Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

More on LinuxToday


Mandrake Linux Advisories: gaim, hylafax

Aug 29, 2002, 21:48 (0 Talkback[s])

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           gaim
Advisory ID:            MDKSA-2002:054
Date:                   August 1st, 2002
Affected versions:      7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1
______________________________________________________________________

Problem Description:

 Versions of Gaim (an AOL instant message client) prior to 0.58 contain a
 buffer overflow in the Jabber plug-in module.  As well, a vulnerability
 was discovered in the URL-handling code, where the "manual" browser
 command passes an untrusted string to the shell without reliable
 quoting or escaping.  This allows an attacker to execute arbitrary
 commands on the user's machine with the user's permissions.  Those
 using the built-in browser commands are not vulnerable.
______________________________________________________________________

References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0384
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0989
  http://gaim.sourceforge.net/ChangeLog
______________________________________________________________________

Updated Packages:

 Linux-Mandrake 7.1:
 cc3f1b72c0b0a046c2d6e271ac4ef9a8  7.1/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  7.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Linux-Mandrake 7.2:
 9fcfb20bdd27480122c97acd5b1db53a  7.2/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  7.2/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.0:
 095f6c8aadaf06732dc8398e8217fb3c  8.0/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  8.0/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.0/ppc:
 d078adbe132c822880c1e50043ba7edd  ppc/8.0/RPMS/gaim-0.59.1-1.1mdk.ppc.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  ppc/8.0/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.1:
 095f6c8aadaf06732dc8398e8217fb3c  8.1/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  8.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.1/ia64:
 5c1d08e501dc2f889bf7ddcd27b551d2  ia64/8.1/RPMS/gaim-0.59.1-1.1mdk.ia64.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  ia64/8.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.2:
 b18399b33a517de8af524c326e9b539b  8.2/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  8.2/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Mandrake Linux 8.2/ppc:
 0110ef0414286614261da0aa9749751f  ppc/8.2/RPMS/gaim-0.59.1-1.1mdk.ppc.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  ppc/8.2/SRPMS/gaim-0.59.1-1.1mdk.src.rpm

 Corporate Server 1.0.1:
 cc3f1b72c0b0a046c2d6e271ac4ef9a8  1.0.1/RPMS/gaim-0.59.1-1.1mdk.i586.rpm
 d72cf5a2ccfa4d130b036aeac5fd88f4  1.0.1/SRPMS/gaim-0.59.1-1.1mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one 
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig <filename>

All packages are signed by MandrakeSoft for security.  You can obtain
the GPG public key of the Mandrake Linux Security Team from:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to 
update.

You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

  http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security@linux-mandrake.com>
______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           hylafax
Advisory ID:            MDKSA-2002:055
Date:                   August 28th, 2002
Affected versions:      7.1, 7.2, 8.0, 8.1, 8.2, Corporate Server 1.0.1
______________________________________________________________________

Problem Description:

 Numerous vulnerabilities in the HylaFAX product exist in versions prior
 to 4.1.3.  It does not check the TSI string which is received from
 remote FAX systems before using it in logging and other places.  A
 remote sender using a specially formatted TSI string can cause the
 faxgetty program to segfault, resulting in a denial of service.  Format
 string vulnerabilities were also discovered by Christer Oberg, which 
 exist in a number of utilities bundled with HylaFax, such as faxrm, 
 faxalter, faxstat, sendfax, sendpage, and faxwatch.  If any of these
 tools are setuid, they could be used to elevate system privileges.
 Mandrake Linux does not, by default, install these tools setuid.
 Finally, Lee Howard discovered that faxgetty would segfault due to a
 buffer overflow after receiving a very large line of image data.  This
 vulnerability could conceivably be used to execute arbitrary commands
 on the system as root, and could also be exploited more easily as a
 denial of sevice.
______________________________________________________________________

References:

  http://www.securityfocus.com/archive/1/215984
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1034
  http://www.securityfocus.com/bid/3357
______________________________________________________________________

Updated Packages:

 Linux-Mandrake 7.1:
 1bbb83c824d07e017a36c2c85b92c3b7  7.1/RPMS/hylafax-4.1-0.11mdk.i586.rpm
 3f4e469a6c57529fe02025ea7b4bef45  7.1/RPMS/hylafax-client-4.1-0.11mdk.i586.rpm
 9b0952a5701bc2ffaa6068b4b0901ede  7.1/RPMS/hylafax-server-4.1-0.11mdk.i586.rpm
 c44d130f10049d79f7a60601b9844b6e  7.1/SRPMS/hylafax-4.1-0.11mdk.src.rpm

 Linux-Mandrake 7.2:
 37c7c3efa774714204c22e6bde81f432  7.2/RPMS/hylafax-4.1-0.11mdk.i586.rpm
 37cb7b798ffaf93aba0782b4fb760a39  7.2/RPMS/hylafax-client-4.1-0.11mdk.i586.rpm
 b28df42826dc9a833c7f19ad92dacbec  7.2/RPMS/hylafax-server-4.1-0.11mdk.i586.rpm
 c44d130f10049d79f7a60601b9844b6e  7.2/SRPMS/hylafax-4.1-0.11mdk.src.rpm

