Linux Advisory Watch – November 26, 2004

Martin Schulze reported a vulnerability[2] in the passwd_check()
function in “libmisc/pwdcheck.c” which is used by chfn and chsh and
thus may allow a local attacker to use them to change the standard
shell of other users or modify their GECOS information (full name,
phone number…).

http://www.linuxsecurity.com/advisories/conectiva_advisory-5223.html

Bugzilla versions prior to 2.16.7 have a vulnerability[3] which allows
a remote user to remove keywords from a ticket even without the
necessary permissions. Such an action, however, would trigger the usual
e-mail detailing the changes, making it easy to discover what happened
and what was changed.

http://www.linuxsecurity.com/advisories/conectiva_advisory-5224.html

Karol Wiesek found a vulnerability[2] in the input validation routines
in Samba 3.x used to match filename strings containing wildcard
characters that may allow a remote attacker to consume abnormal amounts
of CPU cycles.

http://www.linuxsecurity.com/advisories/conectiva_advisory-5234.html

Leon Juranic discovered that BNC, an IRC session bouncing proxy, does
not always protect buffers from being overwritten. This could exploited
by a malicious IRC server to overflow a buffer of limited size and
execute arbitrary code on the client host.

http://www.linuxsecurity.com/advisories/debian_advisory-5227.html

Liam Helmer noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. Bash functions and the CDPATH variable are still passed
through to the program running as privileged user, leaving
possibilities to overload system routines.

http://www.linuxsecurity.com/advisories/debian_advisory-5228.html

Liam Helmer noticed that sudo, a program that provides limited super
user privileges to specific users, does not clean the environment
sufficiently. Bash functions and the CDPATH variable are still passed
through to the program running as privileged user, leaving
possibilities to overload system routines.

http://www.linuxsecurity.com/advisories/debian_advisory-5229.html

Stefan Esser discovered several security related problems in the Cyrus
IMAP daemon. Due to a bug in the command parser it is possible to
access memory beyond the allocated buffer in two places which could
lead to the execution of arbitrary code.

http://www.linuxsecurity.com/advisories/debian_advisory-5240.html

Max Vozeler noticed that yardradius, the YARD radius authentication and
accounting server, contained a stack overflow similar to the one from
radiusd which is referenced as CAN-2001-0534. This could lead to the
execution of arbitrary code as root.

http://www.linuxsecurity.com/advisories/debian_advisory-5241.html

Chris Evans discovered several integer overflows in xpdf, that are also
present in tetex-bin, binary files for the teTeX distribution, which
can be exploited remotely by a specially crafted PDF document and lead
to the execution of arbitrary code.

http://www.linuxsecurity.com/advisories/debian_advisory-5242.html

check for running processes of a user about to be deleted (#132902)

http://www.linuxsecurity.com/advisories/fedora_advisory-5205.html

check for running processes of a user about to be deleted (#132902)

http://www.linuxsecurity.com/advisories/fedora_advisory-5206.html

This should fix the problem where rhgb blocks the boot process when X
fails to initialize correctly, as well as the one preventing vncserver
to start when rhgb is used.

http://www.linuxsecurity.com/advisories/fedora_advisory-5207.html

This update adds additional file types to the list of file types
associated with the OpenOffice.org application suite, allowing users to
open more documents with OpenOffice.org through Nautilus and Evolution.


http://www.linuxsecurity.com/advisories/fedora_advisory-5213.html

This update brings a rebase to 2.6.9, including various security fixes
incorporated into the upstream kernel, and also includes Alan Cox’s -ac
patchset, which adds additional security fixes.

http://www.linuxsecurity.com/advisories/fedora_advisory-5214.html

This update brings an updated -ac patch which which adds several
security fixes, and various other fixes that have occured since the
release of Fedora Core 3.

http://www.linuxsecurity.com/advisories/fedora_advisory-5215.html

This update fixes the missing evolution icon bug (#rh138282).

