LWN.net Weekly Edition for September 11, 2003

The state of the SCO case

The whole SCO affair started as a breach-of-contract suit against IBM. That suit is based on the language of the Unix contracts signed with ATT almost two decades ago, which reads:

The core of SCO's claim is that anything that IBM has ever allowed to be a part of a Unix system has become a "derived product" of Unix and must be treated as if it were Unix itself. SCO cannot make any ownership claims over this code - a side letter to the contract makes that explicit - but it does claim the right to keep IBM from disclosing its own code.

Through its public statements, SCO has since made claims of massive direct copying of SYSV Unix code into Linux. There is still no court case where SCO has made such claims, however. The company's experience at SCO Forum and subsequent public statements suggest that the evidence for direct copying of code - actual copyright violations - is weak at best. SCO might have a small case against SGI, depending on how a judge might choose to interpret the copyright status of 32V Unix and the true source of the ate_malloc() code. But that is between those two companies; the code in question has already been removed from current Linux kernels.

Increasingly, it seems that SCO is left with its original breach of contract case. The recently issued open letter from Darl McBride does nothing to change that impression; it mentions the ate_malloc() case but does not allege any other direct copying. Instead, the company's claims are expressed as follows:

In SCO's view, "Unix System V protected code" is a rather wider set than "SCO-owned code." In fact, at SCO Forum, the company put up a slide discussing the "more than one million lines" that it claims. Here's where they come from:

Subsystem	Files	Lines
Read-copy-update	46	109,688
NUMA	101	56,587
JFS	44	32,224
XFS	173	119,130
Symmetric multiprocessing	1,185	829,393
TOTAL	1,549	1,147,022

(SCO has posted the slides to its presentations on this page. You'll have to click past the cheery warning that things are optimized for Internet Explorer to view them, though.)

These claims are interesting in a number of ways. Let's look at the RCU claim for a moment. In a modern Linux kernel (RCU does not appear in 2.4), the RCU implementation is contained in two files (include/linux/rcupdate.h and kernel/rcupdate.c), which add up to an amazing 402 lines. That leaves us 44 files and 109,286 lines short of the claim made by SCO. Clearly, SCO must also be making claims on any code that uses RCU in any way. If you look for files that make any use of the RCU subsystem, the results are:

File	Lines
arch/i386/oprofile/nmi_timer_int.c	57
drivers/char/ipmi/ipmi_kcs_intf.c	1275
fs/dcache.c	1641
include/asm-x86_64/kdebug.h	44
include/linux/rcupdate.h	135
include/linux/dcache.h	316
include/linux/list.h	565
include/net/dst.h	254
init/main.c	604
ipc/util.c	612
kernel/rcupdate.c	267
kernel/module.c	1949
kernel/sched.c	2594
net/802/psnap.c	160
net/bridge/br_device.c	147
net/bridge/br_forward.c	157
net/bridge/br_if.c	289
net/bridge/br_ioctl.c	309
net/bridge/br_input.c	159
net/core/netfilter.c	761
net/core/dev.c	3092
net/ipv4/af_inet.c	1250
net/ipv4/icmp.c	1120
net/ipv4/ip_input.c	433
net/ipv4/route.c	2797
net/ipv6/af_inet6.c	895
net/ipv6/icmp.c	787
net/ipv6/ip6_input.c	260
net/decnet/dn_route.c	1843
TOTAL 29 files	24,772

So, even with such an expansive interpretion of SCO's claim, there are 17 files missing. They must be big files as well, since they must account for the remaining 84,916 lines. The "contamination" caused by RCU is evidently a very broad thing. We asked SCO where the missing files were, but were told only "[T]his level of detail is something that we will save for our court case in 2005." So we're going to have to remain in suspense for a while. But one thing is clear: SCO claims that the old AT&T licenses give it amazing powers over code that has ever breathed the same air as SYSV Unix. Anybody who claims that the GPL is overly "viral" or that it threatens intellectual property should take a good look at the powers that SCO claims its license gives it. The GPL can't compete in that league.

SCO's legal argument is interesting; the company claims that Linux hackers have, while having never actually seen the SYSV Unix source, nontheless created a derived product of SYSV Unix. They are accused of copying something they never had access to. This argument seems destined to fail; how can something which contains no SYSV code be a derived product of SYSV? But that is the core of SCO's argument.

An interesting question comes out of this: what if SCO wins its case? SCO will have then convinced a court that IBM released IBM's code in violation of an agreement it had with SCO. The fact that IBM released IBM's code, however, would not change. SCO does not own that code, how can it claim a right to payments from Linux users? If SCO wins, it may get a chunk of money from IBM. But it should still have nothing which entitles it to license payment from Linux users.

Returning to Darl McBride's open letter, we note that there are no demands that Linux users buy SCO "licenses," and no threats of suits against users. Mr. McBride, instead, has taken a bit of a different approach:

One might point out that the free software world does, indeed, have an "intellectual property foundation." It is based on copyright law, and free licenses, including the GPL, which SCO has said it wants to break. One might also point out that the community is not in much of a mood for "working with" SCO at this point. But one's time might be better spent pondering what SCO was thinking when it published those words.

SCO clearly wants to be able to put a tax on Linux systems. SCO also clearly sees the GPL as an obstacle; there is no way to make a tax stick to Linux as long as it remains freely redistributable. Could SCO be casting around for a scheme to buy off free software developers should its challenges to the GPL fail? A nice tax for SCO and a few bones tossed to developers willing to relicense their code? It is hard to see how such a scheme could possibly succeed, but it is also hard to find another way to interpret the words quoted above.

In summary, the SCO case remains interesting. SCO has changed its tune several times, but, for the moment, is back where it began: a breach of contract suit against IBM. The company has yet to produce any evidence that Linux users owe it money. It is also now interested in "working with the open source community." But SCO remains unpredictable. We have not yet seen the last strange twist in this case.

