Linux Advisory Watch – September 19, 2003

There are multiple local environment variable vulnerabilities in mana.

http://www.linuxsecurity.com/advisories/caldera_advisory-3622.html

A buffer overflow and an integer overflow that can be exploited by remote attackers through the sending of specially crafted messages have been fixed.

http://www.linuxsecurity.com/advisories/connectiva_advisory-3616.html

Buffer overflow vulnerability

Multiple buffer overflow vulnerabilities existed that could be exploited to at least crash programs linked to gtkhtml by using malformed HTML. In the case of Evolution, a remote attacker can use an HTML mail as an attack vector.

http://www.linuxsecurity.com/advisories/connectiva_advisory-3617.html

This update fixes a potential remote vulnerability in the buffer handling code of OpenSSH.

http://www.linuxsecurity.com/advisories/connectiva_advisory-3623.html

This update fixes new vulnerabilities found in the code that handles buffers in OpenSSH. These vulnerabilities are similiar to the ones fixed in the CLSA-2003:739 announcement and can be exploited by a remote attacker to cause a denial of service condition and potentially execute arbitrary code

http://www.linuxsecurity.com/advisories/connectiva_advisory-3648.html

buffer overflow vulnerabilities

Michal Zalewski reported a remote vulnerability in sendmail versions 8.12.9 and earlier.

http://www.linuxsecurity.com/advisories/connectiva_advisory-3656.html

World writable configuration files, a double-free vulnerability, and a password handler buffer overflow have been fixed in this update.

http://www.linuxsecurity.com/advisories/connectiva_advisory-3658.html

Four vulnerabilities have been identified and fixed in XFree86 including potential denial of service vulnerability.

http://www.linuxsecurity.com/advisories/debian_advisory-3618.html

MySQL contains a buffer overflow condition which could be exploited by a user who has permission to execute “ALTER TABLE” commands on the tables in the “mysql” database.

http://www.linuxsecurity.com/advisories/debian_advisory-3619.html

A bug has been found in OpenSSH’s buffer handling where a buffer could be marked as grown when the actual reallocation failed.

http://www.linuxsecurity.com/advisories/debian_advisory-3624.html

This advisory is an addition to the earlier DSA-382-1 advisory: two more buffer handling problems have been found in addition to the one described in DSA-382-1

http://www.linuxsecurity.com/advisories/debian_advisory-3633.html

Several bugs have been found in OpenSSH’s buffer handling. It is not known if these bugs are exploitable, but as a precaution an upgrade is advised.

http://www.linuxsecurity.com/advisories/debian_advisory-3634.html

There are multiple buffer overflow vulnerabilities in the sendmail package.

http://www.linuxsecurity.com/advisories/debian_advisory-3651.html

The OpenSSH daemon shipped with all versions of EnGarde Secure Linux contains a potentially exploitable buffer management error.

http://www.linuxsecurity.com/advisories/engarde_advisory-3621.html

After the release of ESA-20030916-023, the OpenSSH team discovered more buffer management bugs (fixed in OpenSSH 3.7.1) of the same type. Additionally, Solar Designer fixed additional bugs of this class. His fixes are included in this update.

http://www.linuxsecurity.com/advisories/engarde_advisory-3649.html

The MySQL daemon contains a buffer overflow which may be exploited by any user who has ALTER TABLE permissions on the “mysql” database

http://www.linuxsecurity.com/advisories/engarde_advisory-3650.html

management error

A bug has been found in OpenSSH’s buffer handling where a buffer could be marked as grown when the actual reallocation failed.

http://www.linuxsecurity.com/advisories/freebsd_advisory-3625.html

A buffer overflow that may occur during header parsing was identified. An attacker could create a specially crafted message that may cause sendmail to execute arbitrary code with the privileges of the user running sendmail, typically root.

http://www.linuxsecurity.com/advisories/freebsd_advisory-3647.html

Anyone with global administrative privileges on a MySQL server may execute arbitrary code even on a host he isn’t supposed to have a shell on, with the privileges of the system account running the MySQL server.

http://www.linuxsecurity.com/advisories/gentoo_advisory-3620.html

There’s a heap overflow in all versions of exim3 and exim4 prior to version 4.21. It can be exercised by anyone who can make an SMTP connection to the exim daemon.

http://www.linuxsecurity.com/advisories/gentoo_advisory-3626.html

ll versions of OpenSSH’s sshd prior to 3.7 contain a buffer management error. It is uncertain whether this error is potentially exploitable, however, we prefer to see bugs fixed proactively.

http://www.linuxsecurity.com/advisories/gentoo_advisory-3629.html

Buffer overflow vulnerabilities

Fix a buffer overflow in address parsing. Fix a potential buffer overflow in ruleset parsing. This problem is not exploitable in the default sendmail configuration.