http://www.linuxsecurity.com/advisories/fedora_advisory-5216.html

This fixes tracebacks experienced by some users with dual head support

http://www.linuxsecurity.com/advisories/fedora_advisory-5217.html

add missing options (#137756)

http://www.linuxsecurity.com/advisories/fedora_advisory-5230.html

add missing options (#137756), don’t raise exception when writing
/etc/samba/smb.conf (#135946), updated translations

http://www.linuxsecurity.com/advisories/fedora_advisory-5231.html

Fixes for tempnam usages and startup geometry crashes

http://www.linuxsecurity.com/advisories/fedora_advisory-5232.html

libXpm contains several vulnerabilities that could lead to a Denial of Service and arbitrary code execution.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5209.html

unarj contains a buffer overflow and a directory traversal
vulnerability. This could lead to overwriting of arbitrary files or the
execution of arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5210.html

pdftohtml includes vulnerable Xpdf code to handle PDF files, making it
vulnerable to execution of arbitrary code upon converting a malicious
PDF file.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5219.html

ProZilla contains several buffer overflow vulnerabilities that can be
exploited by a malicious server to execute arbitrary code with the
rights of the user running ProZilla.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5220.html

phpBB contains a vulnerability which allows a remote attacker to
execute arbitrary commands with the rights of the web server user.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5221.html

A bug in the TWiki search function allows an attacker to execute
arbitrary commands with the permissions of the user running TWiki.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5222.html

The Cyrus IMAP Server contains multiple vulnerabilities which could lead to remote execution of arbitrary code.

http://www.linuxsecurity.com/advisories/gentoo_advisory-5233.html

A source code review of the XPM library, done by Thomas Biege of the
SuSE Security-Team revealed several different kinds of bugs. These bugs
include integer overflows, out-of-bounds memory access, shell command
execution, path traversal, and endless loops.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5225.html

A source code review of the XPM library, done by Thomas Biege of the
SuSE Security-Team revealed several different kinds of bugs. These bugs
include integer overflows, out-of-bounds memory access, shell command
execution, path traversal, and endless loops.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5226.html

A number of vulnerabilities in the Cyrus-IMAP server were found by
Stefan Esser. Due to insufficient checking within the argument parser
of the ‘partial’ and ‘fetch’ commands, a buffer overflow could be
exploited to execute arbitrary attacker-supplied code.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5235.html

The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitray commands with the
privileges of the user running the vulnerable application.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5236.html

A vulnerability in zip was discovered where zip would not check the
resulting path length when doing recursive folder compression, which
could allow a malicious person to convince a user to create an archive
containing a specially-crafted path name.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5237.html

A number of bugs in kdebase are fixed with this update.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5238.html

A number of bugs in kdelibs are fixed with this update.

http://www.linuxsecurity.com/advisories/mandrake_advisory-5239.html

Linux 2.4.28, and thus 2.4.28-ow1, fixes a number of security-related
bugs, including the ELF loader vulnerabilities discovered by Paul
Starzetz (confirmed: ability for users to read +s-r binaries;
potential: local root), a race condition with reads from Unix domain
sockets (potential local root), smbfs support vulnerabilities
discovered by Stefan Esser (confirmed: remote DoS by a malicious smbfs
server; potential: remote root by a malicious smbfs server).

http://www.linuxsecurity.com/advisories/openwall_advisory-5218.html

An issue was discovered where the field length limit was not enforced
for certain malicious requests. This could lead to a remote denial of
service attack.

http://www.linuxsecurity.com/advisories/trustix_advisory-5211.html

amavisd-new: Add tmpwatch of the virusmails directory to keep it from
growing infinitely. Anaconda: Increase ramdisk-size as needed by
netboot floppy. Courier-imap: Now use $HOME/Maildir.

http://www.linuxsecurity.com/advisories/trustix_advisory-5212.html