An audit has been performed on the xinetd 2.3.0 source code by Solar Designer for many different possible vulnerabilities. The 2.3.1 release incorporated his patches into the xinetd source tree. The audit was very thorough and found and fixed many problems. This xinetd update includes his audit patch.

An input validation error exists in sendmail that may allow local users to write arbitrary data to process memory. This could possibly allow the execute of code or commands with elevated privileges and may also allow a local attacker to gain access to the root account.

A buffer overflow exists in the WindowMaker window manager's window title handling code, as discovered by Alban Hertroys. Many programs, such as web browsers, set the window title to something obtained from the network, such as the title of the currently-viewed web page. As such, this buffer overflow could be exploited remotely. WindowMaker versions above and including 0.65.1 are fixed upstream; these packages have been patched to correct the problem.

A buffer overflow exists in xli due to missing boundary checks. This could be triggered by an external attacker to execute commands on the victim's machine. An exploit is publically available. xli is an image viewer that is used by Netscape's plugger to display TIFF, PNG, and Sun-Raster images.

Update :

The xloadimage package uses the same code as xli and is likewise vulnerable. An update is provided for xloadimage which was only provided with Linux-Mandrake 7.2.

A vulnerability was found by Salvatore Sanfilippo in both the IMAP and POP3 code of fetchmail where the input is not verified and no bounds checking is done. This can be exploited by a remote attacker to write arbitrary data into memory. The attacker must have control of the mail server the client is connecting to via fetchmail in order to exploit this vulnerability.

A security hole was found in the earlier Linux 2.4 kernels dealing with iptables RELATED connection tracking. The iptables ip_conntrack_ftp module, which is used for stateful inspection of FTP traffic, does not validate parameters passed to it in an FTP PORT command. Due to this flaw, carefully constructed PORT commands could open arbitrary holes in the firewall. This hole has been fixed, as well as a number of other bugs for the 2.4 kernel shipped with Mandrake Linux 8.0

NOTE: This update is *not* meant to be done via MandrakeUpdate! You must download the necessary RPMs and upgrade manually by following these steps :

1. Type: rpm -ivh kernel-2.4.7-12.3mdk.i586.rpm 2. Type: mv kernel-2.4.7-12.3mdk.i586.rpm /tmp 3. Type: rpm -Fvh *.rpm 4. You may wish to edit /etc/lilo.conf to ensure a new entry is in place. The new kernel will be the last entry. Change any options you need to change.
5. Type: /sbin/lilo -v

You may then reboot and use the nwe kernel and remove the older kernel when you are comfortable using the upgraded one.

A buffer overrun exists in the XDMCP handling code used in gdm. By sending a properly crafted XDMCP message, it is possible for a remote attacker to execute arbitrary commands as root on the susceptible machine. By default, XDMCP is disabled in gdm.conf on Mandrake Linux.

CERT released an advisory that details a number of vulnerabilities as found in a variety of different LDAP implementations. The results of these tests showed one vulnerability in OpenLDAP with slapd not handling packets with certain invalid fields. A malicious attacker could craft such invalid packets, resulting in a denial of service attack on the affected server.

A buffer overflow exists in telnet which could provide root access to local users.

A buffer overflow exists in the elm email client when handling very long message-ids. This would overwrite other header fields and could potentially cause further damage.

The Squid proxy server has a serious security flaw in versions 2.3.STABLE2 through 2.3.STABLE4. This problem surfaces when Squid is used in httpd_accel mode. If you configure http_accel_with_proxy off then any request to Squid is allowed. Malicious users may use your proxy to portscan remote systems, forge email, and other activities.

The pseudo-random number generator in OpenSSL versions up to 0.9.6a has a design flaw. By knowing the output of specific PRNG requests, an attacker would be able to determine the PRNG's internal state and thus predict future PRNG output.

Jarno Juuskonen reported that a temporary file vulnerability exists in versions of Tripwire prior to 2.3.1-2. Because Tripwire opens/creates temporary files in /tmp without the O_EXCL flag during filesystem scanning and database updating, a malicious user could execute a symlink attack against the temporary files. This new version has all but one unsafe temporary file open fixed. It can still be used safely when using the new TEMPDIRECTORY configuration option, which is now set to /root/tmp.

Wolfram Kleff reported recently that the fetchmail program would segfault when receiving emails with a very large 'To:' header. This is due to a buffer overflow within the header parsing code, which can be exploited remotely.

