This week, advisories were released for xntp3, ntpd, vim, mailx, kernel, pine, netscape, and mc. The vendors include Conectiva, Caldera, Debian, EnGarde, Immunix, Mandrake, NetBSD, Progeny, Red Hat, Slackware, SuSE, and Trustix.
Many people have no problem sending sensitive data via e-mail.
Most of us do not know how easy it is for anybody to read it. It includes pointers to updated packages and descriptions of each vulnerability. Przemyslaw Frasunek published an exploit that demonstrates a buffer overflow vulnerability in that package. This vulnerability can be exploited remotely and is aggravated by the fact that the xntpd daemon runs as root. The ntp time synchronisation demon has a buffer overflow in its control request parsing which allows any remote attacker to gain root access, if the demon is running.