LWN.net Weekly Edition for April 1, 2004

A look at GNOME 2.6

With the GNOME 2.6 release pushed back a week due to GNOME Web Server intrusion, we decided to take an early look at 2.6 with the 2.5.92 test release. For this preview, GNOME 2.5.92 was built using GARNOME on a system running SUSE Linux 9. The GARNOME GNOME distribution is based on the GAR Architecture; it allows a user to build bleeding-edge software without impacting their current system setup, and without having to check releases out of CVS. This is very handy when using a single system for software testing and everyday work that requires a stable desktop.

GARNOME took the better part of an afternoon to build the GNOME 2.5.92 desktop and basic GNOME components on a machine with an Athlon XP 2600+ CPU and 1 GB of RAM. The basic desktop build consumed a little more than 300 MB of space.

The first thing that most users will notice about GNOME 2.6 is that it seems much faster than previous releases, particularly at startup. The Nautilus shell is also much faster than previous releases, but the default behavior has changed for the worse. When navigating through a directory structure using Nautilus, the default is now for Nautilus to open a new window each time the user opens a directory. Needless to say, this behavior rapidly results in a cluttered desktop. It is possible to override this behavior by using the "--browser" option, but it would be preferable for the default behavior to be the least annoying.

Epiphany 1.2 is speedy, and quite streamlined. Perhaps a little too streamlined, in fact. Epiphany's limited feature set may be less confusing for new users who would be overwhelmed by Mozilla's vast array of options. However, users who have become accustomed to Mozilla may find that Epiphany's minimal features are a bit constrictive. The absence of site-specific pop-up blocking could be a problem for some users who have used Mozilla and Firefox's pop-up blocking features. Epiphany also requires that the user close each browser window individually rather than offering the user the ability to exit all browsers. This may save a user from accidentally closing all of their browser windows when they wish to close only one, but it also requires quite a bit of clicking when a user wishes to exit multiple browser windows.

A smaller annoyance is that Epiphany 1.2 does not allow the user to scroll through recently visited sites via the location toolbar. It's unclear what advantage there is to removing such a simple and commonplace feature. The user is able to select from similar URLs after clicking on the location bar and typing a few letters of the URL, but there is no button to allow the user to simply click and highlight a recently visited URL that remains in the location bar history.

A short while ago I tested the Evolution 1.5 release included in the first Fedora Core 2 test release. GNOME 2.6 includes Evolution 1.5.5, which seems far more stable than it was back in February. They are still including a dialog that warns users that 1.5.5 is test software and recommends that the user download 1.4 if they wish to use a stable branch of Evolution. Evolution 1.5 has a few new features, and loses a few as well. The most notable new feature in 1.5 is junk mail filtering. Notably absent is Evolution's "Summary" panel.

GNOME 2.6 also includes the GTK+ 2.4.0 release. This release introduces a new file browser dialog that, in this writer's opinion, is a vast improvement over the "standard" file dialog. When the user navigates into a directory tree, the file browser creates navigation buttons for each directory. For example, if a user navigates into "local/mozilla/chrome" under their home directory, the dialog will create buttons for "local," "mozilla," and "chrome," in addition to the ever-present "Home" button in the dialog. When the user navigates upward in the directory tree, the sub-directories will still be represented as long as they are in the same hierarchy. This allows the user to navigate through the directory structure much more quickly.

Another application included in GARNOME, though not part of the default desktop build, is Totem movie player based on Xine. It's a nice little media player that plays a wide variety of media, including CDs, VCDs and DVDs (providing libdvdcss is installed for encrypted movies), MPEG video, Ogg files and MP3s. Having used Ogle a great deal in the past, this writer is far happier with Totem for DVD playback. It should also be noted that this author spent more than an adequate amount of time testing Gnometris 2.5.9, and can verify that it is fully ready for deployment.

There are, of course, far too many useful applications in the GNOME arsenal to mention here or to test in a reasonable amount of time. It should suffice to say that GNOME/GARNOME 2.5.92 includes a wide array of useful applications for desktop use, including Gnumeric, the Conglomerate XML editor, gLabels (a handy label-making program), Sodipodi, and many others.

For the most part, the 2.5.92 release is ready for widespread use. There were a few glitches here and there, but it's likely they will be ironed out by the final 2.6 release. One also wishes that it were possible to change certain GNOME settings without having to resort to using the GConf editor. One is unpleasantly reminded of the Windows Registry when tinkering with GConf.

Aside from small glitches and minor annoyances, GNOME 2.5.92 was extremely stable and pleasant to use. Pleasant enough, in fact, to cause this writer to seriously consider switching from XFce to GNOME on a permanent basis. Though one may not agree with all of the interface decisions made by GNOME's developers, it is obvious that the GNOME developers have been working hard to make GNOME a useful and user-friendly desktop environment.

Comments (18 posted)

The Aberdeen Group looks at free databases

The Aberdeen Group has put together an "analyst report" on free databases, as typified by MySQL, PostgreSQL, and Berkeley DB. The report is available for download, in PDF format, from the SleepyCat site, but one must get through a moderately obnoxious registration screen first. For those who don't want to do that, here's a quick summary.

The report starts with a set of reasons why free databases are of interest; they include control over maintenance and support, source availability, cost, flexibility, and reliability. A quick summary of the three covered systems follows, with the "key features" which are supported or missing. The report summarizes the situation in this way:

The free database systems have reached "enterprise" levels of scalability and robustness, however.

The free database market, says Aberdeen, is currently worth about $100 million per year - compared to $10.5 billion for the proprietary variety. Free databases have mostly been making inroads at the low end of the market (the report doesn't say this, but that is how disruptive technologies usually get their start). Aberdeen mentions several times in particular that free databases on Linux are displacing SCO installations. The biggest area for free databases, however, is "new in-house applications." Displacing entrenched systems in other applications is currently too hard, but new applications typically do not have legacy issues to deal with. The best markets for free databases have been in retail and telecommunications.