Comments (13 posted)

An opening for OpenOffice.org

[This article was contributed by Joe 'Zonker' Brockmeier]

For years now, Linux users have had to struggle with the omnipresent Microsoft Office formats. Developers working on OpenOffice.org, Abiword, KOffice, Gnumeric and other applications have had their hands full trying to decipher the proprietary and obfuscated MS Office formats so that users could read and exchange documents with their MS Office-using colleagues. With Microsoft Office 2003, Redmond is taking obfuscation to new levels that may mean legal problems for developers who try to provide compatibility with Office, and huge fees for companies that try to adopt it.

In addition to the usual slew of new features, Office 2003 Professional comes with Information Rights Management (IRM) tools. (Users of Office 2003 Standard can not create IRM documents.) Basically, IRM is just another name for Digital Rights Management (DRM), a term that Microsoft is avoiding because of the negative connotations that DRM has already picked up. IRM allows users to restrict what others can do with a document. Without the proper permissions, recipients of IRM-restricted documents will be unable to read or print them. Recipients of IRM-restricted e-mails will be unable to forward them as well. And users can set documents to expire.

Naturally, these documents will be incompatible with previous versions of Microsoft Office, to say nothing of competing tools like OpenOffice.org, Gnumeric or Ximian's Evolution. In addition to the usual format obfuscation, however, Microsoft also has the Digital Millenium Copyright Act (DMCA) to protect it from competition. Since the format includes encryption, Microsoft will be able to threaten developers with the DMCA if they attempt to include support for IRM-restricted documents.

Microsoft's IRM also depends on its server-based Rights Management Services (RMS). This means that any company wanting to adopt IRM is also forced to adopt Microsoft at the server. It doesn't preclude companies using a mixture of Microsoft and Linux servers, but it does mean that organizations that have only adopted Microsoft at the desktop would be forced to make additional investments in Microsoft software.

Not only is the technology extremely restrictive, the price should be enough to give any CFO or business owner pause. To deploy RMS within an organization requires that you run Windows Server 2003. That brings some hefty licensing fees on its own, but there's more. Every user who connects to that server has to have a Windows Server 2003 Client Access License (CAL) and a RMS User CAL, not to mention the licensing fees for that user's copy of Windows XP and Office 2003 Professional. The RMS CAL alone runs $37 for a single user, or $185 for a pack of five CALs. No doubt, large organizations could get the CALs even cheaper, but it still becomes very expensive. Note that this isn't just for users who create IRM documents, but also for any user who views an IRM-restricted document.

That's to use Microsoft's RMS within an organization. Companies that want to share files with users outside the organization, will need yet another license from Microsoft. According to Microsoft's pricing and licensing overview page, this license alone will run an organization $18,066 for the Windows RMS External Connector License. This fee may not be a major obstacle for large organizations, but it would certainly represent a major burden on small companies that need to share documents with clients.

Believe it or not, Microsoft's new Office suite is potentially good news for the open souce community. It creates yet another opening for Linux vendors and proponents to make the case for free and open software in business. Microsoft has laid out its vision for the future of software, and it's filled with licensing fees stacked upon licensing fees -- and technologies that suck the user deeper and deeper into Microsoft's "stack" of solutions. Many organizations have been content to adopt Windows on the desktop, and other technologies at the server level. Redmond's all-or-nothing approach, attempting to force their customers to adopt their toolchain entirely, may end up driving them away completely.

To use IRM/RMS, an organization would have to adopt Microsoft across the board -- and likely will require them to persuade their business partners to do the same. Few organizations can get by without sharing documents externally. Expect major levels of frustration when a company adopts Office 2003 with IRM, and tries to share documents with others using older versions of Office. Even if a company is gung-ho about IRM, their business partners may not be.

If the Office 2003 strategy works, and organizations start jumping on the IRM bandwagon, it's the ultimate lock-in for Microsoft. Game over for Linux users (and vendors) trying to maintain compatibility with Windows users. This would have the potential of breaking compatibility even for reading e-mail, if you work with Outlook users who enable IRM.

But it also has the potential to cause some significant backlash against Redmond when companies start tallying up the costs of switching and being fully compatible with Microsoft's document DRM. Let's not forget that most organizations are being much more stingy with their tech purchases these days. Many companies are still smarting over Microsoft's "new and improved" licensing programs and the recent security snafus. If SoBig.F wasn't enough to send companies over to Linux, Office 2003 might be the straw that broke the camel's back.

Comments (40 posted)

On giving back

On September 8, LynuxWorks announced the availability of a beta release of BlueCat Linux 5.0. BlueCat is the company's embedded Linux distribution; 5.0, interestingly, is based on the (still unreleased) 2.6 kernel. LynuxWorks claims to have applied a lengthy series of "ISO 9001:2000" reliability tests to this kernel. The PR also cites some of the features of this kernel which are of interest to the embedded community, including kernel preemption, the O(1) scheduler, and the improved threading support. LynuxWorks, they say, is the first embedded systems company to make these features available in a Linux-based system.

The interesting thing, of course, is that all of those features were developed at other companies. Kernel preemption, in particular, was done by Nigel Gamble and Robert Love at MontaVista - a direct LynuxWorks competitor. The extensive testing done by LynuxWorks must certainly have turned up bugs; the 2.6 kernel is still an unreleased product, beta quality at best. Yet no fixes appear to have been sent back to the community. Over the last year, only one posting appeared on linux-kernel from either lynuxworks.com or lnxw.com - a request for help with a compilation problem. The 2.6 BitKeeper repository, containing all patches merged since February 2002, shows one set of patches from LynuxWorks.com: a USB Pegasus driver by Petko Manolov. The last patch was merged in May, 2002. We asked LynuxWorks if it had a list of recent contributions (which could, after all, have been sent in from a different email address), but got no response.

