Package : libgtop Problem type : remote nobody exploit Debian-specific: no
Two different problems where found in libgtop-daemon:
* The laboratory intexxia found a format string problem in the logging code from libgtop_daemon. There were two logging functions which are called when authorizing a client which could be exploited by a remote user.
* Flavio Veloso found a buffer overflow in the function that authorizes clients
Since libgtop_daemon runs as user nobody both bugs could be used to gain access as the nobody user to a system running libgtop_daemon.
Both problems have been fixed in version 1.0.6-1.1 and we recommend you upgrade your libgtop-daemon package immediately.
wget url will fetch the file for you dpkg -i file.deb will install the referenced file.
Debian GNU/Linux 2.2 alias potato ---------------------------------
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.