As for the future:

The authors of the report talked with free database users, and found that those users are well pleased with the level of programming help and support available for the software. If you use a free database system, you can actually talk with the engineers who wrote it, which is not possible with large, proprietary systems. Thus, notes the report, if you're using a free database, you should expect to communicate with the development community, and not just with a vendor.

The talk of licensing is remarkably FUD-free:

The report concludes by saying that free database adoption will stay slow for the next couple of years before beginning to ramp up. The authors state the the lower-level programming tools offered with free database systems will slow down adoption somewhat. Over time, however, the advantages of free databases will lead to those systems having a "moderately bright" future.

Comments (13 posted)

Test releases - be careful out there

The announcement for the second Fedora Core 2 test release went out right on schedule. We hope to have a review of this release done in the near future. In the mean time, it's worth noting that the interest in this release appears to be relatively high, and that some testers are encountering significant difficulties with this release.

Some of the problems being encountered are not surprising to anybody. FC2t2 is the first test release which has SELinux enabled. The incorporation of SELinux into a multipurpose distribution like Fedora is simply guaranteed to generate a fair number of surprises. Working with SELinux in the test release is, in fact, likely to be relatively obnoxious; it is, after all, a fundamentally different security model. There will be a lot of glitches to shake out. Anybody who is even thinking about going near Fedora SELinux in the near future should have a good look at the FC2 SELinux FAQ first. Then read it a second time.

Adding SELinux is certain to be disruptive. Some users will no doubt be unhappy about the fact that they are, in some sense, helping Red Hat debug this feature so that it can be incorporated (with less pain) into the Enterprise Linux products. Bringing in SELinux is an important thing to do, however; we have to improve the security of our systems, and SELinux has the potential to help in the containment of compromises. The Fedora Project is doing us all a favor by blazing this particular trail.

The FC2t2 installation disk has also surprised a number of testers by refusing to boot on their systems. The workaround is fairly straightforward: boot from an earlier Fedora disk, then swap CDs at the boot prompt. But this failure, combined with some other difficulties, has led some potential testers to criticize Red Hat in a loud and public way. The claim is that insufficient quality control on Red Hat's part led to them wasting a bunch of time and bandwidth downloading a release that they cannot even install, much less test.

What may be happening here is that Fedora is bringing in some new users who are unaccustomed to testing bleeding-edge software. New participants in the development process are more than welcome, but they do need to realize that they are exactly that: participants in the development process. No product as complicated as a Linux distribution is going to reach a steady state without a great many testers giving it a try and shaking out the bugs; this is true even of distribution releases which do not include little novelties like the 2.6 kernel and SELinux. If you install (or attempt to install) a test release, you have to be prepared for surprises. When a surprise finds you, it's time to pick up the pieces and help the developers figure out what's going on. But it helps nobody if testers criticize those developers when the test release they have provided (for free) has problems.

Comments (4 posted)

A quick SCO update

There has been action in a couple of the SCO Group's legal cases, so it's time for an update.

IBM has amended its counterclaims in response to SCO's second amended complaint. One of the patent claims has been dropped, and quite a bit of strong language has been added. For example, paragraph 60:

Several paragraphs describing Novell's claims and actions, including the claims to have retained the Unix copyrights, have been added. Some new claim language states:

If IBM obtains such a judgment, SCO's case is essentially over; all that will be left is SCO's defense against IBM's counterclaims.

SCO, meanwhile, has filed a motion to bifurcate the IBM trial. SCO would like to split IBM's patent charges into a separate, trial with its own schedule. SCO's claims that the patent case is unrelated to the Linux-related charges are not entirely without merit; this motion might just be granted.

In the Novell case, SCO has been trying to get the trial moved back to Utah state court where, one assumes, it believes it will get a more favorable hearing. Novell has filed a memorandum in opposition of this motion (available in PDF format) that minces no words; from the opening paragraph:

Novell then dedicates several pages of legalese to the destruction of SCO's arguments. From an outside point of view, Novell's arguments look hard to answer.

In the Red Hat case: nothing has happened, as usual.

Finally, SCO has announced that SCO Forum 2004 will be held August 1 to 3 in Las Vegas. Even here, the company is rather economical with the truth: "SCO Forum 2004 will highlight the company's 25th anniversary in bringing powerful UNIX software solutions to businesses around the world." The SCO Group, originally Caldera, has been incorporated since 1998 (though Caldera, in a different form, had been around since the early 1990's). This company will not be celebrating its 25th anniversary anytime soon.

In any case, the event could be amusing; one can well imagine that, by August, the tone will not be particularly upbeat. Mark your calendars.

Comments (9 posted)

Page editor: Jonathan Corbet

Security

Utah's anti-spyware law

There oughta be a law, as they say, and now there is one in Utah. Yes, Utah is first state in the US to pass legislation banning certain kinds of spyware, the Spyware Control Act, and they took a heap of criticism from the likes of Microsoft and even cuddlier companies like Google, Novell and Amazon, who tried to block it from being passed, but failed. The governor just signed it last week.

Why? What is in this bill that such a broad coalition of companies took a look at it and didn't like what they saw? The best place to go to understand the new law is Ben Edelman's page, A Close Reading of Utah's Spyware Control Act (H.B.323). He has a clear chart showing in a creative way what the law says, with all its subclauses visually laid out. He consulted with the Utah legislators who prepared the bill, and his take on it is worth reading.

He was mightily surprised to see companies like Yahoo and AOL and Amazon and all the rest united against this bill. He concludes they have misunderstood the bill, and after researching it, I think that is indeed part of the problem. Novell's Vice President and Deputy General Counsel Ryan Richards wrote an Op Ed piece for the local paper about the bill in mid-March, "'Spyware' Bill Would Hurt Net Use", where he lays out the objections that he had to the bill and what he felt would be its unintended consequences. Here's a bit of what he wrote: ". . . the bill in its current form could potentially criminalize some of the most popular consumer software on the market, including popular media players, anti-virus programs, internet services, e-mail programs, and networking software."