LynuxWorks, in other words, is taking full advantage of the work of others - including its competitors - to claim to be "first to market" with a set of new features. And it has done so without contributing much of anything back to the community from which it draws the software it is selling. LynuxWorks is far from alone in this behavior, of course. LynuxWorks is also acting entirely within its rights. As long as they abide by the GPL, nobody can complain if they use the software in this way. That is what free software is all about.

It is also true, however, that being within your rights and being right are not always the same thing. A company that is making money selling Linux should feel some obligation to contribute back to Linux. Especially when that company is in the operating systems business and clearly has the technical resources to make that sort of contribution.

Contributing back is not just the right thing to do; it is also good business. Customers feel better when they see that their suppliers have a good relationship with the development community upon which they depend. Customers also like the feeling that a supplier understands the software well enough to make changes and get them accepted; it improves that chances that bugs can be fixed and requested changes implemented. They feel better about the software as a whole if the vendor cares enough to make it better. Software with active support from those selling it has a better chance of being around and still maintained a few years from now.

Many free software companies understand this well; they point to their free software contributions as a source of pride. As users of free software become more sophisticated, they will ask for that information. Customers need to know that their suppliers can provide them with the support they need, and that said suppliers are committed to the future of the software they work with. A history of contributing back to the software in question is one of the best ways to show customers what they want to see. It also has the incidental benefits of making the software better and being the right thing to do.

Comments (13 posted)

The Chamberlain v. Skylink DMCA ruling

One of the many DMCA cases circulating in the U.S. court system is Chamberlain v. Skylink. Chamberlain manufactures garage door openers and, of course, the remote units which are used to open and close the garage door. Recent Chamberlain models use a "rolling code" system which is intended to protect homeowners against playback attacks; the code transmitted by the remote is different every time, so a thief with a recorder would capture nothing useful. This system also has the incidental result of preventing other companies from selling remotes that work with Chamberlain openers.

Except that Skylink figured out a way to get around the code, and marketed a working remote. Chamberlain then took Skylink to court, claiming that, among other things, the Skylink remote violates the Digital Millennium Copyright Act. The problem, it seems, is that the Skylink remote circumvents the "technical measures" employed by Chamberlain to restrict access to the copyrighted software in its openers. Chamberlain was sufficiently confident of its position that it asked for a summary judgement on the DMCA argument. At the end of August, the court denied that request; the full text of the ruling is available in PDF format.

One might hope that this case would have been an opportunity for the court to take a serious look at the DMCA. The DMCA, used in this way, is an effective tool to prevent the creation of interoperable products in a wide range of industries. All that's needed is a bit of internal code and a simple "technical measure" to prevent interoperation; the DMCA does the rest. Unfortunately, the ruling in this case does little to help those who would like to see the power of the DMCA reduced.

The court denied the judgement for two reasons. The first is that, in the court's opinion, Chamberlain did not establish that the software inside its garage door opener was actually protected by copyright - a crucial precondition for DMCA applicability. This is a true technicality here; it is difficult to believe that Chamberlain will not have a copyright interest in the software it created.

The second reason is, essentially, that Chamberlain did not tell its customers that they couldn't use competing remotes.

This second point may be enough to sink Chamberlain's DMCA argument, but it leaves the DMCA itself untouched. A simple statement on the box that only Chamberlain remotes may be used with the opener will close the hole in the future. This ruling is a defeat for a company attempting to wield the DMCA for its commercial benefit, but it will do nothing to stop this use of the DMCA in the future.

Comments (5 posted)

Page editor: Jonathan Corbet

Security

Security news

The apache evasive maneuvers module

Jonathan Zdziarski announced the release of mod_dosevasive 1.8 at the beginning of September. mod_dosevasive is an apache module, licensed under the GPL, which enables a web server to detect certain kinds of denial-of-service attack and take appropriate action.

The core of mod_dosevasive is a set of hash tables keeping track of recent page requests. If a particular system (as identified by its IP address) starts requesting too many pages at once, or it requests the same page repeatedly too often, the module decides an attack is underway. The next request from that source will get back a 403 error response, and the site goes into the blacklist. The default blacklist period is ten seconds; each request received while the offending system is blacklisted extends its time there.

mod_dosevasive can also send notification email when it detects an attack, or execute an arbitrary command. The command capability is intended to make the module work with firewalls; rather than continually failing requests with 403 errors, an administrator can set up the firewall to simply block traffic from the attacking system altogether. That approach, clearly, will be more effective against large-scale distributed attacks where the real purpose is to consume bandwidth.

The mod_dosevasive web page has more information.

Comments (3 posted)

September CERT Summary

The September quarterly CERT Summary is out, discussing the security issues which are currently worth noting. Most notable this time around is the fact that Linux and free software do not figure into any of the problems covered. According to this summary, all of the serious security issues of the last three months affect only proprietary software. Enjoy it while it lasts.

Full Story (comments: none)

New vulnerabilities

exim: buffer overflows

Package(s):	exim exim-tls	CVE #(s):	CAN-2003-0743
Created:	September 4, 2003	Updated:	September 30, 2003
Description:	A buffer overflow exists in exim, which is the standard mail transport agent in Debian. By supplying a specially crafted HELO or EHLO command, an attacker could cause a constant string to be written past the end of a buffer allocated on the heap. This vulnerability is not believed at this time to be exploitable to execute arbitrary code. CAN-2003-0743
Alerts:	Gentoo 200309-09 2003-09-15 Debian DSA-376-2 2003-09-07 Conectiva CLA-2003:735 2003-09-05 Debian DSA-376-1 2003-09-04

