[security] Security Advisories

[Lorenzo Iannuzzi]

http://www.debian.org/security/

Georgi Guninski discovered two stack-based buffer overflows.  They can
not be exploited with the default configuration from the Debian
system, though.  The Common Vulnerabilities and Exposures project
identifies the following problems that are fixed with this update:

CAN-2004-0399

    When "sender_verify = true" is configured in exim.conf a buffer
    overflow can happen during verification of the sender.  This
    problem is fixed in exim 4.

CAN-2004-0400

    When headers_check_syntax is configured in exim.conf a buffer
    overflow can happen during the header check.  This problem does
    also exist in exim 4.

http://www.suse.com

    A configuration error on the Live CD allows for a passwordless, remote 
    root login to the system via ssh, if the computer has booted from the 
    Live CD and if it is connected to a network. Since the CD-ROM is a 
    read-only medium by definition, there is no solution for this error 
    that would be persistent over a reboot from the Live CD. Manually 
    killing all running instances of the secure shell daemon ("killall 
    sshd" as root) after each boot cures the problem, while still exposing 
    the vulnerability in the time window between startup and the killing 
    of the sshd process.
-- 

Ciao e alla prossima!
Lorenzo