After reading the bill itself, however, I believe he misunderstood the law, and I have concluded that the consequences are not unintended but rather precisely what the legislators meant to achieve. They intended that hidden spyware that transmits information about users without their consent, be outlawed. It's a bit like the definition of spam. "Legitimate" advertisers would like us to exempt their mailings from that definition. Now they want us to exempt them from the definition of spyware. The Utah legislators passed a bill that doesn't make that distinction. They are telling all companies to just quit it.

Because Ed Felton's analysis of the bill included the statement, "I have not seen specific examples of legitimate software that would be affected," I asked Novell's Bruce Lowry what products of theirs might be impacted by this bill, if any. He replied that while the bill is written in a vague enough way that he wasn't quite sure, one product might be ZENworks, used to configure machines and update software, including security patches, remotely. You can see a demonstration of ZENworks in a video on Novell's coverage of its recent Brainshare conference. I thought it looked like a wonderful product, but it does have to monitor computer usage to work and it sends reports back to a remote server, "both actions that would appear to make ZENworks 'spyware' under the terms of the legislation," Lowry worries. "The language doesn't distinguish between this type of high value, legitimate monitoring of computer activity from those actions that the legislation is ostensibly targeting - i.e. unsolicited advertising."

That would be an understandable worry, if he were correct that the law outlawed that product and others like it. But my reading of the statute convinces me that the bill only requires companies to let users know how products like ZENworks do what they do, get user consent, which presumably they already do, and make it possible to uninstall ZENworks, if users want to later. How burdensome is that? Further, Section 5 specifically excludes "software designed and installed solely to diagnose or resolve technical difficulties."

The strong reaction to this modest bill -- and you can read a PDF letter written by the companies and organizations that united to oppose it -- makes me heart-sinkingly sure that companies currently do quite a bit of monitoring and that the bill is designed to solve a runaway problem. Obviously, currently there is no law against spyware, except in Utah, although there is a bill being prepared on the federal level, and the FTC is holding hearings in April. Europe is considerably ahead of the US on privacy issues, maybe because Madison Avenue is an American phenomenon.

Might Mr. Richards be referring to that popular media player of the same name that the EU Commission just ordered Microsoft to unbundle, for example? Considering Microsoft Media Player's calling-home features, I'd say "probably." And while everyone has been talking about "benign" and "important and beneficial Internet communication software", that perennial favorite "stifling innovation", and the bill burdening users with notices, as if anybody cared about us anyhow, the truth is more likely to be elsewhere. Might it be that advertisers are worried about their income stream, and that at least some of the objecting parties - who are also entertainment purveyors - want to know exactly what everybody is up to with their music and DVDs and intend to spy to the extent they think they can get away with?

There is also a chilling statement in the letter listing reasons the signatories oppose the bill: "The bill also would create serious barriers to collection of data that Internet companies and security companies use to analyze and prevent hacker attacks on the Internet. This security problem is exacerbated by the fact that computer hackers, and other criminals could refuse to consent to use the software that law enforcement officials need to be able to conduct investigations." What are they saying? That instead of getting court orders to track criminals, which doesn't require their permission, law enforcement officials currently track everybody with commercial spyware? That's the kind of revelation, if that's what they meant, that gives privacy lovers hives.

So, what does the bill outlaw?

First, what it doesn't outlaw. It doesn't say they can't spy on us customers. They just have to tell us, in plain language, what they intend to do and get our consent, and make it possible for us to uninstall whatever we let them put on our computers, if we later change our minds. Before you say no one would ever give consent, think about Google's toolbar. A lot of folks trust Google, and they say yes when Google asks if they can track them. And no, Google's toolbar is not outlawed by this bill, because they comply with the notice and uninstall requirements already. Maybe that's why many trust them.

Excluded from the definition of spyware, are programs that diagnose or resolve technical problems, cookies, HTML code, and JavaScript used to report info stored on the user's computer, and operating systems. Plenty of wiggle room there. Anti-virus software and firewalls typically come with licenses that tell you what they do and thus get the necessary consent. The bill also outlaws intrusive ads that block the user's view of "legitimate" paid ads and website content. The liability for those who do it anyway is $10,000 per ad displayed, and that is tripled if the jury thinks they did it on purpose.

There is a catch. The victim can't bring a lawsuit. Only website owners, advertisers, and copyright and trademark owners (that elite bunch that legislators adore to write laws for) can sue. The rest of Utah's citizens must report violations to the Division of Consumer Protection, and the agency follows through, hopefully. The Utah legislators need to vote some funding if they are serious about stamping out spyware in Utah.

Ben Edelman tells me it wouldn't surprise him to see exactly that happen in coming years. "I think the bill reflects a good initial attempt to protect consumers and web sites from the many negative effects of spyware programs," he says, "and I think it offers a sensible and workable framework for doing so."

Comments (22 posted)

New vulnerabilities

courier - Remote buffer overflow vulnerabilities

Package(s):	Courier	CVE #(s):	CAN-2004-0224
Created:	March 29, 2004	Updated:	March 31, 2004
Description:	Remote buffer overflow vulnerabilities have been found in Courier-IMAP and Courier MTA. These exploits may allow the execution of arbitrary code, allowing unauthorized access to a vulnerable system.
Alerts:	Gentoo 200403-06 2004-03-26

Comments (2 posted)

emil: Buffer overflow and format string vulnerabilities

Package(s):	emil	CVE #(s):	CAN-2004-0152 CAN-2004-0153
Created:	March 25, 2004	Updated:	March 31, 2004
Description:	The emil mail filter utility has buffer overflow and format string vulnerabilities that can be exploited locally and remotely, It may be possible to craft an email that exploits the vulnerability and executes arbitrary code.
Alerts:	Debian DSA-468-1 2004-03-24

