bd6036 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds: - mutt A buffer overflow in mutt's IMAP code may result in remote system compromise. New packages are currently being build and will be available soon. - kernel A bug in the Linux kernel was found that allows local users to become root. The bug can just be exploited if ptrace(2) is allowed, LKM and kmod support is enabled. We already build new kernels and are currently testing them. As a workaround kernel module loading can be disabled after every boot by executing the following action as root: # echo /just/a/temporary/workaround > /proc/sys/kernel/modprobe Please note, that this will disable some services. - ethereal A format string bug in ethereal's SOCKS handling code and a buffer overflow in the NTLMSSP was found in ethereal. Both bugs may lead to remote system compromise. New packages are currently being build and will be available soon. - apcupsd The control and management daemon for APC UPS systems is vulnerable to remote code execution due to buffer overflow and format string bugs. A dedicatedadvisory for this issue will be released as soon as all packages are being build. - vnc VNC (Virtual Network Computing) uses a weak cookie generation process which can be exploited by an attacker to bypass authentication. New packages are currently being tested and will be available on our FTP servers soon. - openssl A paper regarding remote timing attacks against OpenSSL has been published by researchers of the Stanford University. It is possible to extract the private RSA key used by services using OpenSSL by observing their timing behavior. Additionally czech researchers found another bug in OpenSSL which is an extension of the "Bleichenbacher Attack". Fixed packages will be available on our FTP servers soon. - mod_php4 4.3.0 A serious security vulnerability was found in mod_php 4.3.0 which allows a remote attacker to read files or even execute PHP-code. This was possible due to direct access to the CGI module. SuSE does not ship this vulnerable version. - pgp4pine A buffer overflow in pine's filter add-on pgp4pine can be abused to execute arbitrary commands remotely. The pgp4pine version SuSE ships is not vulnerable to this bug. - nethack A buffer overflow in nethack can be exploited local users to gain higher privileges if the nethack binary is installed setuid/setgid. This bug is fixed for upcoming SuSE Linux versions. As a temporary workaround you should disable all s-bits on the nethack binary (/etc/permissions.local). - netpbm The netpbm package contains various integer overflows which can lead to arbitrary code execution. New packages are published on our FTP servers. - man A vulnerability in man was published that allows local privilege escalation. SuSE Linux does not ship this vulnerable version of man. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key
Mar 21, 2003
SuSE
91
security advisorygentoobuffer overflowGentoo: 200303-12 Critical: Qpopper Buffer Overflow Remote Execute
Under certain conditions it is possible to execute arbitrary code using a buffer overflow in the recent qpopper.. - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200303-12 - - --------------------------------------------------------------------- PACKAGE : qpopper SUMMARY : buffer overflow DATE : 2003-03-17 09:50 UTC EXPLOIT : remote VERSIONS AFFECTED : =4.0.5 CVE : CAN-2003-0143 - - --------------------------------------------------------------------- - From advisory: "Under certain conditions it is possible to execute arbitrary code using a buffer overflow in the recent qpopper. You need a valid username/password-combination and code is (depending on the setup) usually executed with the user's uid and gid mail." Read the full advisory at: http://marc.theaimsgroup.com/?l=bugtraq&m=104739841223916&w=2 SOLUTION It is recommended that all Gentoo Linux users who are running net-mail/qpopper upgrade to qpopper-4.0.5 as follows: emerge sync emerge qpopper emerge clean - - ---------------------------------------------------------------------
Mar 17, 2003
•Critical
Gentoo
87
security advisorybuffer overflowdebianDebian 3.0 DSA-259-1 Critical: Qpopper Privilege Escalation Exploit
The sample exploit requires a valid user account and password, and overflows astring in the pop_msg() function to give the user "mail" group privileges and ashell on the system. Since the Qvsnprintf function is used elsewhere inqpopper, additional exploits may be possible.. ---------------------------------------------------------------------------- Debian Security Advisory DSA-259-1
Mar 13, 2003
•Critical
Debian
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!