|
|
Security Linux News for Feb 08, 2001
-
Debian Security Advisory: New man-db packages released (Feb 08, 2001, 23:58)
"Styx has reported that the program `man' mistakenly passes
malicious strings (i.e. containing format characters) through
routines that were not meant to use them as format strings. Since
this could cause a segmentation fault and privileges were not
dropped it may lead to an exploit for the 'man' user."
-
Debian Security Advisory: New OpenSSH packages released (Feb 08, 2001, 23:44)
"Prior versions of OpenSSH are vulnerable to a remote arbitrary
memory overwrite attack which may eventually lead into a root
exploit. No exploit program is known yet but expected to come up
soon."
-
TurboLinux Security Announcement: netscape-communicator 4.75-1 and earlier (Feb 08, 2001, 22:20)
"A buffer overflow exists in Netscape's HTML parsing code. By
using specially designed code, a remote website could cause
arbitrary code to be run on the local machine."
-
Caldera Systems Security Advisory: security problems in ptrace and sysctl (Feb 08, 2001, 22:13)
"There are two security problems in 2.2 and 2.4 kernels. By
passing a negative offset to sysctl(), an attacker can read large
parts of Linux kernel memory. In addition, a race condition has
been discovered that allows an attacker to attach via ptrace to a
setuid process, allowing him to modify the running process."
-
TurboLinux Security Announcement: slocate-2.3-1 and earlier (Feb 08, 2001, 22:01)
"There is a heap-corruption vulnerability existing in slocate.
It can compromise slocate's ability to maintain an index of the
entire file- system as well as its ability to read user-specified
databases."
-
Security Portal: Ask Buffy - Log Analyzers for Apache and Tracking Down a Bogus Device (Feb 08, 2001, 08:04)
"I want to write a log analyzer for a Web error log file. I am
interested in analysis of vulnerabilities on Apache Web servers,
errors, CGI vulnerabilities or others, and some well known CGI hack
methods."
|
