Shaun Colley discovered a buffer overflow in 'shar' that was triggered by output files (specified with -o) with names longer than 49 characters. This could be exploited to run arbitrary attacker specified code on systems that automatically process uploaded files with shar.

Ulf Harnhammar discovered that shar does not check the data length returned by the 'wc' command. However, it is believed that this cannot actually be exploited on real systems.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in the telnet client's handling of the LINEMODE suboptions. By sending a specially constructed reply containing a large number of SLC (Set Local Character) commands, a remote attacker (i. e. a malicious telnet server) could execute arbitrary commands with the privileges of the user running the telnet client. (CAN-2005-0469)

Michal Zalewski discovered a Denial of Service vulnerability in the telnet server (telnetd). A remote attacker could cause the telnetd process to free an invalid pointer, which caused the server process to crash, leading to a denial of service (inetd will disable the service if telnetd crashed repeatedly), or possibly the execution of arbitrary code with the privileges of the telnetd process (by default, the 'telnetd' user). Please note that the telnet server is not officially supported by Ubuntu, it is in the 'universe' component.
(CAN-2004-0911).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Javier Fernandez-Sanguino Pena noticed that cdrecord created temporary files in an insecure manner if DEBUG was enabled in /etc/cdrecord/rscsi. If the default value was used (which stored the debug output file in /tmp), this could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking cdrecord.

Please note that DEBUG is not enabled by default in Ubuntu, so if you did not explicitly enable it, this does not affect you.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several buffer overflows have been discovered in libxml2's FTP connection and DNS resolution functions. Supplying very long FTP URLs or IP addresses might result in execution of arbitrary code with the privileges of the process using libxml2.

Since libxml2 is used in packages like php4-imagick, the vulnerability also might lead to privilege escalation, like executing attacker supplied code with a web server's privileges.

However, this does not affect the core XML parsing code, which is what the majority of programs use this library for.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several integer overflow vulnerabilities were discovered in the PNG library. These vulnerabilities could be exploited by an attacker by providing a specially crafted PNG image which, when processed by the PNG library, could result in the execution of program code provided by the attacker.

The PNG library is used by a variety of software packages for different purposes, so the exact nature of the exposure will vary depending on the software involved.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Severity
20488	Ubuntu 4.10 : sharutils vulnerabilities (USN-102-1)	high
20487	Ubuntu 4.10 : netkit-telnet vulnerabilities (USN-101-1)	high
20486	Ubuntu 4.10 : cdrtools vulnerability (USN-100-1)	high
20485	Ubuntu 4.10 : XML library vulnerabilities (USN-10-1)	critical
20484	Ubuntu 4.10 : PNG library vulnerabilities (USN-1-1)	medium

Detections

Analytics

Ubuntu Local Security Checks Family for Nessus

high

high

high

critical

medium