1 |
|
GNATS 4.1.1/4.0.2, August 2005 |
2 |
|
=============================== |
3 |
|
Versions 4.1.1 and 4.0.2 are patch releases addressing a few small |
4 |
|
fixes. Since GNATS 4.0.0, there has been trouble trying to build the |
5 |
|
software on Solaris machines. This has now been fixed. |
6 |
|
|
7 |
|
A Common Vulnerabilities and Exposures candidate [CAN-2005-2180] was |
8 |
|
reported for a local security exploit over the misuse of setuid |
9 |
|
binaries for manipulating local databases. The Makefiles have been |
10 |
|
altered to discontinue using the setuid bit. |
11 |
|
|
12 |
|
The suggested manner in which to use a local database is to use an |
13 |
|
unprivileged user in combination with sudo, or to create a dedicated |
14 |
|
filesystem group to which you add your "responsible" team members. |
15 |
|
Alternatively, you could operate exclusively through the network |
16 |
|
interface. |
17 |
|
|
18 |
|
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2180 |
19 |
|
|
20 |
|
|
21 |
GNATS 4.0.1, November 2004 |
GNATS 4.0.1, November 2004 |
22 |
========================== |
========================== |
23 |
|
|