|
|
| Top White Papers
Current Newswire:
Security Digest: January 27, 2005Jan 28, 2005, 04:45 (0 Talkback[s])Conectiva LinuxCONECTIVA LINUX SECURITY ANNOUNCEMENT PACKAGE : squid DESCRIPTION This announcement adds the following patches to Squid: 1.Empty ACLs[2] 2.Fakeauth_auth[3] 3.LDAP spaces[4] 4.Non blocking disk[5] 5.Gopher html parsing[6] 6.WCCP denial of service[7] 7.SNMP core dump[8] Additionally, this announcement increases the Squid's initscript timeout for waiting it to stop from 10 seconds to 35 seconds, avoiding problems with stuck connections. SOLUTION REFERENCES UPDATED PACKAGES ADDITIONAL INSTRUCTIONS
Detailed instructions regarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en Copyright (c) 2004 Conectiva Inc. http://www.conectiva.com Debian GNU/LinuxDebian Security Advisory DSA 661-1 security@debian.org Package : f2c Javier Fernández-Sanguino Peña from the Debian Security Audit project discovered that f2c and fc, which are both part of the f2c package, a fortran 77 to C/C++ translator, open temporary files insecurely and are hence vulnerable to a symlink attack. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CAN-2005-0017 Multiple insecure temporary files in the f2c translator. CAN-2005-0018 Two insecure temporary files in the f2 shell script. For the stable distribution (woody) these problems have been fixed in version 20010821-3.1 For the unstable distribution (sid) these problems will be fixed soon. We recommend that you upgrade your f2c package. Upgrade Instructions wget url will fetch the file for you will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody Source archives:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1.dsc Alpha architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_alpha.deb ARM architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_arm.deb Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_i386.deb Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_ia64.deb HP Precision architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_hppa.deb Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_m68k.deb Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_mips.deb Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_mipsel.deb PowerPC architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_powerpc.deb IBM S/390 architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_s390.deb Sun Sparc architecture:
http://security.debian.org/pool/updates/main/f/f2c/f2c_20010821-3.1_sparc.deb These files will probably be moved into the stable distribution on its next update. For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> Gentoo LinuxGentoo Linux Security Advisory GLSA 200501-37 Severity: Normal SynopsisGraphicsMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution. BackgroundGraphicsMagick is a collection of tools to read, write and manipulate images in many formats. GraphicsMagick is originally derived from ImageMagick 5.5.2. Affected packages
Package / Vulnerable / Unaffected
1 media-gfx/graphicsmagick < 1.1.5 >= 1.1.5 DescriptionAndrei Nigmatulin discovered that handling a Photoshop Document (PSD) file with more than 24 layers in ImageMagick could trigger a heap overflow (GLSA 200501-26). GraphicsMagick is based on the same code and therefore suffers from the same flaw. ImpactAn attacker could potentially design a malicious PSD image file to cause arbitrary code execution with the permissions of the user running GraphicsMagick. WorkaroundThere is no known workaround at this time. ResolutionAll GraphicsMagick users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.5"
References[ 1 ] CAN-2005-0005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005 [ 2 ] GLSA 200501-26 http://www.gentoo.org/security/en/glsa/glsa-200501-26.xml AvailabilityThis GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200501-37.xml Concerns?Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. LicenseCopyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0 Gentoo Linux Security Advisory GLSA 200501-38 Severity: Normal SynopsisThe Perl DBI library and File::Path::rmtree function are vulnerable to symlink attacks. BackgroundPerl is a cross platform programming language. The DBI is the standard database interface module for Perl. Affected packages
Package / Vulnerable / Unaffected
1 dev-perl/dbi <= 1.38 *>= 1.37-r1
>= 1.38-r1
2 dev-lang/perl <= 5.8.6-r1 >= 5.8.6-r2
*>= 5.8.5-r3
*>= 5.8.4-r2
*>= 5.8.2-r2
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
DescriptionJavier Fernandez-Sanguino Pena discovered that the DBI library creates temporary files in an insecure, predictable way (CAN-2005-0077). Paul Szabo found out that "File::Path::rmtree" also handles temporary files insecurely (CAN-2004-0452). ImpactA local attacker could create symbolic links in the temporary files directory that point to a valid file somewhere on the filesystem. When the DBI library or File::Path::rmtree is executed, this could be used to overwrite files with the rights of the user calling these functions. WorkaroundThere are no known workarounds at this time. ResolutionAll Perl users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose dev-lang/perl
All DBI library users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose dev-perl/dbi
References[ 1 ] CAN-2005-0077 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0077 [ 2 ] CAN-2004-0452 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452 AvailabilityThis GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200501-38.xml Concerns?Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org. LicenseCopyright 2005 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.0 MandrakelinuxMandrakelinux Security Update Advisory Package name: evolution Problem Description: Max Vozeler discovered an integer overflow in the camel-lock-helper application. This application is installed setgid mail by default. A local attacker could exploit this to execute malicious code with the privileges of the "mail" group; likewise a remote attacker could setup a malicious POP server to execute arbitrary code when an Evolution user connects to it. The updated packages have been patched to prevent this problem. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0102 Updated Packages: Mandrakelinux 10.0: Mandrakelinux 10.0/AMD64: Mandrakelinux 10.1: Mandrakelinux 10.1/X86_64: Corporate Server 3.0: Corporate Server 3.0/x86_64: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandrakelinux at: http://www.mandrakesoft.com/security/advisories If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID Mandrakelinux Security Update Advisory Package name: bind Problem Description: A vulnerability was discovered in BIND version 9.3.0 where a remote attacker may be able to cause named to exit prematurely, causing a Denial of Service due to an incorrect assumption in the validator function authvalidated(). The updated packages have been patched to prevent this problem. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0034 http://www.kb.cert.org/vuls/id/938617 Updated Packages: Mandrakelinux 10.1: Mandrakelinux 10.1/X86_64: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandrakesoft for security. You can obtain the GPG public key of the Mandrakelinux Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandrakelinux at: http://www.mandrakesoft.com/security/advisories If you want to report vulnerabilities, please contact security_linux-mandrake.com Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team <security linux-mandrake.com>
0 Talkback[s]
(click to add your comment)
|