 Mandrake Linux 8.0:
 a3676fb894765134d5669f914e39f10c  8.0/RPMS/hylafax-4.1.3-1.1mdk.i586.rpm
 27c72f3ad72e85abc4c527fa44d625e9  8.0/RPMS/hylafax-client-4.1.3-1.1mdk.i586.rpm
 b1effc6accf5c808694ee312abf08140  8.0/RPMS/hylafax-server-4.1.3-1.1mdk.i586.rpm
 070d143881cf21632484fcd65fad1aa0  8.0/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
 a4f1487efa5cc026103d80c96dd41a43  8.0/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  8.0/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Mandrake Linux 8.0/ppc:
 e51efc370f2bb4af971457edd5dda1e9  ppc/8.0/RPMS/hylafax-4.1.3-1.1mdk.ppc.rpm
 3b15cb44ed18c353c154e7d97fecc4ba  ppc/8.0/RPMS/hylafax-client-4.1.3-1.1mdk.ppc.rpm
 73af1b321e30ed8d7740c1e8a0b60a67  ppc/8.0/RPMS/hylafax-server-4.1.3-1.1mdk.ppc.rpm
 6225da0393fd8f80c2dfebd85df5998e  ppc/8.0/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.ppc.rpm
 eac3efd3d7c5184312bd4aa793a8a8e7  ppc/8.0/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.ppc.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  ppc/8.0/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Mandrake Linux 8.1:
 1947a6895cdfe3c4bda4fc100b3c1276  8.1/RPMS/hylafax-4.1.3-1.1mdk.i586.rpm
 13fcd879330de0cb58bc8c8c99595291  8.1/RPMS/hylafax-client-4.1.3-1.1mdk.i586.rpm
 2450c7ec306a4e5c9e6a73d8d09bafc6  8.1/RPMS/hylafax-server-4.1.3-1.1mdk.i586.rpm
 862d14c12e65ee9f82451ad911bc8df7  8.1/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
 f5b5c5a4b3137277793adf385ffba962  8.1/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  8.1/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Mandrake Linux 8.1/ia64:
 07a96e577b97485a6d723743196ad248  ia64/8.1/RPMS/hylafax-4.1.3-1.1mdk.ia64.rpm
 1d2ee7c691e72978ea49c0eec3c945b4  ia64/8.1/RPMS/hylafax-client-4.1.3-1.1mdk.ia64.rpm
 248d6879e45952ae2c9494e91297b0b6  ia64/8.1/RPMS/hylafax-server-4.1.3-1.1mdk.ia64.rpm
 3f48d8f2283917f3b451dcaf9deb3edf  ia64/8.1/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.ia64.rpm
 16dee4b27fc1fc63ccd377e1340d371c  ia64/8.1/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.ia64.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  ia64/8.1/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Mandrake Linux 8.2:
 e3c962f212ba5faf2bbbf9bbe97ac39b  8.2/RPMS/hylafax-4.1.3-1.1mdk.i586.rpm
 27d3a86f8bd39560468fdc5b9be66269  8.2/RPMS/hylafax-client-4.1.3-1.1mdk.i586.rpm
 60f4529da79fcc543502d650a2782178  8.2/RPMS/hylafax-server-4.1.3-1.1mdk.i586.rpm
 0f2044dfb51f6b086f0620965f810da3  8.2/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.i586.rpm
 0542d8bd7f1f98784af674c107ede594  8.2/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.i586.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  8.2/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Mandrake Linux 8.2/ppc:
 72c6a45d7a11fb1b69a3fd8ebb9b0fc8  ppc/8.2/RPMS/hylafax-4.1.3-1.1mdk.ppc.rpm
 a26c8f863ac3b71ebea178e3a946b173  ppc/8.2/RPMS/hylafax-client-4.1.3-1.1mdk.ppc.rpm
 16bab89e373b104b3cbe910e103297e8  ppc/8.2/RPMS/hylafax-server-4.1.3-1.1mdk.ppc.rpm
 a2fe9322f593f6d56f319c439e4a952d  ppc/8.2/RPMS/libhylafax4.1.1-4.1.3-1.1mdk.ppc.rpm
 2d60a7ab5d1b41b85511f3302a5044de  ppc/8.2/RPMS/libhylafax4.1.1-devel-4.1.3-1.1mdk.ppc.rpm
 ff2a96e07f08a70a8f0d9b734a37c122  ppc/8.2/SRPMS/hylafax-4.1.3-1.1mdk.src.rpm

 Corporate Server 1.0.1:
 1bbb83c824d07e017a36c2c85b92c3b7  1.0.1/RPMS/hylafax-4.1-0.11mdk.i586.rpm
 3f4e469a6c57529fe02025ea7b4bef45  1.0.1/RPMS/hylafax-client-4.1-0.11mdk.i586.rpm
 9b0952a5701bc2ffaa6068b4b0901ede  1.0.1/RPMS/hylafax-server-4.1-0.11mdk.i586.rpm
 c44d130f10049d79f7a60601b9844b6e  1.0.1/SRPMS/hylafax-4.1-0.11mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.  The verification of md5
checksums and GPG signatures is performed automatically for you.

If you want to upgrade manually, download the updated package from one 
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".  A list of
FTP mirrors can be obtained from:

  http://www.mandrakesecure.net/en/ftp.php

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:

  rpm --checksig <filename>

All packages are signed by MandrakeSoft for security.  You can obtain
the GPG public key of the Mandrake Linux Security Team from:

  https://www.mandrakesecure.net/RPM-GPG-KEYS

Please be aware that sometimes it takes the mirrors a few hours to 
update.

You can view other update advisories for Mandrake Linux at:

  http://www.mandrakesecure.net/en/advisories/

MandrakeSoft has several security-related mailing list services that
anyone can subscribe to.  Information on these lists can be obtained by
visiting:

  http://www.mandrakesecure.net/en/mlist.php

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security@linux-mandrake.com>