Comments (none posted)

ethereal - multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2004-0176 CAN-2004-0365 CAN-2004-0367
Created:	March 29, 2004	Updated:	June 2, 2004
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.3. More information can be found in this advisory from ethereal.com and in this Eye on Security advisory.
Alerts:	Debian DSA-511-1 2004-05-30 OpenPKG OpenPKG-SA-2004.015 2004-04-16 Red Hat RHSA-2004:137-01 2004-03-31 Mandrake MDKSA-2004:024 2004-03-30 Conectiva CLA-2004:835 2004-03-31 Red Hat RHSA-2004:136-01 2004-03-30 Netwosix NW-2004-0007 2004-03-29 Gentoo 200403-07 2004-03-28

Comments (none posted)

monit: buffer overflow and DOS

Package(s):	monit	CVE #(s):
Created:	March 31, 2004	Updated:	April 19, 2004
Description:	The monit system administration program through version 4.1 suffers from remotely exploitable buffer overflow and denial of service vulnerabilities. Two additional vulnerabilities have been found in the HTTP interface of monit, possibly leading to denial of service or execution of arbitrary code.
Alerts:	Gentoo 200404-16 2004-04-19 Netwosix NW-2004-0008 2004-04-06 Gentoo 200403-14 2004-03-31

Comments (none posted)

oftpd - denial of service

Package(s):	oftpd	CVE #(s):
Created:	March 29, 2004	Updated:	April 5, 2004
Description:	A remotely-exploitable overflow exists in versions of oftpd 0.3.6 and earlier, allowing an attacker to crash the oftpd daemon. Issuing a port command with a number higher than 255 causes the server to crash. The port command may be issued before any authentication takes place, meaning the attacker does not need to know a valid username and password in order to exploit this vulnerability.
Alerts:	Debian DSA-473-1 2004-04-03 Gentoo 200403-08 2004-03-29

Comments (1 posted)

openldap: denial of service

Package(s):	openldap	CVE #(s):
Created:	March 31, 2004	Updated:	March 31, 2004
Description:	Versions of the OpenLDAP server through 2.1.12 suffer from a remotely exploitable denial of service vulnerability; some more information can be found in the OpenLDAP bug tracker.
Alerts:	Gentoo 200403-12 2004-03-31

Comments (none posted)

pam-pgsql - missing input sanitizing

Package(s):	pam-pgsql	CVE #(s):	CAN-2004-0366
Created:	March 29, 2004	Updated:	March 31, 2004
Description:	Primoz Bratanic discovered a bug in libpam-psgl, a PAM module to authenticate using a PostgreSQL database. The library does not escape all user-supplied data that are sent to the database. An attacker could exploit this bug to insert SQL statements.
Alerts:	Debian DSA-469-1 2004-03-29

Comments (none posted)

squid - vulnerability in URL decoding

Package(s):	squid	CVE #(s):	CAN-2004-0189
Created:	March 29, 2004	Updated:	April 20, 2004
Description:	A bug was found in the processing of %-encoded characters in a URL in versions of Squid 2.5.STABLE4 and earlier. If a Squid configuration uses Access Control Lists (ACLs), a remote attacker could create URLs that would not be correctly tested against Squid's ACLs, potentially allowing clients to access prohibited URLs.
Alerts:	Whitebox WBSA-2004:133-01 2004-04-19 Fedora FEDORA-2004-104 2004-04-15 Red Hat RHSA-2004:133-01 2004-04-14 Conectiva CLA-2004:838 2004-04-12 Debian DSA-474-1 2004-04-03 OpenPKG OpenPKG-SA-2004.008 2004-04-01 Mandrake MDKSA-2004:025 2004-03-30 Gentoo 200403-11 2004-03-30 Red Hat RHSA-2004:134-01 2004-03-29

Comments (none posted)

tcpdump: ISAKMP payload handling denial-of-service vulnerabilities

Package(s):	tcpdump	CVE #(s):	CAN-2004-0183 CAN-2004-0184
Created:	March 30, 2004	Updated:	September 30, 2004
Description:	TCPDUMP v3.8.1 and earlier versions contain multiple flaws in the packet display functions for the ISAKMP protocol. Upon receiving specially crafted ISAKMP packets, TCPDUMP will try to read beyond the end of the packet capture buffer and crash. More information is available in this Rapid7 advisory.
Alerts:	Fedora-Legacy FLSA:1468 2004-09-29 Whitebox WBSA-2004:219-01 2004-06-10 Red Hat RHSA-2004:219-01 2004-05-26 Fedora FEDORA-2004-120 2004-05-13 Slackware SSA:2004-108-01 2004-04-17 Mandrake MDKSA-2004:030 2004-04-14 OpenPKG OpenPKG-SA-2004.010 2004-04-07 Debian DSA-478-1 2004-04-06 Trustix TSLSA-2004-0015 2004-03-30

Comments (none posted)

Updated vulnerabilities

apache2: Denial of Service vulnerability

Package(s):	apache2	CVE #(s):
Created:	September 29, 2003	Updated:	March 25, 2004
Description:	A problem was discovered in Apache2 where CGI scripts that write more than 4k to the standard error stream will hang the script's execution. This problem can lead to a denial of service situation. See this bug report for additional details.
Alerts:	Gentoo 200403-04 2004-03-22 Netwosix NW-2004-0006 2004-03-25 Mandrake MDKSA-2003:096-1 2003-10-24 Mandrake MDKSA-2003:096 2003-09-26

Comments (none posted)

ecartis: several vulnerabilities

Package(s):	ecartis	CVE #(s):	CAN-2003-0781 CAN-2003-0782
Created:	March 24, 2004	Updated:	March 24, 2004
Description:	The ecartis mailing list manager (version 1.0) suffers from an input validation vulnerability which can result in the disclosure of list passwords. Ecartis also has several buffer overflow vulnerabilities. See this advisory for more information.
Alerts:	Debian DSA-467-1 2004-03-23

