Re: su vulnerability

2000-10-09 Thread Daniel Jacobowitz
On Mon, Oct 09, 2000 at 05:16:20AM -0800, Ethan Benson wrote: > On Mon, Oct 09, 2000 at 03:04:35PM +0200, Javier Fernandez-Sanguino Peña > wrote: > > > > One thing I wonder is why does not Debian issue advisories to popular > > mailing > > lists (linux-security on securityportal and bugtrack

Re: su vulnerability

2000-10-09 Thread Daniel Jacobowitz
On Mon, Oct 09, 2000 at 05:16:20AM -0800, Ethan Benson wrote: > On Mon, Oct 09, 2000 at 03:04:35PM +0200, Javier Fernandez-Sanguino Peña wrote: > > > > One thing I wonder is why does not Debian issue advisories to popular mailing > > lists (linux-security on securityportal and bugtrack on sec

Re: su vulnerability

2000-10-09 Thread Cristian Ionescu-Idbohrn
On Mon, 9 Oct 2000, Ethan Benson wrote: [snip] > i am a bit curious about the recent traceroute bug, (traceroute -g 1 > -g 1 segfaults) pretty much every other major dist has released an > advisory and update for this, but debian appears not to have (unless i > missed it). a fixed traceroute pac

Re: su vulnerability

2000-10-09 Thread Ethan Benson
On Mon, Oct 09, 2000 at 03:04:35PM +0200, Javier Fernandez-Sanguino Peña wrote: > > One thing I wonder is why does not Debian issue advisories to popular > mailing > lists (linux-security on securityportal and bugtrack on securityfocus comes to they do post announcments to BugTraq, at leas

Re: su vulnerability

2000-10-09 Thread Javier Fernandez-Sanguino Peña
One thing I wonder is why does not Debian issue advisories to popular mailing lists (linux-security on securityportal and bugtrack on securityfocus comes to mind). Also, I do not see this posted at security.debian.org I am currently maintaining my status as Debian maintainer but s

Re: su vulnerability

2000-10-09 Thread Philippe BARNETCHE
Actually, debian WAS vulnerable to it. It's a glibc problem (format string problem). You can update it. http://security.debian.org apt-get upgrade glibc Le lun, 09 oct 2000, Robert Varga a écrit : > There is a su exploit discussed at SecurityPortal which is working on > RedHat 6.2 > (http://www

Re: su vulnerability

2000-10-09 Thread Cristian Ionescu-Idbohrn
On Mon, 9 Oct 2000, Ethan Benson wrote: [snip] > i am a bit curious about the recent traceroute bug, (traceroute -g 1 > -g 1 segfaults) pretty much every other major dist has released an > advisory and update for this, but debian appears not to have (unless i > missed it). a fixed traceroute pa

Re: su vulnerability

2000-10-09 Thread Ethan Benson
On Mon, Oct 09, 2000 at 03:04:35PM +0200, Javier Fernandez-Sanguino Peña wrote: > > One thing I wonder is why does not Debian issue advisories to popular mailing > lists (linux-security on securityportal and bugtrack on securityfocus comes to they do post announcments to BugTraq, at least

Re: su vulnerability

2000-10-09 Thread Javier Fernandez-Sanguino Peña
One thing I wonder is why does not Debian issue advisories to popular mailing lists (linux-security on securityportal and bugtrack on securityfocus comes to mind). Also, I do not see this posted at security.debian.org I am currently maintaining my status as Debian maintainer but s

Re: su vulnerability

2000-10-09 Thread Philippe BARNETCHE
Actually, debian WAS vulnerable to it. It's a glibc problem (format string problem). You can update it. http://security.debian.org apt-get upgrade glibc Le lun, 09 oct 2000, Robert Varga a écrit : > There is a su exploit discussed at SecurityPortal which is working on > RedHat 6.2 > (http://ww

su vulnerability

2000-10-09 Thread Robert Varga
There is a su exploit discussed at SecurityPortal which is working on RedHat 6.2 (http://www.securityportal.com/research/exploits/linux/20001003-linux-su.txt) Is debian vulnerable to it? And there is another regarding ssh. Regards, Robert Varga

su vulnerability

2000-10-09 Thread Robert Varga
There is a su exploit discussed at SecurityPortal which is working on RedHat 6.2 (http://www.securityportal.com/research/exploits/linux/20001003-linux-su.txt) Is debian vulnerable to it? And there is another regarding ssh. Regards, Robert Varga -- To UNSUBSCRIBE, email to [EMAIL PROTECTED