Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam  Beyond Security  SecuriTeam Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	New xmcd packages released (Security patch) 26 Nov. 2000    Summary The xmcd package has historically installed two setuid helpers (in Debian, and other UNIX systems) for accessing cddb databases and SCSI cdrom drives. More recently, the package offered the administrator the chance to remove these setuid flags, but did so incorrectly.   Credit: The information has been provided by Debian security announce.    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable systems: Debian GNU/Linux 2.1 alias slink Debian GNU/Linux 2.2 (stable) alias potato A buffer overflow in ncurses, linked to the "cda" binary, allowed a root exploit. Fixed ncurses packages have been released, as well as fixed xmcd packages that do not install this binary with a setuid flag. The problem is fixed in xmcd 2.5pl1-7.1, and it is recommended that all users that have xmcd installed upgrade to this release. You may need to add users of xmcd to the "audio" and "cdrom" groups in order for them to continue using xmcd. Patch: Debian GNU/Linux 2.1 alias slink Slink is no longer being supported by the Debian Security Team. It is highly recommended to upgrade to the current stable release. Debian GNU/Linux 2.2 (stable) alias potatoFixes are currently available for the Alpha, ARM, Intel ia32, Motorola 680x0, PowerPC and Sun SPARC architectures, and will be included in 2.2r2. Source archives: http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.diff.gz http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.dsc http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1.orig.tar.gz Alpha architecture: http://security.debian.org/dists/potato/updates/main/binary-alpha/cddb_2.5pl1-7.1_alpha.deb http://security.debian.org/dists/potato/updates/main/binary-alpha/xmcd_2.5pl1-7.1_alpha.deb ARM architecture: http://security.debian.org/dists/potato/updates/main/binary-arm/cddb_2.5pl1-7.1_arm.deb http://security.debian.org/dists/potato/updates/main/binary-arm/xmcd_2.5pl1-7.1_arm.deb Intel ia32 architecture: http://security.debian.org/dists/potato/updates/main/binary-i386/cddb_2.5pl1-7.1_i386.deb http://security.debian.org/dists/potato/updates/main/binary-i386/xmcd_2.5pl1-7.1_i386.deb Motorola 680x0 architecture: http://security.debian.org/dists/potato/updates/main/binary-m68k/cddb_2.5pl1-7.1_m68k.deb http://security.debian.org/dists/potato/updates/main/binary-m68k/xmcd_2.5pl1-7.1_m68k.deb PowerPC architecture: http://security.debian.org/dists/potato/updates/main/binary-powerpc/cddb_2.5pl1-7.1_powerpc.deb http://security.debian.org/dists/potato/updates/main/binary-powerpc/xmcd_2.5pl1-7.1_powerpc.deb Sun Sparc architecture: http://security.debian.org/dists/potato/updates/main/binary-sparc/cddb_2.5pl1-7.1_sparc.deb http://security.debian.org/dists/potato/updates/main/binary-sparc/xmcd_2.5pl1-7.1_sparc.deb  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles PHP dba_replace() Arbitrary File Destruction VLC Media Player RealText Processing Stack Overflow Vulnerability LibSPF2 DNS TXT Record Parsing Bug GNU Enscript "setfilename" Special Escape Buffer Overflow File-Find-Object Format String Vulnerability Veritas Storage Foundation Arbitrary File Read Vulnerability Sun Solstice AdminSuite sadmind adm_build_path() Buffer Overflow Vulnerability Apache Tomcat Information Disclosure (RemoteFilterValve) Apple CUPS HP-GL/2 filter Code Execution Vulnerability WordPress MU wpmu-Blogs.php Crose Site Scrpting Vulnerability strongSwan IKEv2 Denial of Service Vulnerability Cross-Site Scripting Filter Evasion in Various Frameworks / Applications MySQL Charset Truncation Vulnerability Wordpress user_login Column SQL Truncation Vulnerability Joomla Weak Random Password Reset Token Vulnerability  Featured Articles Hacking SOHO Routers LibSPF2 DNS TXT Record Parsing Bug Vulnerability in Server Service Allows Code Execution (MS08-067) Opera Stored Cross Site Scripting Vulnerability GearSoftware Powered Products Local Privilege Escalation (IopfCompleteRequest) Vulnerabilities in Microsoft Excel Allows Code Execution (MS08-057) VMware Emulation Flaw x64 Guest Privilege Escalation
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®