The pseudo-random number generator in OpenSSL versions up to 0.9.6a has a design flaw. By knowing the output of specific PRNG requests, an attacker would be able to determine the PRNG's internal state and thus predict future PRNG output.

Jarno Juuskonen reported that a temporary file vulnerability exists in versions of Tripwire prior to 2.3.1-2. Because Tripwire opens/creates temporary files in /tmp without the O_EXCL flag during filesystem scanning and database updating, a malicious user could execute a symlink attack against the temporary files. This new version has all but one unsafe temporary file open fixed. It can still be used safely when using the new TEMPDIRECTORY configuration option, which is now set to /root/tmp.

Wolfram Kleff reported recently that the fetchmail program would segfault when receiving emails with a very large 'To:' header. This is due to a buffer overflow within the header parsing code, which can be exploited remotely.

Michal Zalewski has found a vulnerability in all versions of Samba prior to 2.0.10 where if a client sends an invalid netbios name Samba could be tricked into appending it's log to files writable by root.
This can be very dangerous if combined with a symlink created by a local user. Note that the log files must be specified as %m.log in order for this to work, and Mandrake Linux ships Samba by default using log.%m, thus it is not vulnerable 'out of the box'.

A vulnerability exists with the GTK+ toolkit in that the GTK_MODULES environment variable allows a local user to enter a directory path to a module that does not necessarily need to be associated with GTK+.
With this, an attacker could create a custom module and load it using the toolkit which could result in elevated privileges, the overwriting of system files, and the execution of malicious code.

Update :

The packages for 7.2 and Single Network Firewall 7.2 were not signed with our GnuPG key. Please note the changed MD5 values of the below packages.

Recently, Caldera found that when webmin starts a system daemon from the web frontend it does not clear its environment variables. Since these variables contain the authorization of the administrator, any daemon would also get these variables.

The ispell program uses mktemp() to open temporary files. This makes it vulnerable to symlink attacks. The program now has a patch from OpenBSD applied that uses mkstemp() instead, and switches gets() to fgets() for dealing with user input.

A number of remote buffer overflows were discovered in the tcpdump package that would allow a remote attack of the local tcpdump process.
Intrusion detection using tcpdump would no longer be useful due to the attack stoping all network activity on the system. As well, this new version of tcpdump fixes the vulnerability with decoding AFS ACL packets which would allow a remote attacker to run arbitrary code on the local system with root privilege.

A bug exists in xinetd as shipped with Mandrake Linux 8.0 dealing with TCP connections with the WAIT state that prevents linuxconf-web from working properly. As well, xinetd contains a security flaw in which it defaults to a umask of 0. This means that applications using the xinetd umask that do not set permissions themselves (like SWAT, a web configuration tool for Samba), will create world-writable files. This update sets the default umask to 022.

Update :

This update forces the TMPDIR to /tmp instead of obtaining it from the root user by default, which uses /root/tmp. As well, this version of xinetd also fixed a possible buffer overflow in the logging code that was reported by zen-parse on bugtraq, but was not mentioned in the previous advisory.

Several buffer overflow vulnerabilities have been found in the UW-IMAP package by the authors and independent groups. These vulnerabilities can be exploited only once a user has authenticated which limits the extent of the vulnerability to a remote shell with that user's permissions. On systems where the user already has a shell, nothing new will be provided to that user, unless the user has only local shell access. On systems where the email accounts do not provide shell access, however, the problem is much greater.

A format string vulnerability exists in gnupg 1.0.5 and previous versions which is fixed in 1.0.6. This vulnerability can be used to invoke shell commands with privileges of the currently logged-in user.

Update :

The /usr/bin/gpg executable was installed setuid root and setgid root.
While being setuid root offers locking pages in physical memory to avoid writing sensitive material to swap and is of benefit, being setgid root provides no benefits and allows users to write to files that have group root access. This update strips the setgid bit from /usr/bin/gpg.

Several format string vulnerabilities exist in the minicom program.
These bugs can be exploited to obtain group uucp privilege. A simple fix is to simply remove the setgid bit on /usr/bin/minicom, however these new packages introduce some fixes for the vulnerabilities through a patch from Red Hat, and also strip the setgid bit.

A recent security fix to cron introduced a new problem with giving up privileges before invoking the editor. A malicious local user could exploit this to gain root access.