Michal Zalewski has found a vulnerability in all versions of Samba prior to 2.0.10 where if a client sends an invalid netbios name Samba could be tricked into appending it's log to files writable by root.
This can be very dangerous if combined with a symlink created by a local user. Note that the log files must be specified as %m.log in order for this to work, and Mandrake Linux ships Samba by default using log.%m, thus it is not vulnerable 'out of the box'.

A vulnerability exists with the GTK+ toolkit in that the GTK_MODULES environment variable allows a local user to enter a directory path to a module that does not necessarily need to be associated with GTK+.
With this, an attacker could create a custom module and load it using the toolkit which could result in elevated privileges, the overwriting of system files, and the execution of malicious code.

Update :

The packages for 7.2 and Single Network Firewall 7.2 were not signed with our GnuPG key. Please note the changed MD5 values of the below packages.

Recently, Caldera found that when webmin starts a system daemon from the web frontend it does not clear its environment variables. Since these variables contain the authorization of the administrator, any daemon would also get these variables.

The ispell program uses mktemp() to open temporary files. This makes it vulnerable to symlink attacks. The program now has a patch from OpenBSD applied that uses mkstemp() instead, and switches gets() to fgets() for dealing with user input.

A number of remote buffer overflows were discovered in the tcpdump package that would allow a remote attack of the local tcpdump process.
Intrusion detection using tcpdump would no longer be useful due to the attack stoping all network activity on the system. As well, this new version of tcpdump fixes the vulnerability with decoding AFS ACL packets which would allow a remote attacker to run arbitrary code on the local system with root privilege.

A bug exists in xinetd as shipped with Mandrake Linux 8.0 dealing with TCP connections with the WAIT state that prevents linuxconf-web from working properly. As well, xinetd contains a security flaw in which it defaults to a umask of 0. This means that applications using the xinetd umask that do not set permissions themselves (like SWAT, a web configuration tool for Samba), will create world-writable files. This update sets the default umask to 022.

Update :

This update forces the TMPDIR to /tmp instead of obtaining it from the root user by default, which uses /root/tmp. As well, this version of xinetd also fixed a possible buffer overflow in the logging code that was reported by zen-parse on bugtraq, but was not mentioned in the previous advisory.

Several buffer overflow vulnerabilities have been found in the UW-IMAP package by the authors and independent groups. These vulnerabilities can be exploited only once a user has authenticated which limits the extent of the vulnerability to a remote shell with that user's permissions. On systems where the user already has a shell, nothing new will be provided to that user, unless the user has only local shell access. On systems where the email accounts do not provide shell access, however, the problem is much greater.

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user.

Update :

The /usr/bin/gpg executable was installed setuid root and setgid root.
While being setuid root offers locking pages in physical memory to avoid writing sensitive material to swap and is of benefit, being setgid root provides no benefits and allows users to write to files that have group root access. This update strips the setgid bit from /usr/bin/gpg.

Several format string vulnerabilities exist in the minicom program.
These bugs can be exploited to obtain group uucp privilege. A simple fix is to simply remove the setgid bit on /usr/bin/minicom, however these new packages introduce some fixes for the vulnerabilities through a patch from Red Hat, and also strip the setgid bit.

A recent security fix to cron introduced a new problem with giving up privileges before invoking the editor. A malicious local user could exploit this to gain root access.

The version of cups shipped with Linux-Mandrake 8.0 has a problem where when a user prints a multi-page PostScript file with embedded pictures, the pages following the first with the picture are all printed on the same page, one on top of the other. From multi-page Abiword files (only text) only the last page is printed. This update resolves this bug. As well, the upstream 1.1.7 release of cups fixes some security issues.

Versions of the Pine email client prior to 4.33 have various temporary file creation problems, as does the pico editor. These issues allow any user with local system access to cause any files owned by any other user, including root, to potentially be overwritten if the conditions were right.

Update :

The packages for 7.1 and Corporate Server did not properly update the menu entries. These updated packages update the menu entries.

A problem exists with the kdesu component of kdelibs. It created a world-readable temporary file to exchange authentication information and delete it shortly after. This can be abused by a local user to gain access to the X server and could result in a compromise of the account that kdesu would access.

Update :

Konqueror was unable to view manpages. This update corrects the problem and further corrections to sound are present for those cards that did not work properly with the previous update.

GnuPG version 1.0.5 has been released that fixes a few security problems, including a vulnerability that makes it easier for an attacker to recover your private key if they are able to steal your keyring.

