OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: Mon Dec 16 2002 - 10:33:19 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200212-5
    - - --------------------------------------------------------------------

    PACKAGE : exim
    SUMMARY : local root vulnerability
    DATE    : 2002-12-16 16:12 UTC
    EXPLOIT : local

    - - --------------------------------------------------------------------

    - From advisory:

    "This is a format string bug in daemon.c, line 976:

    sprintf(CS buff, CS pid_file_path, ""); /* Backward compatibility */

    pid_file_path can be changed on the command line.
    This line is in the function daemon_go(), which only
    gets executed when the user is an exim-admin-user."

    Read the full advisory at
    http://marc.theaimsgroup.com/?l=bugtraq&m=103903403527788&w=2

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    net-mail/exim-4.05 and earlier update their systems as follows:

    emerge rsync
    emerge exim
    emerge clean

    - - --------------------------------------------------------------------
    alizgentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    rakergentoo.org
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.1 (GNU/Linux)

    iD8DBQE9/gBNfT7nyhUpoZMRAq43AKCfp65F8XNHS5Td8CE1qQiNqvrT9QCeJUTB
    6MYY1rust/c7RtKpA78PAv4=
    =IZpj
    -----END PGP SIGNATURE-----