Comments (none posted)

inetd: DoS attack

Package(s):	inetd	CVE #(s):
Created:	September 8, 2003	Updated:	September 10, 2003
Description:	inetd has a hard-coded limit of 256 connections-per-minute, after which the given service is disabled for ten minutes. An attacker could use a quick burst of connections every ten minutes to effectively disable a service. Once upon a time, this was an intentional feature of inetd, but in today's world it has become a bug. Even having inetd look at the source IP and try to limit only the source of the attack would be problematic since TCP source addresses are so easily faked.
Alerts:	Slackware SSA:2003-251-01 2003-09-08

Comments (3 posted)

mah-jong: buffer overflows, denial of service

Package(s):	mah-jong	CVE #(s):	CAN-2003-0705 CAN-2003-0706
Created:	September 8, 2003	Updated:	September 10, 2003
Description:	Nicolas Boullis discovered two vulnerabilities in mah-jong, a network-enabled game. CAN-2003-0705 (buffer overflow): This vulnerability could be exploited by a remote attacker to execute arbitrary code with the privileges of the user running the mah-jong server. CAN-2003-0706 (denial of service): This vulnerability could be exploited by a remote attacker to cause the mah-jong server to enter a tight loop and stop responding to commands.
Alerts:	Debian DSA-378-1 2003-09-07

Comments (none posted)

wu-ftpd: insecure program execution

Package(s):	wu-ftpd	CVE #(s):	CVE-1999-0997
Created:	September 5, 2003	Updated:	September 24, 2003
Description:	wu-ftpd, an FTP server, implements a feature whereby multiple files can be fetched in the form of a dynamically constructed archive file, such as a tar archive. The names of the files to be included are passed as command line arguments to tar, without protection against them being interpreted as command-line options. GNU tar supports several command line options which can be abused, by means of this vulnerability, to execute arbitrary programs with the privileges of the wu-ftpd process.
Alerts:	Slackware SSA:2003-259-03 2003-09-23 Conectiva CLA-2003:748 2003-09-22 Debian DSA-377-1 2003-09-04

Comments (1 posted)

Updated vulnerabilities

2.4 kernel - several vulnerabilities

Package(s):	2.4 kernel	CVE #(s):	CAN-2003-0461 CAN-2003-0462 CAN-2003-0464 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552
Created:	July 21, 2003	Updated:	December 23, 2003
Description:	Several security issues have been discovered affecting the Linux kernel: CAN-2003-0461: /proc/tty/driver/serial reveals the exact character counts for serial links. This could be used by a local attacker to infer password lengths and inter-keystroke timings during password entry. CAN-2003-0462: Paul Starzetz discovered a file read race condition existing in the execve() system call, which could cause a local crash. CAN-2003-0464: A recent change in the RPC code set the reuse flag on newly-created sockets. Olaf Kirch noticed that his could allow normal users to bind to UDP ports used for services such as nfsd. CAN-2003-0476: The execve system call in Linux 2.4.x records the file descriptor of the executable process in the file table of the calling process, allowing local users to gain read access to restricted file descriptors. CAN-2003-0501: The /proc filesystem in Linux allows local users to obtain sensitive information by opening various entries in /proc/self before executing a setuid program. This causes the program to fail to change the ownership and permissions of already opened entries. CAN-2003-0550: The STP protocol is known to have no security, which could allow attackers to alter the bridge topology. STP is now turned off by default. CAN-2003-0551: STP input processing was lax in its length checking, which could lead to a denial of service. CAN-2003-0552: Jerry Kreuscher discovered that the Forwarding table could be spoofed by sending forged packets with bogus source addresses the same as the local host.
Alerts:	Red Hat RHSA-2003:408-00 2003-12-19 Gentoo 200308-01 2003-08-14 Debian DSA-358-4 2003-08-13 SuSE SuSE-SA:2003:034 2003-08-12 Debian DSA-358-2 2003-08-05 Debian DSA-358-3 2003-08-04 Debian DSA-358-1 2003-07-31 EnGarde ESA-20032407-018 2003-07-24 Red Hat RHSA-2003:238-01 2003-07-21

Comments (none posted)

apache: multiple vulnerabilities in Apache HTTP server

Package(s):	apache	CVE #(s):	CAN-2003-0192 CAN-2003-0253 CAN-2003-0254
Created:	July 11, 2003	Updated:	September 22, 2003
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of the Apache HTTP Server 2.0.47. This release fixes four security vulnerabilities: Certain sequences of per-directory renegotiations and the SSLCipherSuite directive being used to upgrade from a weak ciphersuite to a strong one could result in the weak ciphersuite being used in place of the strong one. [CAN-2003-0192] Certain errors returned by accept() on rarely accessed ports could cause temporal denial of service, due to a bug in the prefork MPM. [CAN-2003-0253] Denial of service was caused when target host is IPv6 but ftp proxy server can't create IPv6 socket. [CAN-2003-0254] The server would crash when going into an infinite loop due to too many subsequent internal redirects and nested subrequests. [VU#379828]
Alerts:	Red Hat RHSA-2003:243-01 2003-09-22 Red Hat RHSA-2003:240-01 2003-09-04 Mandrake MDKSA-2003:075-1 2003-08-28 Mandrake MDKSA-2003:075 2003-07-21 Conectiva CLA-2003:698 2003-07-21 Trustix 2003-0025 2003-07-11

Comments (none posted)

autorespond: buffer overflow

Package(s):	autorespond	CVE #(s):	CAN-2003-0654
Created:	August 18, 2003	Updated:	September 30, 2003
Description:	Christian Jaeger discovered a buffer overflow in autorespond, an email autoresponder used with qmail. This vulnerability could potentially be exploited by a remote attacker to gain the privileges of a user who has configured qmail to forward messages to autorespond. This vulnerability is currently not believed to be exploitable due to incidental limits on the length of the problematic input, but there may be situations in which these limits do not apply. CAN-2003-0654
Alerts:	Debian DSA-373-1 2003-08-16

