Bug 5002 - Mars-Nwe security vulnerability
Summary: Mars-Nwe security vulnerability
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: mars-nwe
Version: 6.0
Hardware: All
OS: Linux
high
medium
Target Milestone: ---
Assignee: David Lawrence
QA Contact:
URL: http://www.securityfocus.com/data/vul...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 1999-09-08 23:32 UTC by zurk
Modified: 2008-05-01 15:37 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed: 1999-09-14 17:40:29 UTC
Embargoed:

Attachments (Terms of Use)

Description zurk 1999-09-08 23:32:37 UTC 
I'm not too sure that redhat 6 is vulnerable to this but you
might want to check it out. mars-new package is/has a
boundary condition error..a local exploitable buffer
overflow. Its a root exploit. All versions upto and
including 0.99 (redhat 6?) are believed to be vulnerable to
this. Also wanted to report that anaconda (redhat 6.1's
installer) seems to crash and reboot the machine when it
cant detect the video card (i.e. it cant load the VGA_16
server). not sure where to put that one. Also you might want
to check or change the 6.1 mars-nwe too.
Comment 1 Bill Nottingham 1999-09-09 14:25:59 UTC 
Actually, the code that calls system (with the buffer
overflow) is never used.
Comment 2 Bill Nottingham 1999-09-14 17:40:59 UTC 
Fixed in the errata release.
Note You need to log in before you can comment on or make changes to this bug.