A format string vulnerability exists in all versions of gftp prior to version 2.0.8. This vulnerability has been fixed upstream in version 2.0.8.

A temporary file vulnerability exists in rpmdrake. This updated rpmdrake corrects the problem.

A temporary file vulnerability exists in NEdit, the Nirvana Editor.
When printing the entire text or selected parts of the text within the editor, nedit creates a temporary file in an insecure manner. This could be exploited to gain access to other user privileges including root.

A vulnerability found by Marcus Meissner exists in Samba where it was not creating temporary files safely which could allow local users to overwrite files that they may not have access to. This happens when a remote user queried a printer queue and samba would create a temporary file in which the queue's data was written. Because Samba created the file insecurely and used a predictable filename, a local attacker could cause Samba to overwrite files that the attacker did not have access to. As well, the smbclient 'more' and 'mput' commands also created temporary files insecurely.

The vulnerability is present in Samba 2.0.7 and lower. 2.0.8 and 2.2.0 correct this behaviour.

Update :

The Samba 2.0.8 release did not entirely fix the temporary file issues in previous versions. The Samba team released 2.0.9 recently which does fix these problems completely. As well, the 8.0 packages will now not attempt to use /root/tmp as the temporary directory, but /var/tmp.

ID	Name	Severity
13891	Mandrake Linux Security Advisory : xinetd (MDKSA-2001:076)	high
13890	Mandrake Linux Security Advisory : sendmail (MDKSA-2001:075)	medium
13889	Mandrake Linux Security Advisory : WindowMaker (MDKSA-2001:074)	critical
13888	Mandrake Linux Security Advisory : xloadimage (MDKSA-2001:073-1)	high
13887	Mandrake Linux Security Advisory : fetchmail (MDKSA-2001:072)	critical
13886	Mandrake Linux Security Advisory : kernel (MDKSA-2001:071)	high
13885	Mandrake Linux Security Advisory : gdm (MDKSA-2001:070)	critical
13884	Mandrake Linux Security Advisory : openldap (MDKSA-2001:069)	medium
13883	Mandrake Linux Security Advisory : telnet (MDKSA-2001:068)	critical
13882	Mandrake Linux Security Advisory : elm (MDKSA-2001:067)	high
13881	Mandrake Linux Security Advisory : squid (MDKSA-2001:066)	high
13880	Mandrake Linux Security Advisory : openssl (MDKSA-2001:065)	medium
13879	Mandrake Linux Security Advisory : tripwire (MDKSA-2001:064)	medium
13878	Mandrake Linux Security Advisory : fetchmail (MDKSA-2001:063)	high
13877	Mandrake Linux Security Advisory : samba (MDKSA-2001:062)	critical
13876	Mandrake Linux Security Advisory : gtk+ (MDKSA-2001:061-1)	high
13875	Mandrake Linux Security Advisory : webmin (MDKSA-2001:059)	high
13874	Mandrake Linux Security Advisory : ispell (MDKSA-2001:058)	low
13873	Mandrake Linux Security Advisory : tcpdump (MDKSA-2001:056)	high
13872	Mandrake Linux Security Advisory : xinetd (MDKSA-2001:055-1)	low
13871	Mandrake Linux Security Advisory : imap (MDKSA-2001:054)	medium
13870	Mandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)	high
13869	Mandrake Linux Security Advisory : minicom (MDKSA-2001:051)	high
13868	Mandrake Linux Security Advisory : vixie-cron (MDKSA-2001:050)	high
13867	Mandrake Linux Security Advisory : cups (MDKSA-2001:048)	high
13866	Mandrake Linux Security Advisory : pine (MDKSA-2001:047-1)	low
13865	Mandrake Linux Security Advisory : kdelibs (MDKSA-2001:046-3)	medium
13864	Mandrake Linux Security Advisory : gnupg (MDKSA-2001:045)	high
13863	Mandrake Linux Security Advisory : gftp (MDKSA-2001:044)	high
13862	Mandrake Linux Security Advisory : rpmdrake (MDKSA-2001:043)	high
13861	Mandrake Linux Security Advisory : nedit (MDKSA-2001:042)	high
13860	Mandrake Linux Security Advisory : samba (MDKSA-2001:040-1)	low

Detections

Analytics

Mandriva Local Security Checks Family for Nessus

high

medium

critical

high

critical

high

critical

medium

critical

high

high

medium

medium

high

critical

high

high

low

high

low

medium

high

high

high

high

low

medium

high

high

high

high

low