Comments (none posted)

bind buffer overflow vulnerability in DNS resolver libraries

Package(s):	bind glibc	CVE #(s):	CAN-2002-0651 CAN-2002-0684
Created:	July 8, 2002	Updated:	September 30, 2003
Description:	The BIND 4.9.8-OW2 patch and BIND 4.9.9 release (and thus 4.9.9-OW1) include fixes for a libc related vulnerability which does not affect Linux. Updates from the Internet Software Consortium (ISC) are available from here. No release or branch of Openwall GNU/*/Linux (Owl) is known to be affected, due to Olaf Kirch's fixes for this problem getting into the GNU C library more than two years ago. Unfortunatly that does not mean that Linux systems are not vulnerable. Similar code, without Olaf Firch's fixes, is in the glibc getnetbyXXX functions. These functions are described in the SuSE alert as " used by very few applications only, such as ifconfig and ifuser, which makes exploits less likely." CERT Advisory: CA-2002-19 Buffer Overflow in Multiple DNS Resolver Libraries CAN-2002-0651 CAN-2002-0684
Alerts:	Mandrake MDKSA-2002:050 2002-08-13 Yellow Dog YDU-20020810-3 2002-08-10 Eridani ERISA-2002:035 2002-08-09 Red Hat RHSA-2002:133-13 2002-08-08 SCO Group CSSA-2002-034.0 2002-08-05 Yellow Dog YDU-20020801-2 2002-08-01 Eridani ERISA-2002:028 2002-07-25 Red Hat RHSA-2002:139-10 2002-07-22 EnGarde ESA-20020724-018 2002-07-24 Mandrake MDKSA-2002:043 2002-07-16 Trustix 2002-0061 2002-07-15 Gentoo glibc-20020713 2002-07-13 Conectiva CLA-2002:507 2002-07-11 SuSE SuSE-SA:2002:026 2002-07-09 OpenPKG OpenPKG-SA-2002.006 2002-07-04

Comments (1 posted)

Canna server: exploitable buffer overrun

Package(s):	canna	CVE #(s):	CAN-2002-1158 CAN-2002-1159
Created:	December 10, 2002	Updated:	September 30, 2003
Description:	Canna is a kana-kanji conversion server which is necessary for Japanese language character input. A buffer overflow bug in the Canna server up to and including version 3.5b2 allows a local user to gain the privileges of the user 'bin' which could lead to further exploits. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1158 to this issue. A lack of validation of requests has been found that affects Canna version 3.6 and earlier. A malicious remote user could exploit this vulnerability to leak information, or cause a denial of service attack. (CAN-2002-1159) See also http://canna.sourceforge.jp/sec/Canna-2002-01.txt CAN-2002-1158 CAN-2002-1159
Alerts:	SCO Group CSSA-2003-005.0 2003-01-21 Debian DSA-224-1 2002-01-08 Gentoo 200212-8 2002-12-20 Red Hat RHSA-2002:246-18 2002-12-04

Comments (none posted)

eroaster: insecure temporary file

Package(s):	eroaster	CVE #(s):	CAN-2003-0656
Created:	August 19, 2003	Updated:	September 30, 2003
Description:	A vulnerability was discovered in eroaster where it does not take any security precautions when creating a temporary file for the lockfile. This vulnerability could be exploited to overwrite arbitrary files with the privileges of the user running eroaster. CAN-2003-0656
Alerts:	Gentoo 200309-04 2003-09-02 Mandrake MDKSA-2003:083 2003-08-19 Debian DSA-366-1 2003-08-05

Comments (none posted)

ethereal: security problems in Ethereal 0.9.12

Package(s):	ethereal	CVE #(s):	CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432
Created:	June 23, 2003	Updated:	November 10, 2003
Description:	Several security problems have been found in Ethereal 0.9.12. "It may be possible to make Ethereal crash or run arbitrary code by injecting a purposefully malformed packet onto the wire, or by convincing someone to read a malformed packet trace file."
Alerts:	SCO Group CSSA-2003-030.0 2003-11-07 Yellow Dog YDU-20030718-2 2003-07-18 Red Hat RHSA-2003:203-01 2003-07-03 Gentoo 200306-13 2003-06-25 Conectiva CLA-2003:662 2003-06-25 Mandrake MDKSA-2003:070 2003-06-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fdclone: insecure temporary directory

Package(s):	fdclone	CVE #(s):	CAN-2003-0596
Created:	July 23, 2003	Updated:	September 30, 2003
Description:	fdclone creates a temporary directory in /tmp as a workspace. However, if this directory already exists, the existing directory is used instead, regardless of its ownership or permissions. This would allow an attacker to gain access to fdclone's temporary files and their contents, or replace them with other files under the attacker's control. CAN-2003-0596
Alerts:	Debian DSA-352-1 2003-07-22

Comments (none posted)

fetchmail: buffer overflow

Package(s):	fetchmail	CVE #(s):	CAN-2002-1365
Created:	December 17, 2002	Updated:	October 20, 2003
Description:	Versions of fetchmail prior to 6.2.0 have (yet another) buffer overflow vulnerability which can be exploited remotely via a suitably crafted message. See this advisory for details.
Alerts:	Immunix IMNX-2003-7+-023-01 2003-10-17 Mandrake MDKSA-2003:011 2003-01-27 EnGarde ESA-20030127-002 2003-01-27 SCO Group CSSA-2003-001.0 2003-01-09 SuSE SuSE-SA:2003:001 2003-01-02 Debian DSA-216-1 2002-12-24 Red Hat RHSA-2002:293-09 2002-12-17 Conectiva CLA-2002:554 2002-12-16

Comments (3 posted)

gkrellm: buffer overflow

Package(s):	gkrellm	CVE #(s):
Created:	August 29, 2003	Updated:	September 3, 2003
Description:	A buffer overflow was discovered in gkrellmd, the server component of the gkrellm monitor package, in versions of gkrellm 2.1.x prior to 2.1.14. This buffer overflow occurs while reading data from connected gkrellm clients and can lead to possible arbitrary code execution as the user running the gkrellmd server.
Alerts:	Mandrake MDKSA-2003:087 2003-08-28