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

fetchmail may crash on specially crafted message

Package(s):	fetchmail	CVE #(s):	CAN-2003-0792
Created:	October 16, 2003	Updated:	April 8, 2004
Description:	A bug was discovered in fetchmail 6.2.4 where a specially crafted email message can cause fetchmail to crash.
Alerts:	OpenPKG OpenPKG-SA-2004.012 2004-04-08 Gentoo 200403-10 2004-03-30 Netwosix NW-2004-0002 2004-02-20 SCO Group CSSA-2004-004.0 2004-02-19 Slackware SSA:2003-300-02 2003-10-22 Mandrake MDKSA-2003:101 2003-10-16

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

httpd - vulnerabilities fixed in Apache HTTP Server v2.0.49

Package(s):	httpd	CVE #(s):	CAN-2004-0174 CAN-2003-0020 CAN-2004-0113
Created:	March 23, 2004	Updated:	March 30, 2004
Description:	The Apache Software Foundation and the Apache HTTP Server Project have announced the release of version 2.0.49 of the Apache HTTP Server ("Apache"). More on the vulnerabilities fixed in this release can be found in this announcement.
Alerts:	Trustix TSLSA-2004-0017 2004-03-30

Comments (none posted)

iproute: local denial of service

Package(s):	iproute net-tools	CVE #(s):	CAN-2003-0856
Created:	November 25, 2003	Updated:	December 14, 2004
Description:	The iproute utility is susceptible to spoofed netlink messages sent by local users, with the result that denial of service attacks are possible.
Alerts:	Mandrake MDKSA-2004:148 2004-12-13 Fedora FEDORA-2004-154 2004-06-03 Fedora FEDORA-2004-115 2004-05-11 Debian DSA-492-1 2004-04-18 Gentoo 200404-10 2004-04-09 Red Hat RHSA-2003:316-01 2003-11-24

Comments (none posted)

kdelibs: cookie disclosure

Package(s):	kdelibs	CVE #(s):	CAN-2003-0592
Created:	March 10, 2004	Updated:	August 24, 2004
Description:	kdelibs (and, thus, Konqueror) has a vulnerability where a hostile server can force the disclosure of cookies that should not be presented to it. KDE versions 3.1.3 and later contain a fix.
Alerts:	Gentoo 200408-23 2004-08-24 Red Hat RHSA-2004:074-01 2004-03-10 Red Hat RHSA-2004:075-01 2004-03-10 Mandrake MDKSA-2004:022 2004-03-10 Debian DSA-459-1 2004-03-10

Comments (none posted)

kdepim: VCF file information reader vulnerability

Package(s):	kdepim	CVE #(s):	CAN-2003-0988
Created:	January 15, 2004	Updated:	May 26, 2004
Description:	KDE has issued a security advisory for all versions of kdepim as distributed with KDE versions 3.1.0 through 3.1.4 inclusive. A carefully crafted .VCF file potentially enables local attackers to compromise the privacy of a victim's data or execute arbitrary commands with the victim's privileges. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0988 to this issue.
Alerts:	Fedora FEDORA-2004-133 2004-05-19 Gentoo 200404-02 2004-04-06 Whitebox WBSA-2004:005-01 2004-02-12 Conectiva CLA-2004:810 2004-01-20 Slackware SSA:2004-014-01 2004-01-14 Mandrake MDKSA-2004:003 2004-01-14 Red Hat RHSA-2004:006-01 2004-01-07

Comments (none posted)

kernel: local root exploit in 2.4.22

Package(s):	kernel	CVE #(s):	CAN-2003-0961
Created:	December 1, 2003	Updated:	April 5, 2004
Description:	A vulnerability was discovered in the Linux kernel versions 2.4.22 and previous. A flaw in bounds checking in the do_brk() function can allow a local attacker to gain root privileges. This vulnerability is known to be exploitable. The 2.4.23 kernel contains the fix. For more details on how this vulnerability works, see this LWN article.
Alerts:	Debian DSA-475-1 2004-04-05 Debian DSA-470-1 2004-04-01 Debian DSA-442-1 2004-02-19 Debian DSA-433-1 2004-02-04 Debian DSA-423-1 2004-01-15 Red Hat RHSA-2003:368-01 2003-12-19 Conectiva CLA-2003:796 2003-12-05 Gentoo 200312-02 2003-12-04 SuSE SuSE-SA:2003:049 2003-12-04 Yellow Dog YDU-20031203-1 2003-12-03 Red Hat RHSA-2003:389-01 2003-12-01 Fedora FEDORA-2003-026 2003-12-02 Slackware SSA:2003-336-01 2003-12-01 Red Hat RHSA-2003:392-00 2003-12-01 Trustix 2003-0046 2003-12-01 Mandrake MDKSA-2003:110 2003-12-01 Debian DSA-403-1 2003-12-01

Comments (1 posted)

Linux kernel 2.2.10 failing function and TLB flush vulnerability

Package(s):	kernel-source-2.2.10	CVE #(s):	CAN-2004-0077
Created:	March 18, 2004	Updated:	June 4, 2004
Description:	A local root exploit is possible due to early flushing of the TLB.
Alerts:	Debian DSA-514-1 2004-06-04 Debian DSA-466-1 2004-03-18

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libpng, libpng3: buffer overflow

