Debian - The Community's Center for Security


The central voice for Linux and Open Source security news

Welcome!

Sign up!

EnGarde Community

Polls

How strictly do your users obey your security policies?

	To the letter.
	For the most part.
	When it suits them.
	By chance.
	Not at all.

Advisories

Community

Linux Events

Linux User Groups

Link to Us

Security Center

Book Reviews

Security Dictionary

Security Tips

SELinux

White Papers

Featured Blogs

Emily Ratliff: OS Security

DanWalsh LiveJournal

Security Bloggers Network

Latest Newsletters

Linux Advisory Watch: November 21st, 2008

Linux Security Week: November 17th, 2008

LinuxSecurity Newsletters

RSS Feeds

Get the LinuxSecurity news you want faster with RSS

Debian

Find the information you need for your favorite open source distribution

To browse through our weekly Linux Advisory Watch newsletters, click here.

Debian 2.1: majordomo vulnerability

03 June 2000

Posted by LinuxSecurity.com Team
Any local user can trick majordomo into executing arbitrary code or to create or write files as the majordomo user anywhere on the filesystem.

Debian Security Advisory: mtr

09 March 2000

Posted by LinuxSecurity.com Team
The version of mtr as distributed in Debian GNU/Linux 2l1 (aka slink) did not drop root privileges correctly. While there are no known exploits it is conceivable that a weakness in gtk or ncurses could be used to exploit this.

Debian 2.1: nmh remote exploit

28 February 2000

Posted by LinuxSecurity.com Team
nmh did not check incoming mail messages properly. This could be exploited byusing carefully designed MIME headers to trick mhshow into executing arbitrary shell code. [Found on LWN]

Debian 2.1: race condition present in make

21 February 2000

Posted by LinuxSecurity.com Team
The make package as shipped in Debian GNU/Linux 2.1 is vulnerable to arace condition that can be exploited with a symlink attack. make usedmktemp while creating temporary files in /tmp. and that is a knownpotential security hole, as documented in the man page of mktemp.

apcd: symlink attack in apcd

01 February 2000

Posted by LinuxSecurity.com Team
The apcd package as shipped in Debian GNU/Linux 2.1 is vulnerable to a symlink attack. If the apcd process gets a SIGUSR1 signal it will dump its status to /tmp/upsstat. However this file is not opened safely, which makes it a good target for a symlink attack. This has been fixed in version 0.6a.nr-4slink1. We recommend you upgrade your apcd package immediately.

Deb: Root compromise in ftpwatch

12 January 2000

Posted by LinuxSecurity.com Team
This vulnerability exists in all distributed versions of the ftpwatch package. We recommend that you remove ftpwatch package until a corrected version is released.