similar to: Old sendmail advisory

I guess I never sent the message I was going to last week about xterm. [Noteto REW: If I did, kill this message...] It seems that sending xterm an excessively long escape sequence kills it (and perchance might be made to hack it, which would be quite bad.) The xterm in XFree86-3.2 is immune to this problem. I recommend everyone upgrade ASAP. -- - David A. Holland | VINO

About a year ago I outlined a scheme for arranging chowning of the tty end of ptys without needing root privileges. Since then, I haven''t had time to actually implement it. I was thinking about the problem again today, and, having learned a bit about sessions and controlling ttys and stuff, was able to come up with a simpler mechanism. First, observe that the POSIX session mechanism, if

It seems that when you send rwhod an rwho packet, it blindly assumes you are who the packet says you are. That is to say, it looks as if any host can inject false rwho data for any other host. I''m not convinced this is worth fixing. Opinions? -- - David A. Holland | VINO project home page: dholland@eecs.harvard.edu | http://www.eecs.harvard.edu/vino

Some versions (the util-linux version, but not the netwrite or netkit versions) of /usr/bin/write have a buffer overrun problem that is almost certainly exploitable. Note that this gives access to the tty group, but not (directly) root. The fix is to change the two sprintfs to snprintfs. Patches have been mailed to the maintainer. -- - David A. Holland | VINO project home page:

x-kernel@vger.rutgers.edu Subject: Re: tty chowning Newsgroups: mail.linux.kernel In-Reply-To: <199709261901.PAA04763@dcl.MIT.EDU> Organization: Cc: Bcc: "Theodore Y. Ts''o" <tytso@MIT.EDU> writes: > David Holland <dholland@eecs.harvard.edu> writes: > } Why not build chowning into this process? On TIOCSCTTY, the tty would > } chown itself to the

Marek Michalkiewicz <marekm@I17LINUXB.ISTS.PWR.WROC.PL> wrote: : It seems that most of the RedHat 5.3.12 security patches are in the : standard 5.4.17, except for the patch below. Also, there are more : (different) fixes in 5.4.18 (check h_length against sizeof(sin_addr) : in inet/rcmd.c and inet/rexec.c). : + { : +

Hi. I don''t know if this one is known, but I can''t recall seeing anything about it. If it is old news I apologize. I discovered a bug in the inetd that comes with NetKit-B-0-08 and older. If a single SYN is sent to port 13 of the server, inetd will die of Broken Pipe: write(3, "Sun Jan 12 21:50:35 1997\r\n", 26) = -1 EPIPE (Broken pipe) --- SIGPIPE (Broken pipe) ---

[mod: Executive summary: SNI found recent linux-distributions not-vulnerable -- REW] -----BEGIN PGP SIGNED MESSAGE----- ###### ## ## ###### ## ### ## ## ###### ## # ## ## ## ## ### ## ###### . ## ## . ######.

[Mod: This message is a reason *why* linux-security is moderated list. This is also a reason why Rogier, myself, Alan Cox and others really do not want to have completely open lists that deal with security related aspects of running a system as way too many people just jump to conclusions and give suggestions without doing any reasearch on a subject. -- alex (co-moderator of

I am trying to get vino going on CentOS 7.1 I run this command: gsettings set org.gnome.Vino require-encryption false Then this one: gsettings list-recursively org.gnome.Vino org.gnome.Vino notify-on-connect true org.gnome.Vino alternative-port uint16 5900 org.gnome.Vino disable-background false org.gnome.Vino use-alternative-port false org.gnome.Vino icon-visibility 'client'

[Note: this has already been sent to comp.os.linux.announce.] -----BEGIN PGP SIGNED MESSAGE----- It has come to my attention that the recent 1.6 release of MAKEDEV-C inadvertently created /dev/random and /dev/urandom with the wrong permissions. /dev/random and /dev/urandom should look like this: crw-r--r-- 1 root system 1, 8 Feb 21 14:42 /dev/random crw-r--r-- 1 root system

-----BEGIN PGP SIGNED MESSAGE----- ============================================================================= CERT(sm) Advisory CA-96.20 Original issue date: September 18, 1996 Last revised: -- Topic: Sendmail Vulnerabilities - ----------------------------------------------------------------------------- *** This advisory supersedes CA-95:05 *** The CERT Coordination Center

Send CentOS-announce mailing list submissions to centos-announce at centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request at centos.org You can reach the person managing the list at centos-announce-owner at centos.org When

CentOS Errata and Security Advisory 2013:1452 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-1452.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: 6f9e41d0b9e7dc36736a76d4e13e637faade333740eb51478580177461b631f7 vino-2.13.5-10.el5_10.i386.rpm x86_64:

CentOS Errata and Security Advisory 2013:1452 Moderate Upstream details at : https://rhn.redhat.com/errata/RHSA-2013-1452.html The following updated files have been uploaded and are currently syncing to the mirrors: ( sha256sum Filename ) i386: ba60630e41e8c8341218d49294c94402ad59e251f1e4ef5b458aa2da7fc160cc vino-2.28.1-9.el6_4.i686.rpm x86_64:

On Sun, 2007-01-14 at 18:38 +0000, Jason_Meers wrote: > Christoph Maser wrote: > > >> > > Actually the default logins (text mode and gdm) both show the hostname. > > Don't tell me you leave logged in sessions. > > > > No not normally, only on a few specific machines on the LAN that are > only accessible from another machine on the LAN. > >

Send CentOS-announce mailing list submissions to centos-announce at centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request at centos.org You can reach the person managing the list at centos-announce-owner at centos.org When

Send CentOS-announce mailing list submissions to centos-announce at centos.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.centos.org/mailman/listinfo/centos-announce or, via email, send a message with subject or body 'help' to centos-announce-request at centos.org You can reach the person managing the list at centos-announce-owner at centos.org When

I''m looking for some evidence, backup up with dates and references, that shows that the Linux community responds to security problems more quickly than other OS vendors, and thus might be considered "more secure". A number of fairly high profile corporations are starting to look for such information as they consider Linux as an alternative solution to other UNIXes. Something

On 9/30/2020 7:23 PM, Jason Keltz wrote: > On 9/30/2020 4:11 PM, Remy Zandwijk via samba wrote: > >>> On 30 Sep 2020, at 21:42, Jason Keltz via samba >>> <samba at lists.samba.org> wrote: >>> >>> >>> On 9/30/2020 3:01 PM, Remy Zandwijk via samba wrote: >>>>>>> On the client, add: >>>>>>>