Thomas –
This week, advisories were released for kde, openssl, tcpdump, samba, netpbm-free,
lxr, kernel, libc, qpopper, man, mysql, rxvt, zlib, gnome-lokkit, and libc.
The distributors include, Caldera, Debian, Guardian Digital’s EnGarde Secure
Linux, Gentoo, Mandrake, Red Hat, Slackware, SuSE, and Trustix.
LinuxSecurity Feature Extras:
Get
out of a BIND – install DJBDNS– DJBDNS eases DNS management and
improves security over BIND alternatives by taking a different approach
to serving and caching DNS answers.Remote
Syslog with MySQL and PHP – Msyslog has the ability to log syslog
messages to a database. This allows for easier monitoring of multiple servers
and the ability to be display and search for syslog messages using PHP
or any other programming language that can communicate with the database.by
that, too.
[ Linux
Advisory Watch ] – [ Linux
Security Week ] – [ PacketStorm
Archive ] – [ Linux Security
Documentation ]
The Linux Advisory Watch newsletter is developed by the community of
volunteers at
and sponsored by Guardian Digital, Inc., the open
source security company.
| Package: | KDE |
| Date: | 03-17-2003 |
| Description: | The implementation of the rlogin protocol in all of the affected systems, and the implementation of the telnet protocol in affected KDE 2 systems. |
| Vendor Alerts: | Caldera:
|
| Package: | openssl |
| Date: | 03-19-2003 |
| Description: | The xdrmem_getbytes() function in the XDR library provided by Sun Microsystems contains an integer overflow that can lead to improperly sized dynamic memory allocation. |
| Vendor Alerts: | Caldera:
EnGarde:
Gentoo:
Trustix:
|
| Package: | tcpdump |
| Date: | 03-19-2003 |
| Description: | An attacker is able to send a specially crafted RADIUS network packet which causes tcpdump to enter an infinite loop. |
| Vendor Alerts: | Debian:
Trustix:
|
| Package: | samba |
| Date: | 03-19-2003 |
| Description: | A buffer overflow and race condition vulnerabilities have been fixed. These vulnerabilities may lead to remote root compromise. |
| Vendor Alerts: | Debian:
Gentoo:
Mandrake:
Slackware:
SuSE:
Red Hat:
Trustix:
|
| Package: | netpbm-free |
| Date: | 03-17-2003 |
| Description: | These vulnerabilities may allow remote attackers to cause a denial of service or execute arbitrary code. |
| Vendor Alerts: | Debian:
|
| Package: | lxr |
| Date: | 03-19-2003 |
| Description: | There is a vulnerability that allows a remote attacker to read arbitrary files on the host system as user www-data. |
| Vendor Alerts: | Debian:
|
| Package: | kernel |
| Date: | 03-18-2003 |
| Description: | This update fixes several vulnerabilities in the Linux kernel |
| Vendor Alerts: | EnGarde:
Red Hat:
Trustix:
|
| Package: | libc |
| Date: | 03-20-2003 |
| Description: | The xdrmem XDR stream object does incorrect bounds-checking. |
| Vendor Alerts: | FreeBSD:
|
| Package: | qpopper |
| Date: | 03-20-2003 |
| Description: | Under certain conditions it is possible to execute arbitrary code using a buffer overflow in the recent qpopper. |
| Vendor Alerts: | Gentoo:
|
| Package: | man |
| Date: | 03-20-2003 |
| Description: | man 1.5l fixes a bug which results in arbitrary code execution upon reading a specially formatted man file. |
| Vendor Alerts: | Gentoo:
Trustix:
|
| Package: | mysql |
| Date: | 03-20-2003 |
| Description: | MySQL will no longer read config files that are world-writeable. |
| Vendor Alerts: | Gentoo:
Trustix:
|
| Package: | rxvt |
| Date: | 03-20-2003 |
| Description: | Many of the features supported by popular terminal emulator software can be abused when un-trusted data is displayed on the screen. The impact of this abuse can range from annoying screen garbage to a complete system compromise. All of the issues below are actually documented features, anyone who takes the time to read over the man pages or source code could use them to carry out an attack. |
| Vendor Alerts: | Gentoo:
Red Hat:
|
| Package: | zlib |
| Date: | 03-18-2003 |
| Description: | Richard Kettlewell discovered a buffer overflow vulnerability in the zlib library’s gzprintf() function. |
| Vendor Alerts: | Mandrake:
|
| Package: | gnome-lokkit |
| Date: | 03-17-2003 |
| Description: | Updated Gnome-lokkit packages fix missing FORWARD ruleset in Red Hat Linux 8.0. |
| Vendor Alerts: | Red Hat:
|
| Package: | glibc |
| Date: | 03-17-2003 |
| Description: | Updated glibc packages are available to fix an integer overflow in the XDR decoder. |
| Vendor Alerts: | Red Hat:
|
Category:
- Security
