From 91b5385125438b8da321f34ea2707f569c15ce2a Mon Sep 17 00:00:00 2001 From: nectar Date: Wed, 7 Apr 2004 17:13:05 +0000 Subject: make tidy --- security/vuxml/vuln.xml | 179 +++++++++++++++++++++++------------------------- 1 file changed, 85 insertions(+), 94 deletions(-) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 97fefe07cf91..6d63eb8c2176 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -43,9 +43,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

The kernel interface for creating a snapshot of a filesystem is the same as that for changing the flags on - that filesystem. Due to an oversight, the mksnap_ffs(8) + that filesystem. Due to an oversight, the mksnap_ffs(8) command called that interface with only the snapshot flag set, causing all other flags to be reset to the default value.

@@ -90,9 +88,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -

A programming error in the shmat(2) system call can result +

A programming error in the shmat(2) system call can result in a shared memory segment's reference count being erroneously incremented.

It may be possible to cause a shared memory segment to @@ -125,9 +121,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -

A programming error has been found in the jail_attach(2) +

A programming error has been found in the jail_attach(2) system call which affects the way that system call verifies the privilege level of the calling process. Instead of failing immediately if the calling process was already @@ -237,9 +231,88 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + + Several remotely exploitable buffer overflows in gaim + + + gaim + 0.75_3 + 0.75_5 + 0.76 + + + + +

Stefan Esser of e-matters found almost a dozen remotely + exploitable vulnerabilities in Gaim. From the e-matters + advisory:

+
While developing a custom add-on, an integer overflow + in the handling of AIM DirectIM packets was revealed that + could lead to a remote compromise of the IM client. After + disclosing this bug to the vendor, they had to make a + hurried release because of a change in the Yahoo connection + procedure that rendered GAIM useless. Unfourtunately at the + same time a closer look onto the sourcecode revealed 11 more + vulnerabilities.
+ +
The 12 identified problems range from simple standard + stack overflows, over heap overflows to an integer overflow + that can be abused to cause a heap overflow. Due to the + nature of instant messaging many of these bugs require + man-in-the-middle attacks between client and server. But the + underlying protocols are easy to implement and MIM attacks + on ordinary TCP sessions is a fairly simple task.
+ +
In combination with the latest kernel vulnerabilities or + the habit of users to work as root/administrator these bugs + can result in remote root compromises.
+

+ + + + http://security.e-matters.de/advisories/012004.txt + CAN-2004-0005 + CAN-2004-0006 + CAN-2004-0007 + CAN-2004-0008 + + + 2004-01-26 + 2004-02-12 + 2004-04-07 + + + + + oftpd denial-of-service vulnerability (PORT command) + + + oftpd + 0.3.7 + + + + +

Philippe Oechslin reported a denial-of-service vulnerability + in oftpd. The oftpd server can be crashed by sending a PORT + command containing an integer over 8 bits long (over 255).

+ + + + http://www.time-travellers.org/oftpd/oftpd-dos.html + 9980 + CAN-2004-0376 + + + 2004-03-04 + 2004-03-28 + 2004-04-05 + + + - Midnight Commander buffer overflow during symlink - resolution + Midnight Commander buffer overflow during symlink resolution mc @@ -577,9 +650,7 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

From the FreeBSD Security Advisory:

A programming error in the handling of some IPv6 socket - options within the setsockopt(2) system call may result + options within the setsockopt(2) system call may result in memory locations being accessed without proper validation.

It may be possible for a local attacker to read portions @@ -629,33 +700,6 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - - oftpd denial-of-service vulnerability (PORT command) - - - oftpd - 0.3.7 - - - - -
Philippe Oechslin reported a denial-of-service vulnerability - in oftpd. The oftpd server can be crashed by sending a PORT - command containing an integer over 8 bits long (over 255).
- - - - http://www.time-travellers.org/oftpd/oftpd-dos.html - 9980 - CAN-2004-0376 - - - 2004-03-04 - 2004-03-28 - 2004-04-05 - - - multiple vulnerabilities in ethereal @@ -1965,59 +2009,6 @@ misc.c: - - Several remotely exploitable buffer overflows in gaim - - - gaim - 0.75_3 - 0.75_5 - 0.76 - - - - -
Stefan Esser of e-matters found almost a dozen remotely - exploitable vulnerabilities in Gaim. From the e-matters - advisory:
-
-
While developing a custom add-on, an integer overflow - in the handling of AIM DirectIM packets was revealed that - could lead to a remote compromise of the IM client. After - disclosing this bug to the vendor, they had to make a - hurried release because of a change in the Yahoo connection - procedure that rendered GAIM useless. Unfourtunately at the - same time a closer look onto the sourcecode revealed 11 more - vulnerabilities.
- -
The 12 identified problems range from simple standard - stack overflows, over heap overflows to an integer overflow - that can be abused to cause a heap overflow. Due to the - nature of instant messaging many of these bugs require - man-in-the-middle attacks between client and server. But the - underlying protocols are easy to implement and MIM attacks - on ordinary TCP sessions is a fairly simple task.
- -
In combination with the latest kernel vulnerabilities or - the habit of users to work as root/administrator these bugs - can result in remote root compromises.
-
- - - - http://security.e-matters.de/advisories/012004.txt - CAN-2004-0005 - CAN-2004-0006 - CAN-2004-0007 - CAN-2004-0008 - - - 2004-01-26 - 2004-02-12 - 2004-04-07 - - - Samba 3.0.x password initialization bug -- cgit