The version of cups shipped with Linux-Mandrake 8.0 has a problem where when a user prints a multi-page PostScript file with embedded pictures, the pages following the first with the picture are all printed on the same page, one on top of the other. From multi-page Abiword files (only text) only the last page is printed. This update resolves this bug. As well, the upstream 1.1.7 release of cups fixes some security issues.

Versions of the Pine email client prior to 4.33 have various temporary file creation problems, as does the pico editor. These issues allow any user with local system access to cause any files owned by any other user, including root, to potentially be overwritten if the conditions were right.

Update :

The packages for 7.1 and Corporate Server did not properly update the menu entries. These updated packages update the menu entries.

A problem exists with the kdesu component of kdelibs. It created a world-readable temporary file to exchange authentication information and delete it shortly after. This can be abused by a local user to gain access to the X server and could result in a compromise of the account that kdesu would access.

Update :

Konqueror was unable to view manpages. This update corrects the problem and further corrections to sound are present for those cards that did not work properly with the previous update.

GnuPG version 1.0.5 has been released that fixes a few security problems, including a vulnerability that makes it easier for an attacker to recover your private key if they are able to steal your keyring.

A format string vulnerability exists in all versions of gftp prior to version 2.0.8. This vulnerability has been fixed upstream in version 2.0.8.

A temporary file vulnerability exists in rpmdrake. This updated rpmdrake corrects the problem.

A temporary file vulnerability exists in NEdit, the Nirvana Editor.
When printing the entire text or selected parts of the text within the editor, nedit creates a temporary file in an insecure manner. This could be exploited to gain access to other user privileges including root.

A vulnerability found by Marcus Meissner exists in Samba where it was not creating temporary files safely which could allow local users to overwrite files that they may not have access to. This happens when a remote user queried a printer queue and samba would create a temporary file in which the queue's data was written. Because Samba created the file insecurely and used a predictable filename, a local attacker could cause Samba to overwrite files that the attacker did not have access to. As well, the smbclient 'more' and 'mput' commands also created temporary files insecurely.

The vulnerability is present in Samba 2.0.7 and lower. 2.0.8 and 2.2.0 correct this behaviour.

Update :

The Samba 2.0.8 release did not entirely fix the temporary file issues in previous versions. The Samba team released 2.0.9 recently which does fix these problems completely. As well, the 8.0 packages will now not attempt to use /root/tmp as the temporary directory, but /var/tmp.

ID	Name	Severity
13880	Mandrake Linux Security Advisory : openssl (MDKSA-2001:065)	medium
13879	Mandrake Linux Security Advisory : tripwire (MDKSA-2001:064)	medium
13878	Mandrake Linux Security Advisory : fetchmail (MDKSA-2001:063)	high
13877	Mandrake Linux Security Advisory : samba (MDKSA-2001:062)	critical
13876	Mandrake Linux Security Advisory : gtk+ (MDKSA-2001:061-1)	high
13875	Mandrake Linux Security Advisory : webmin (MDKSA-2001:059)	high
13874	Mandrake Linux Security Advisory : ispell (MDKSA-2001:058)	low
13873	Mandrake Linux Security Advisory : tcpdump (MDKSA-2001:056)	high
13872	Mandrake Linux Security Advisory : xinetd (MDKSA-2001:055-1)	low
13871	Mandrake Linux Security Advisory : imap (MDKSA-2001:054)	medium
13870	Mandrake Linux Security Advisory : gnupg (MDKSA-2001:053-1)	high
13869	Mandrake Linux Security Advisory : minicom (MDKSA-2001:051)	high
13868	Mandrake Linux Security Advisory : vixie-cron (MDKSA-2001:050)	high
13867	Mandrake Linux Security Advisory : cups (MDKSA-2001:048)	high
13866	Mandrake Linux Security Advisory : pine (MDKSA-2001:047-1)	low
13865	Mandrake Linux Security Advisory : kdelibs (MDKSA-2001:046-3)	medium
13864	Mandrake Linux Security Advisory : gnupg (MDKSA-2001:045)	high
13863	Mandrake Linux Security Advisory : gftp (MDKSA-2001:044)	high
13862	Mandrake Linux Security Advisory : rpmdrake (MDKSA-2001:043)	high
13861	Mandrake Linux Security Advisory : nedit (MDKSA-2001:042)	high
13860	Mandrake Linux Security Advisory : samba (MDKSA-2001:040-1)	low

Detections

Analytics

Mandriva Local Security Checks Family for Nessus

medium

medium

high

critical

high

high

low

high

low

medium

high

high

high

high

low

medium

high

high

high

high

low