Slightly off-topic, but I imagine a lot of RT admins get their
mail with fetchmail, a lot from external sources, and some RT
admins might have untrusted mysql users . . . so, as seen on
Vulnwatch (.org) Friday and Saturday, discovered by e-matters
(http://security.e-matters.de):
bug in fetchmail, permitting execution of arbitrary code as
user running fetchmail, exploitable with just a malicious
mail, corrected in fetchmail 6.2.0 released Dec 13 2002
bugs in MySQL, permitting root acces to databases, execution
of arbitrary code as mysqld, malicious server executing code
on clients, denial of service . . . corrected in MySQL 3.23.54
released 12 December 2002.
No exploits released.
Time for an upgrade, people . . .
I’m not certain, but I don’t think Debian and RedHat packages have
been updated yet. Maybe by the time you read this!
#include <std_disclaim.h> Lorens Kockum