Package(s):	libpng, libpng3	CVE #(s):	CAN-2002-1363
Created:	December 19, 2002	Updated:	July 14, 2004
Description:	Glenn Randers-Pehrson discovered a problem in connection with 16-bit samples from libpng, an interface for reading and writing PNG (Portable Network Graphics) format files. The starting offsets for the loops are calculated incorrectly which causes a buffer overrun beyond the beginning of the row buffer.
Alerts:	Gentoo 200407-06 2004-07-08 OpenPKG OpenPKG-SA-2004.030 2004-07-06 Mandrake MDKSA-2004:063 2004-06-29 Whitebox WBSA-2004:249-01 2004-06-21 Fedora FEDORA-2004-176 2004-06-18 Fedora FEDORA-2004-174 2004-06-18 Fedora FEDORA-2004-175 2004-06-18 Fedora FEDORA-2004-173 2004-06-18 Red Hat RHSA-2004:249-01 2004-06-18 Conectiva CLA-2003:564 2003-01-23 Mandrake MDKSA-2003:008 2003-01-20 OpenPKG OpenPKG-SA-2003.001 2003-01-15 Yellow Dog YDU-20030114-2 2002-01-14 SuSE SuSE-SA:2003:0004 2003-01-14 Red Hat RHSA-2003:006-06 2003-01-09 Debian DSA-213-1 2002-12-19

Comments (none posted)

libxml2 - arbitrary code execution

Package(s):	libxml2	CVE #(s):	CAN-2004-0110
Created:	February 26, 2004	Updated:	July 21, 2004
Description:	Yuuichi Teranishi discovered a flaw in libxml2 versions prior to 2.6.6. When fetching a remote resource via FTP or HTTP, libxml2 uses special parsing routines. These routines can overflow a buffer if passed a very long URL. If an attacker is able to find an application using libxml2 that parses remote resources and allows them to influence the URL, then this flaw could be used to execute arbitrary code.
Alerts:	Fedora-Legacy FLSA:1324 2004-07-19 Conectiva CLA-2004:836 2004-03-31 Gentoo 200403-01 2004-03-06 Trustix TSLSA-2004-0010 2004-03-05 OpenPKG OpenPKG-SA-2004.003 2004-03-05 Netwosix NW-2004-0004 2004-03-04 Debian DSA-455-1 2004-03-03 Mandrake MDKSA-2004:018 2004-03-03 Red Hat RHSA-2004:091-02 2004-03-03 Whitebox WBSA-2004:090-01 2004-03-01 Red Hat RHSA-2004:090-01 2004-02-26 Fedora FEDORA-2004-087 2004-02-25 Red Hat RHSA-2004:091-01 2004-02-26

Comments (none posted)

mailman denial of service

Package(s):	mailman	CVE #(s):	CAN-2003-0991
Created:	February 9, 2004	Updated:	May 25, 2004
Description:	Matthew Galgoci of Red Hat discovered a Denial of Service (DoS) vulnerability in versions of Mailman prior to 2.1. An attacker could send a carefully-crafted message causing mailman to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0991 to this issue.
Alerts:	Conectiva CLA-2004:842 2004-05-25 Red Hat RHSA-2004:156-01 2004-04-14 Mandrake MDKSA-2004:013 2004-02-13 Red Hat RHSA-2004:019-01 2004-02-09

Comments (1 posted)

mc: arbitrary code execution

Package(s):	mc	CVE #(s):	CAN-2003-1023
Created:	January 16, 2004	Updated:	April 5, 2004
Description:	A vulnerability was discovered in Midnight Commander, a file manager, whereby a malicious archive (such as a .tar file) could cause arbitrary code to be executed if opened by Midnight Commander.
Alerts:	OpenPKG OpenPKG-SA-2004.009 2004-04-05 Gentoo 200403-09 2004-03-29 Conectiva CLA-2004:833 2004-03-31 SCO Group CSSA-2004-014.0 2004-03-25 Whitebox WBSA-2004:035-01 2004-02-12 Fedora FEDORA-2004-058 2004-02-09 Red Hat RHSA-2004:035-01 2004-01-19 Mandrake MDKSA-2004:007 2004-01-26 Red Hat RHSA-2004:034-01 2004-01-19 Debian DSA-424-1 2004-01-16

Comments (none posted)

metamail: integer and buffer overflows

Package(s):	metamail	CVE #(s):	CAN-2004-0104 CAN-2004-0105
Created:	February 18, 2004	Updated:	May 21, 2004
Description:	Versions of metamail through 2.7 contain a set of integer and buffer overflows which are remotely exploitable via a properly crafted message.
Alerts:	Gentoo 200405-17 2004-05-21 Debian DSA-449-1 2004-02-24 Mandrake MDKSA-2004:014 2004-02-18 Slackware SSA:2004-049-02 2004-02-18 Red Hat RHSA-2004:073-01 2004-02-18

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mod_python: denial of service vulnerability

Package(s):	mod_python	CVE #(s):	CAN-2003-0973
Created:	January 27, 2004	Updated:	October 4, 2004
Description:	Apache's mod_python module could crash the httpd process if a specific, malformed query string was sent. The Apache Foundation has reported that mod_python may be prone to Denial of Service attacks when handling a malformed query. Mod_python 2.7.9 was released to fix the vulnerability, however, because the vulnerability has not been fully fixed, version 2.7.10 has been released. Users of mod_python 3.0.4 are not affected by this vulnerability.
Alerts:	Fedora-Legacy FLSA:1325 2004-10-03 Conectiva CLA-2004:837 2004-04-12 Whitebox WBSA-2004:058-01 2004-03-01 Debian DSA-452-1 2004-02-29 Red Hat RHSA-2004:058-01 2004-02-26 Red Hat RHSA-2004:063-01 2004-02-26 Gentoo 200401-03 2004-01-27

Comments (none posted)

mozilla: multiple vulnerabilties

Package(s):	mozilla	CVE #(s):	CAN-2003-0594 CAN-2003-0564
Created:	March 10, 2004	Updated:	August 19, 2004
Description:	Mozilla 1.4 contains a few vulnerabilities, including disclosure of cookies to the wrong server, a scripting vulnerability which can allow an attacker to run arbitrary code, and an S/MIME vulnerability which can lead to remote denial of service or code execution attacks.
Alerts:	Whitebox WBSA-2004:421-01 2004-08-19 Whitebox WBSA-2004:110-01 2004-03-29 Red Hat RHSA-2004:112-01 2004-03-17 Mandrake MDKSA-2004:021 2004-03-10