Comments (none posted)

glibc: DNS stub resolvers contain buffer overflow vulnerability

Package(s):	glibc	CVE #(s):	CAN-2002-1146
Created:	November 7, 2002	Updated:	February 5, 2004
Description:	DNS stub resolvers from multiple vendors contain a buffer overflow vulnerability. The impact of this vulnerability appears to be limited to denial of service. (See CERT Vulnerability Note VU#738331) The BIND 4 and BIND 8.2.x stub resolver libraries, and other libraries such as glibc 2.2.5 and earlier, libc, and libresolv, uses the maximum buffer size instead of the actual size when processing a DNS response, which causes the stub resolvers to read past the actual boundary ("read buffer overflow"), allowing remote attackers to cause a denial of service (crash).
Alerts:	Mandrake MDKSA-2004:009 2004-02-04 Red Hat RHSA-2002:197-09 2002-11-06 Red Hat RHSA-2002:197-06 2002-10-03

Comments (none posted)

gnupg: key validation

Package(s):	gnupg	CVE #(s):	CAN-2003-0255
Created:	May 15, 2003	Updated:	November 17, 2003
Description:	A key validation bug was discovered in the GNU Privacy Guard (GPG) which would cause keys with more then one user ID to trust all user ID's with the amount of trust given to the most-valid user ID.
Alerts:	SCO Group CSSA-2003-034.0 2003-11-17 Conectiva CLA-2003:694 2003-07-11 Yellow Dog YDU-20030602-4 2003-06-02 Mandrake MDKSA-2003:061 2003-05-22 Slackware ssa:2003-141-04 2003-05-22 Red Hat RHSA-2003:175-01 2003-05-20 Gentoo 200305-04 2003-05-16 OpenPKG OpenPKG-SA-2003.029 2003-05-16 EnGarde ESA-20030515-016 2003-05-15

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

horde: session hijacking

Package(s):	horde	CVE #(s):
Created:	September 1, 2003	Updated:	September 3, 2003
Description:	According to this advisory an attacker could send an email to a victim who used HORDE MTA, to get the victim to visit a website, which then logs all available information about the victim's system.
Alerts:	Gentoo 200309-02.1 2003-09-01 Gentoo 200309-02 2003-09-01

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpam-smb: exploitable buffer overflow

Package(s):	libpam-smb, pam-smb	CVE #(s):	CAN-2003-0686
Created:	August 26, 2003	Updated:	September 30, 2003
Description:	libpam-smb is a PAM authentication module which makes it possible to authenticate users against a password database managed by Samba or a Microsoft Windows server. If a long password is supplied, this can cause a buffer overflow which could be exploited to execute arbitrary code with the privileges of the process which invokes PAM services. See this advisory for more information. CAN-2003-0686
Alerts:	Conectiva CLA-2003:734 2003-09-05 SuSE SuSE-SA:2003:036 2003-09-03 Gentoo 200309-01 2003-09-01 Red Hat RHSA-2003:261-01 2003-08-26 Debian DSA-374-1 2003-08-26

Comments (1 posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

lynx: CRLF injection vulnerability

Package(s):	lynx	CVE #(s):	CAN-2002-1405
Created:	November 19, 2002	Updated:	September 30, 2003
Description:	If lynx is given a url with some special characters on the command line, it will include faked headers in the HTTP query. This feature can be used to force scripts (that use Lynx for downloading files) to access the wrong site on a web server with multiple virtual hosts. CAN-2002-1405
Alerts:	Conectiva CLA-2003:720 2003-08-11 Mandrake MDKSA-2003:023 2003-02-24 OpenPKG OpenPKG-SA-2003.011 2003-02-18 Red Hat RHSA-2003:029-06 2003-02-12 Trustix 2002-0085 2002-12-19 Debian DSA-210-1 2002-12-13 SCO Group CSSA-2002-049.0 2002-11-18

Comments (none posted)

perl-MailTools: remote command execution

Package(s):	MailTools	CVE #(s):	CAN-2002-1271
Created:	November 5, 2002	Updated:	September 19, 2003
Description:	The SuSE Security Team reviewed critical Perl modules, including the Mail::Mailer package. This package contains a security hole which allows remote attackers to execute arbitrary commands in certain circumstances. This is due to the usage of mailx as default mailer which allows commands to be embedded in the mail body. Note that mail processing programs which use this package can be affected by this vulnerability; in particular, SpamAssassin is vulnerable if you use the -r or -w flags.
Alerts:	Debian DSA-386-1 2003-09-18 Gentoo 200302-01 2003-02-02 Mandrake MDKSA-2002:076 2002-11-07 Gentoo 200211-001 2002-11-06 SuSE SuSE-SA:2002:041 2002-11-05

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mindi: insecure file creations

Package(s):	mindi	CVE #(s):	CAN-2003-0617
Created:	September 2, 2003	Updated:	September 30, 2003
Description:	Mindi versions prior to 0.86 creates files in /tmp which could allow local user to overwrite arbitrary files. CAN-2003-0617
Alerts:	Gentoo 200309-05 2003-09-02 Debian DSA-362-1 2003-08-02

Comments (none posted)

mpg123 - buffer overflow

Package(s):	mpg123	CVE #(s):	CAN-2003-0577
Created:	July 16, 2003	Updated:	September 30, 2003
Description:	The mpg123 utility contains a buffer overflow vulnerability which can allow an attacker to execute arbitrary code by way of a malicious MP3 file.
Alerts:	Gentoo 200309-17 2003-09-30 Mandrake MDKSA-2003:078 2003-07-23 Conectiva CLA-2003:695 2003-07-15