http://www.linuxsecurity.com/advisories/gentoo_advisory-3646.html

A bug has been found in OpenSSH’s buffer handling where a buffer could be marked as grown when the actual reallocation failed.

http://www.linuxsecurity.com/advisories/immunix_advisory-3627.html

This advisory has been updated to reflect that the OpenSSH team has found more instances of the programming idiom in question in their codebase.

http://www.linuxsecurity.com/advisories/immunix_advisory-3635.html

Michal Zalewski discovered flaws in sendmail’s prescan() function.

http://www.linuxsecurity.com/advisories/immunix_advisory-3652.html

A buffer overwrite with unknown consequences has been found in OpenSSH.

http://www.linuxsecurity.com/advisories/netbsd_advisory-3636.html

The iBCS2 system call translator for statfs erroneously used the user-supplied length parameter when copying a kernel data structure into userland.

http://www.linuxsecurity.com/advisories/netbsd_advisory-3637.html

multiple vulnerabilities

Three unrelated problems with inappropriate argument handling were found in the kernel sysctl code, which could be exploited by malicious local user.

http://www.linuxsecurity.com/advisories/netbsd_advisory-3638.html

A bug has been found in OpenSSH’s buffer handling where a buffer could be marked as grown when the actual reallocation failed.

http://www.linuxsecurity.com/advisories/redhat_advisory-3628.html

Updated KDE packages that resolve a local security issue with KDM PAM support and weak session cookie generation are now available.

http://www.linuxsecurity.com/advisories/redhat_advisory-3631.html

Buffer manipulation vulnerabilities

Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1.

http://www.linuxsecurity.com/advisories/redhat_advisory-3644.html

Updated Sendmail packages that fix a potentially-exploitable vulnerability are now available. The sucessful exploitation of this bug can lead to heap and stack structure overflows.

http://www.linuxsecurity.com/advisories/redhat_advisory-3645.html

These fix a buffer management error found in versions of OpenSSH earlier than 3.7. The possibility exists that this error could allow a remote exploit, so we recommend all sites running OpenSSH upgrade to the new OpenSSH package immediately.

http://www.linuxsecurity.com/advisories/slackware_advisory-3630.html

buffer management errors

These packages fix additional buffer management errors that were not corrected in the recent 3.7p1 release.

http://www.linuxsecurity.com/advisories/slackware_advisory-3639.html

There are multiple vulnerabilities in the sendmail package.

http://www.linuxsecurity.com/advisories/slackware_advisory-3640.html

A programming error has been found in code responsible for buffer management. If exploited by a (remote) attacker, the error may lead to unauthorized access to the system, allowing the execution of arbitrary commands.

http://www.linuxsecurity.com/advisories/suse_advisory-3632.html

A programming error has been found in code responsible for buffer management.

http://www.linuxsecurity.com/advisories/suse_advisory-3657.html

All versions of OpenSSH’s sshd prior to 3.7.1 contain buffer management errors.

http://www.linuxsecurity.com/advisories/trustix_advisory-3641.html

Fixed buffer overflow in SET PASSWORD which could potentially be exploited by MySQL users with root privileges to execute random code or to gain shell access.

http://www.linuxsecurity.com/advisories/trustix_advisory-3642.html

This vulnerability may allow a remote attacker to execute arbitrary code.

http://www.linuxsecurity.com/advisories/turbolinux_advisory-3643.html

The potential buffer overflows are in ruleset parsing and address parsing for sendmail.

http://www.linuxsecurity.com/advisories/turbolinux_advisory-3653.html

Updated packages are now available to fix additional buffer manipulation problems which were fixed in OpenSSH 3.7.1.

http://www.linuxsecurity.com/advisories/yellowdog_advisory-3654.html

Michal Zalewski found a bug in the prescan() function of unpatched Sendmail versions prior to 8.12.10.

http://www.linuxsecurity.com/advisories/yellowdog_advisory-3655.html

INTRODUCING: Secure Mail Suite from Guardian DigitalUnparalleled E-Mail Security. Secure Mail Suite is the most Dynamic, Rigorous Protection for Your Email System on the market today. It Clobbers Spam. Detects and Disables Viruses. And its Killer Firewall Keeps Your Data — and Your System and Safe and Secure. All in an Easy-to-Manage Application that’s Simple to Administer and Maintain.

Secure Mail Suite is Guardian Digital’s Optimum Solution to Mail Security. It’s based on Open-Source Engineering, so it’s constantly Improving. And with Guardian Digital Engarde Support, Secure Mail Suite Stays On Guard for You — for Many Reliable Years. Secure Mail Suite. Sweet! From the First Name in Open-Source Security. Guardian Digital.