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo 200503-34 2005-03-28 Debian DSA-411-1 2004-01-05

Comments (none posted)

mplayer: remotely exploitable buffer overflow vulnerability

Package(s):	mplayer	CVE #(s):	CAN-2003-0835
Created:	September 29, 2003	Updated:	April 6, 2004
Description:	A remotely exploitable buffer overflow vulnerability was found in MPlayer. A malicious host can craft a harmful ASX header, and trick MPlayer into executing arbitrary code upon parsing that header. Read the full advisory for details.
Alerts:	Mandrake MDKSA-2004:026 2004-04-05 Gentoo 200403-13 2004-03-31 Conectiva CLA-2003:760 2003-10-06 Mandrake MDKSA-2003:097 2003-09-30 Gentoo 200309-15 2003-09-27

Comments (none posted)

mutt: buffer overflow

Package(s):	mutt	CVE #(s):	CAN-2004-0078
Created:	February 11, 2004	Updated:	March 26, 2004
Description:	mutt suffers from a buffer overflow in its "index menu" code. This overflow can be exploited via a hostile message to crash mutt and, perhaps, execute arbitrary code. Version 1.4.2 fixes the problem; see this advisory for details.
Alerts:	SCO Group CSSA-2004-013.0 2004-03-25 OpenPKG OpenPKG-SA-2004.005 2004-03-09 Netwosix NW-2004-0001 2004-02-16 Trustix 2004-0006 2004-02-13 Whitebox WBSA-2004:050-01 2004-02-12 Mandrake MDKSA-2004:010 2004-02-11 Slackware SSA:2004-043-01 2004-02-12 Red Hat RHSA-2004:051-01 2004-02-11 Red Hat RHSA-2004:050-01 2004-02-11 Fedora FEDORA-2004-061 2004-02-11

Comments (none posted)

Nessus NASL scripting engine security issues

Package(s):	nessus	CVE #(s):
Created:	May 27, 2003	Updated:	August 12, 2004
Description:	Some some vulnerabilities exsist in the Nessus NASL scripting engine. To exploit these flaws, an attacker would need to have a valid Nessus account as well as the ability to upload arbitrary Nessus plugins in the Nessus server (this option is disabled by default) or he/she would need to trick a user somehow into running a specially crafted nasl script. Read the full advisory for additional information.
Alerts:	Gentoo 200305-10 2003-05-27

Comments (none posted)

netpbm: insecure temporary files

Package(s):	netpbm	CVE #(s):	CAN-2003-0924
Created:	January 19, 2004	Updated:	December 29, 2004
Description:	netpbm is graphics conversion toolkit made up of a large number of single-purpose programs. Many of these programs were found to create temporary files in an insecure manner, which could allow a local attacker to overwrite files with the privileges of the user invoking a vulnerable netpbm tool.
Alerts:	Conectiva CLA-2004:909 2004-12-29 Gentoo 200410-02 2004-10-04 Mandrake MDKSA-2004:011-1 2004-09-27 Whitebox WBSA-2004:031-01 2004-02-12 Mandrake MDKSA-2004:011 2004-02-11 Red Hat RHSA-2004:030-01 2004-02-05 Fedora FEDORA-2004-068 2004-02-06 Red Hat RHSA-2004:031-01 2004-01-22 Debian DSA-426-1 2004-01-18

Comments (1 posted)

openssh: timing attack leads to information disclosure

Package(s):	openssh	CVE #(s):	CAN-2003-0190
Created:	May 2, 2003	Updated:	November 30, 2004
Description:	From the advisory: "During a pen-test we stumbled across a nasty bug in OpenSSH-portable with PAM support enabled (via the --with-pam configure script switch). This bug allows a remote attacker to identify valid users on vulnerable systems, through a simple timing attack. The vulnerability is easy to exploit and may have high severity, if combined with poor password policies and other security problems that allow local privilege escalation."
Alerts:	Ubuntu USN-34-1 2004-11-30 OpenPKG OpenPKG-SA-2003.035 2003-08-06 Red Hat RHSA-2003:222-01 2003-07-29 Gentoo 200305-02 2003-05-13 Gentoo 200305-01 2002-03-05

Comments (1 posted)

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	Red Hat RHSA-2005:830-00 2005-11-02 Red Hat RHSA-2005:829-00 2005-11-02 Fedora FEDORA-2005-1042 2005-10-31 Fedora-Legacy FLSA:1395 2004-05-08 Conectiva CLA-2004:834 2004-03-31 Whitebox WBSA-2004:084-01 2004-03-23 Red Hat RHSA-2004:084-01 2004-03-23 Fedora FEDORA-2004-095 2004-03-19 Whitebox WBSA-2004:120-01 2004-03-22 Trustix TSLSA-2004-0012 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Red Hat RHSA-2004:121-01 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Gentoo 200403-03 2004-03-17 Debian DSA-465-1 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 EnGarde ESA-20040317-003 2004-03-17

Comments (1 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2003-0618
Created:	February 2, 2004	Updated:	April 21, 2004
Description:	Paul Szabo discovered a number of bugs in suidperl, a helper program to run perl scripts with setuid privileges. By exploiting these bugs, an attacker could abuse suidperl to discover information about files (such as testing for their existence and some of their permissions) that should not be accessible to unprivileged users.
Alerts:	Debian DSA-431-2 2004-04-16 Debian DSA-431-1 2004-02-01

Comments (none posted)

postfix: denial of service vulnerabilities

Package(s):	postfix	CVE #(s):	CAN-2003-0468 CAN-2003-0540
Created:	August 5, 2003	Updated:	May 27, 2004
Description:	The postfix MTA, versions through 1.1.12 (but not 2.0) is subject to two remotely exploitable denial of service vulnerabilities; see this advisory from Michal Zalewski for details.
Alerts:	Mandrake MDKA-2004:028 2004-05-26 Trustix 2003-0029 2003-08-04 Mandrake MDKSA-2003:081 2003-08-04 EnGarde ESA-20030804-019 2003-08-04 Conectiva CLA-2003:717 2003-08-04 SuSE SuSE-SA:2003:033 2003-08-04 Red Hat RHSA-2003:251-01 2003-08-04 Debian DSA-363-1 2003-08-03