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netris: buffer overflow

Package(s):	netris	CVE #(s):	CAN-2003-0685
Created:	August 18, 2003	Updated:	September 30, 2003
Description:	Shaun Colley discovered a buffer overflow vulnerability in netris, a network version of a popular puzzle game. A netris client connecting to an untrusted netris server could be sent an unusually long data packet, which would be copied into a fixed-length buffer without bounds checking. This vulnerability could be exploited to gain the priviliges of the user running netris in client mode, if they connect to a hostile netris server. CAN-2003-0685
Alerts:	Debian DSA-372-1 2003-08-16

Comments (none posted)

net-snmp: denial of service vulnerability

Package(s):	net-snmp	CVE #(s):	CAN-2002-1170
Created:	December 17, 2002	Updated:	November 7, 2003
Description:	The SNMP daemon included in the Net-SNMP package versions 5.0.1 through 5.0.4 can be caused to crash if it is sent a specially crafted packet.
Alerts:	Conectiva CLA-2003:778 2003-11-07 Red Hat RHSA-2002:228-11 2002-12-17

Comments (none posted)

nfs-utils xlog() off-by-one bug

Package(s):	nfs-utils	CVE #(s):	CAN-2003-0252
Created:	July 14, 2003	Updated:	March 8, 2004
Description:	Linux NFS utils package contains remotely exploitable off-by-one bug. A local or remote attacker could exploit this vulnerability by sending specially crafted request to rpc.mountd daemon. See this BugTraq post for more details.
Alerts:	Trustix TSLSA-2004-0009 2004-03-05 SCO Group CSSA-2003-037.0 2003-11-17 Conectiva CLA-2003:700 2003-07-22 Mandrake MDKSA-2003:076 2003-07-21 Gentoo 200307-07 2003-07-19 Yellow Dog YDU-20030718-1 2003-07-18 Slackware SSA:2003-195-01b 2003-07-15 Immunix IMNX-2003-7+-018-01 2003-07-14 SuSE SuSE-SA:2003:031 2003-07-15 Slackware SSA:2003-195-01 2003-07-14 Debian DSA-349-1 2003-07-14 Red Hat RHSA-2003:206-01 2003-07-14

Comments (none posted)

node: buffer overflow, format string

Package(s):	node	CVE #(s):
Created:	September 1, 2003	Updated:	September 3, 2003
Description:	Morgan alias SM6TKY discovered and fixed several security related problems in LinuxNode, an Amateur Packet Radio Node program. The buffer overflow he discovered can be used to gain unauthorised root access and can be remotely triggered.
Alerts:	Debian DSA-375-3 2003-08-29

Comments (none posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

pam_ldap: non-functioning host restrictions

Package(s):	pam_ldap	CVE #(s):
Created:	September 3, 2003	Updated:	September 3, 2003
Description:	pam_ldap 161 contains a bug in the pam_filter module which prevents host-based restrictions from working as advertised; version 1.62 fixes the problem.
Alerts:	Mandrake MDKSA-2003:088 2003-09-02

Comments (none posted)

pam-pgsql: format string vulnerability

Package(s):	pam-pgsql	CVE #(s):	CAN-2003-0672
Created:	August 11, 2003	Updated:	September 30, 2003
Description:	Florian Zumbiehl reported a vulnerability in pam-pgsql whereby the username to be used for authentication is used as a format string when writing a log message. This vulnerability may allow an attacker to execute arbitrary code with the privileges of the program requesting PAM authentication. CAN-2003-0672
Alerts:	Debian DSA-370-1 2003-08-08

Comments (none posted)

perl: cross site scripting vulnerability in CGI.pm module

Package(s):	perl	CVE #(s):	CAN-2003-0615
Created:	July 29, 2003	Updated:	September 30, 2003
Description:	obscure@eyeonsecurity.org reported a cross site scripting vulnerability in the CGI.pm perl module. This module is used to facilitate the creation of web forms and is part of the perl-modules RPM package. CAN-2003-0615
Alerts:	Red Hat RHSA-2003:256-02 2003-10-03 Red Hat RHSA-2003:256-01 2003-09-22 OpenPKG OpenPKG-SA-2003.039 2003-09-15 Mandrake MDKSA-2003:084 2003-08-20 Debian DSA-371-1 2003-08-11 OpenPKG OpenPKG-SA-2003.036 2003-08-06 Conectiva CLA-2003:713 2003-07-29

Comments (none posted)

PHP: vulnerability in mail function

Package(s):	php	CVE #(s):	CAN-2002-0985 CAN-2002-0986
Created:	November 13, 2002	Updated:	September 30, 2003
Description:	Two vulnerabilities exists in the mail() PHP function. The first one allows the execution of any program/script bypassing safe_mode restriction, the second one may give an open-relay script if the mail() function is not carefully used in PHP scripts. See this Bugtraq report for more details. Note that this is a different vulnerability than the previous PHP mail() problem, which affected versions through 4.1.0. CAN-2002-0985 CAN-2002-0986
Alerts:	SCO Group CSSA-2003-008.0 2003-03-04 Gentoo 200211-005 2002-11-20 EnGarde ESA-20021122-031 2002-11-22 Conectiva CLA-2002:545 2002-11-13 Red Hat RHSA-2002:213-06 2002-11-11

Comments (none posted)

phpgroupware - cross-site scripting and other exploits

Package(s):	phpgroupware	CVE #(s):	CAN-2003-0504 CAN-2003-0582
Created:	July 16, 2003	Updated:	September 30, 2003
Description:	Several vulnerabilities were discovered in all versions of phpgroupware prior to 0.9.14.006. This latest version fixes an exploitable condition in all versions that can be exploited remotely without authentication and can lead to arbitrary code execution on the web server. This vulnerability is being actively exploited. Version 0.9.14.005 fixed several other vulnerabilities including cross-site scripting issues that can be exploited to obtain sensitive information such as authentication cookies. See this Security Corportation report for more information. CAN-2003-0504 CAN-2003-0582
Alerts:	Debian DSA-365-1 2003-08-05 Conectiva CLA-2003:703 2003-07-23 Mandrake MDKSA-2003:077 2003-07-23 Conectiva CLA-2003:697 2003-07-16

