From: Secunia Security Advisories (sec-advsecunia.com)
Date: Mon Apr 28 2003 - 07:32:19 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TITLE:
Gentoo update for mgetty

READ ONLINE:
http://www.secunia.com/advisories/8674/

CRITICAL:
Highly critical

IMPACT:
System access, DoS

WHERE:
From remote

OPERATING SYSTEM:
Gentoo Linux 1.x

DESCRIPTION:
Gentoo has issued an update for mgetty. This fixes two
vulnerabilities, which can be exploited to compromise a vulnerable
system or escalate privileges.

Mgetty doesn't validate the user name supplied by the modem, when
calling external programs. This allows malicious users to overflow
the buffer and execute arbitrary code with root privileges.

Also, local users are able to circumvent the permissions in faxspool.
This allows local users to send faxes regardless of permissions.

SOLUTION:
Update Gentoo:

emerge sync
emerge mgetty
emerge clean

----------------------------------------------------------------------

Secunia recommends that you verify all advisories you receive, by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

Contact details:
Web : http://www.secunia.com/
E-mail : support@secunia.com
Tel : +44 (0) 20 7016 2693
Fax : +44 (0) 20 7637 0419

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories

----------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]