Comments (none posted)

PWLib: possible Denial of Service

Package(s):	PWLib	CVE #(s):	CAN-2004-0097
Created:	February 13, 2004	Updated:	April 9, 2004
Description:	PWLib is a cross-platform class library designed to support the OpenH323 project. OpenH323 provides an implementation of the ITU H.323 teleconferencing protocol, used by packages such as Gnome Meeting. A test suite for the H.225 protocol (part of the H.323 family) provided by the NISCC uncovered bugs in PWLib prior to version 1.6.0. An attacker could trigger these bugs by sending carefully crafted messages to an application. The effects of such an attack can vary depending on the application, but would usually result in a Denial of Service. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0097 to this issue.
Alerts:	Gentoo 200404-11 2004-04-09 Mandrake MDKSA-2004:017 2004-03-03 Fedora FEDORA-2004-078 2004-03-02 Debian DSA-448-1 2004-02-22 Whitebox WBSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:047-01 2004-02-18 Red Hat RHSA-2004:048-01 2004-02-13

Comments (none posted)

python: buffer overflow

Package(s):	python	CVE #(s):	CAN-2004-0150
Created:	March 10, 2004	Updated:	October 11, 2004
Description:	Python (versions 2.2 and 2.2.1 only) has a buffer overflow in the getaddrinfo() function which can be exploited by a malformed IPv6 address.
Alerts:	Debian DSA-458-3 2004-10-10 Gentoo 200409-03 2004-09-02 Debian DSA-458-2 2004-08-31 Mandrake MDKSA-2004:019 2004-03-09 Debian DSA-458-1 2004-03-09

Comments (none posted)

samba privilege escalation

Package(s):	samba	CVE #(s):	CAN-2004-0186
Created:	March 15, 2004	Updated:	April 20, 2004
Description:	Samba, a LanManager-like file and printer server for Unix, was found to contain a vulnerability whereby a local user could use the "smbmnt" utility, which is setuid root, to mount a file share from a remote server which contained setuid programs under the control of the user. These programs could then be executed to gain privileges on the local system.
Alerts:	Mandrake MDKSA-2004:035 2004-04-19 Debian DSA-463-1 2004-03-12

Comments (none posted)

sysstat: temporary file vulnerability

Package(s):	sysstat	CVE #(s):	CAN-2004-0107 CAN-2004-0108
Created:	March 10, 2004	Updated:	October 4, 2004
Description:	The sysstat utility has a temporary file vulnerability which can be exploited by a local attacker to overwrite system files.
Alerts:	Fedora-Legacy FLSA:1372 2004-10-03 Gentoo 200404-04 2004-04-06 Debian DSA-460-2 2004-04-03 Trustix TSLSA-2004-0011 2004-03-16 Whitebox WBSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:053-01 2004-03-10 Red Hat RHSA-2004:093-01 2004-03-10 Debian DSA-460-1 2004-03-10

Comments (none posted)

File overwrite vulnerability in tar and unzip

Package(s):	tar unzip	CVE #(s):	CAN-2001-1267 CAN-2001-1268 CAN-2001-1269 CAN-2002-0399
Created:	October 1, 2002	Updated:	April 9, 2006
Description:	The tar utility does not properly filter file names containing "../", meaning that a hostile archive can, if unpacked by an unsuspecting user, overwrite any file that is writable by that user. GNU tar versions 1.13.19 and earlier are vulnerable; unzip through version 5.42 has the same vulnerability.
Alerts:	Fedora-Legacy FLSA:183571-1 2006-04-04 Red Hat RHSA-2006:0195-01 2006-02-21 Conectiva CLA-2002:538 2002-10-29 Mandrake MDKSA-2002:066 2002-10-10 Mandrake MDKSA-2002:065 2002-10-10 EnGarde ESA-20021003-022 2002-10-03 Gentoo unzip-20021001 2002-10-01 Gentoo tar-20021001 2002-10-01 Red Hat RHSA-2002:096-24 2002-09-18

Comments (1 posted)

tcpdump: flaws in the ISAKMP decoding routines

Package(s):	tcpdump	CVE #(s):	CAN-2003-0989 CAN-2004-0057 CAN-2004-0055
Created:	January 15, 2004	Updated:	April 6, 2004
Description:	George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump versions prior to 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue. Jonathan Heusser discovered two additional flaws in the ISAKMP decoding routines of tcpdump versions up to and including 3.8.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0057 to this issue. Jonathan Heusser discovered a flaw in the print_attr_string function in the RADIUS decoding routines for tcpdump 3.8.1 and earlier. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0055 to this issue. Remote attackers could potentially exploit these issues by sending carefully-crafted packets to a victim. If the victim uses tcpdump, these packets could result in a denial of service, or possibly execute arbitrary code as the 'pcap' user.
Alerts:	Gentoo 200404-03 2004-03-31 Fedora FEDORA-2004-091 2004-03-04 SCO Group CSSA-2004-008.0 2004-03-02 Fedora FEDORA-2004-092 2004-03-02 Whitebox WBSA-2004:008-01 2004-02-12 Fedora-Legacy FLSA:1222 2004-01-31 Mandrake MDKSA-2004:008 2004-01-26 EnGarde ESA-20040119-002 2004-01-19 Debian DSA-425-1 2004-01-16 OpenPKG OpenPKG-SA-2004.002 2004-01-16 Trustix 2004-0004 2004-01-05 SuSE SuSE-SA:2004:002 2004-01-14 Red Hat RHSA-2004:008-01 2004-01-15 Red Hat RHSA-2004:007-01 2004-01-14

Comments (none posted)

Multiple vendor telnetd vulnerability

Package(