'Highly critical' security bugs listed for Linux products

NetworkWorld.com > Operating Systems > Linux: "Information about several vulnerabilities in Linux and Linux-based applications that are deemed to be "highly critical" were recently posted on the security Web site Secunia.com.

Debian was cited as a system with operating system vulnerabilities that could be exploited. Meanwhile, users running RealNetworks' open-source Helix browser, the open-source phpWebSite manager utility, as well as users with a network backup product from Arkeia, were warned of software flaws that could leave systems potentially open to attack.

On Debian, the vulnerability exists with bsmtpd, an SMTP mailer component of the Sendmail and Postfix e-mail server packages. Secunia.com warns that "unsanitised addresses can cause the execution of arbitrary commands during alleged mail delivery." This could lead to the possible hijacking of a user's system.

A bug was also recently reported in Arkeia's backup utility software for managing network backup jobs with Linux. The software flaw could cause a buffer overflow on a system running the Arkeia back-up client and allow attackers to run programs on the system. Exploit code for the vulnerability is available.

A software flaw that makes Linux PCs susceptible to malicious WAV files was reported in RealNetworks' open-source Helix media player, which runs on most Linux systems. The flaw could allow an attacker to create a special WAV file that causes a buffer overflow on the system, leaving it open for hackers to run code on the machine.

For the phpWebSite package (which provides a Web site content management system) a vulnerability in the code could leave the system open to unauthorized access and altering of a Web site running on the software. Attackers can use the software hole to upload Web scripts into the root directory of the phpWebSite system, as well as alter scripts on the site. "