Skip to Content.
Sympa Menu

sm-spell-submit - [SM-Spell-Submit]Bug in mm

sm-spell-submit AT lists.ibiblio.org

Subject: Submit list for new spells

List archive

Chronological Thread  
  • From: "Eric Sandall" <sandalle AT hellhound.homeip.net>
  • To: "Source Mage Grimoire " <sm-grimoire AT lists.ibiblio.org>, "Source Mage Spell Submit " <sm-spell-submit AT lists.ibiblio.org>
  • Subject: [SM-Spell-Submit]Bug in mm
  • Date: Tue, 30 Jul 2002 10:41:59 -0700 (PDT)

I have submitted this bug into bugzilla, but thought everyone else would
like to know as well.

Package : mm
Vulnerability : insecure temporary files
Problem-Type : local
Debian-specific: no
CVE Id : CAN-2002-0658

Marcus Meissner and Sebastian Krahmer discovered and fixed a temporary
file vulnerability in the mm shared memory library. This problem can
be exploited to gain root access to a machine running Apache which is
linked against this library, if shell access to the user ``www-data''
is already available (which could easily be triggered through PHP).

The latest version is 1.2.1 (compiles fine on my machine using gcc3).
The SOURCE directory has changed to:
SOURCE_URL[0]=ftp://ftp.ossp.org/pkg/lib/mm/$SOURCE

-One of Three

--
Eric Sandall | Source Mage GNU/Linux Developer
sandalle AT hellhound.homeip.net | http://www.sourcemage.org
http://hellhound.homeip.net/~sandalle | SystAdmin @ Inst. Shock Physics @ WSU
ICQ: 667348 | http://www.shock.wsu.edu/






Archive powered by MHonArc 2.6.24.

Top of Page