Comments (none posted)

phpwebsite: SQL Injection, DoS and XSS Vulnerabilities

Package(s):	phpwebsite	CVE #(s):
Created:	September 2, 2003	Updated:	September 3, 2003
Description:	phpwebsite contains an sql injection vulnerability in the calendar module which allows the attacker to execute sql queries. In addition phpwebsite is also vulnerable to XSS. More information can be found in the full advisory.
Alerts:	Gentoo 200309-03 2003-09-02

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PostgreSQL - more buffer overflows

Package(s):	postgresql	CVE #(s):
Created:	February 12, 2003	Updated:	November 7, 2003
Description:	A new set of buffer overflows has been discovered in PostgreSQL 7.2.2; they affect the circle_poly(), path_encode(), and path_addr() functions. Exploiting these overflows requires that the attacker first obtain a connection to the PostgreSQL server.
Alerts:	Debian DSA-397-1 2003-11-07 Immunix IMNX-2003-7+-005-01 2003-04-08 Trustix 2003-0004 2003-02-20 Mandrake MDKSA-2002:062-1 2003-02-11

Comments (1 posted)

Local arbitrary code execution vulnerability in Python

Package(s):	python	CVE #(s):	CAN-2002-1119
Created:	August 28, 2002	Updated:	September 30, 2003
Description:	Zack Weinberg discovered that os._execvpe from os.py uses a predictable name which could lead to execution of arbitrary code. According to the Debian advisory, the problem was present in Python versions 1.5, 2.1 and 2.2. CAN-2002-1119
Alerts:	Red Hat RHSA-2002:202-33 2003-02-12 OpenPKG OpenPKG-SA-2003.006 2003-01-23 Red Hat RHSA-2002:202-25 2003-01-21 Mandrake MDKSA-2002:082-1 2002-12-09 Mandrake MDKSA-2002:082 2002-11-25 SCO Group CSSA-2002-045.0 2002-11-14 Trustix 2002-0073 2002-10-17 Gentoo python-20021003 2002-10-03 Conectiva CLA-2002:527 2002-10-01 Debian DSA-159-2 2002-09-09 Debian DSA-159-1 2002-08-28

Comments (none posted)

Multiple-use vulnerability in Safe.pm

Package(s):	Safe.pm	CVE #(s):	CAN-2002-1323
Created:	October 9, 2002	Updated:	February 20, 2004
Description:	usePerl has a description of a vulnerability in the Safe.pm Perl module. It seems that if a Safe compartment is used more than once, it ceases to be safe. The problem is fixed in Safe 2.08.
Alerts:	SCO Group CSSA-2004-007.0 2004-02-20 Gentoo 200212-6 2002-12-20 Trustix 2002-0087 2002-12-19 OpenPKG OpenPKG-SA-2002.014 2002-12-16 Debian DSA-208-1 2002-12-12

Comments (none posted)

semi: insecure temporary file

Package(s):	semi, wemi	CVE #(s):	CAN-2003-0440
Created:	July 7, 2003	Updated:	September 30, 2003
Description:	semi, a MIME library for GNU Emacs, does not take appropriate security precautions when creating temporary files. This bug could potentially be exploited to overwrite arbitrary files with the privileges of the user running Emacs and semi, potentially with contents supplied by the attacker. wemi is a fork of semi, and contains the same bug. CAN-2003-0440
Alerts:	Gentoo 200308-02 2003-08-14 Yellow Dog YDU-20030723-2 2003-07-23 Red Hat RHSA-2003:234-01 2003-07-23 Debian DSA-339-1 2003-07-06

Comments (none posted)

sendmail: bad DNS reply causes crash

Package(s):	sendmail	CVE #(s):	CAN-2003-0688
Created:	August 26, 2003	Updated:	September 30, 2003
Description:	There is a potential problem in sendmail 8.12.8 and earlier sendmail 8.12.x versions with respect to DNS maps. The bug did not exist in versions before 8.12 as the DNS map type is new to 8.12. The bug was fixed in 8.12.9, released March 29, 2003. See this advisory for more information. CAN-2003-0688
Alerts:	Conectiva CLA-2003:727 2003-08-29 Red Hat RHSA-2003:265-01 2003-08-28 OpenPKG OpenPKG-SA-2003.037 2003-08-28 SuSE SuSE-SA:2003:035 2003-08-26 Mandrake MDKSA-2003:086 2003-08-26

Comments (none posted)

stunnel: signal handler reentrancy DoS

Package(s):	stunnel	CVE #(s):	CAN-2002-1563
Created:	July 25, 2003	Updated:	November 25, 2003
Description:	Stunnel is a wrapper for network connections. It can be used to tunnel an unencrypted network connection over a secure connection (encrypted using SSL or TLS) or to provide a secure means of connecting to services that do not natively support encryption. When configured to listen for incoming connections (instead of being invoked by xinetd), stunnel can be configured to either start a thread or a child process to handle each new connection. If Stunnel is configured to start a new child process to handle each connection, it will receive a SIGCHLD signal when that child exits. Stunnel versions prior to 4.04 would perform tasks in the SIGCHLD signal handler which, if interrupted by another SIGCHLD signal, could be unsafe. This could lead to a denial of service.
Alerts:	< Red Hat RHSA-2003:296-01 2003-11-24 SCO Group CSSA-2003-026.0 2003-10-03 Conectiva CLA-2003:736 2003-09-05 Trustix 2003-0030 2003-08-07 EnGarde ESA-20030806-020 2003-08-06 Red Hat RHSA-2003:221-01 2003-07-25