Advisories, January 30, 2006

Jan 31, 2006, 04:45 (0 Talkback[s])

Debian GNU/Linux

Debian Security Advisory DSA 951-2 security@debian.org
http://www.debian.org/security/ Martin Schulze
January 30th, 2006 http://www.debian.org/security/faq

Package : trac
Vulnerability : missing input sanitising
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2005-4065 CVE-2005-4644
BugTraq IDs : 15720 16198
Debian Bug : 348791

This update corrects the search feature in trac, an enhanced wiki and issue tracking system for software development projects, which broke with the last security update. For completeness please find below the original advisory text:

Several vulnerabilies have been discovered in trac, an enhanced wiki and issue tracking system for software development projects. The Common Vulnerabilities and Exposures project identifie the following problems:

CVE-2005-4065

Due to missing input sanitising it is possible to inject arbitrary SQL code into the SQL statements.

CVE-2005-4644

A cross-site scripting vulnerability has been discovered that allows remote attackers to inject arbitrary web script or HTML.

The old stable distribution (woody) does not contain trac packages.

For the stable distribution (sarge) these problems have been fixed in version 0.8.1-3sarge4.

For the unstable distribution (sid) these problems have been fixed in version 0.9.3-1.

We recommend that you upgrade your trac package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

    http://security.debian.org/pool/updates/main/t/trac/trac_0.8.1-3sarge4.dsc
      Size/MD5 checksum: 656 2afc7d22430b36a751b23c4bf140777c
    http://security.debian.org/pool/updates/main/t/trac/trac_0.8.1-3sarge4.diff.gz
      Size/MD5 checksum: 12886 2f5cbdedc833e862f328b70c88ad6f4f
    http://security.debian.org/pool/updates/main/t/trac/trac_0.8.1.orig.tar.gz
      Size/MD5 checksum: 236791 1b6c44fae90c760074762b73cdc88c8d

Architecture independent components:

http://security.debian.org/pool/updates/main/t/trac/trac_0.8.1-3sarge4_all.deb
Size/MD5 checksum: 198590 a06bca97069edda61ab12ed76caf9a5c

These files will probably be moved into the stable distribution on its next update.

Debian Security Advisory DSA 959-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
January 30th, 2006 http://www.debian.org/security/faq

Package : unalz
Vulnerability : buffer overflow
Problem-Type : local (remote)
Debian-specific: no
CVE ID : CVE-2005-3862
Debian Bug : 340842

Ulf Hürnhammer from the Debian Audit Project discovered that unalz, a decompressor for ALZ archives, performs insufficient bounds checking when parsing file names. This can lead to arbitrary code execution if an attacker provides a crafted ALZ archive.

The old stable distribution (woody) does not contain unalz.

For the stable distribution (sarge) this problem has been fixed in version 0.30.1

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you upgrade your unalz package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

    http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1.dsc
      Size/MD5 checksum: 505 6946e7c6ae2e663674cb968a17517d6b
    http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1.tar.gz
      Size/MD5 checksum: 108993 9b45066980a87f11db43f24b0756be33

Alpha architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_alpha.deb
Size/MD5 checksum: 54350 5cf460c260a651fa6c48a39a350fea19

AMD64 architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_amd64.deb
Size/MD5 checksum: 47924 21585b3182e29c28c4871bd75d2b8565

ARM architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_arm.deb
Size/MD5 checksum: 49050 7e2bb36975ff0f6e601be3c4ac5de5a9

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_i386.deb
Size/MD5 checksum: 42794 c9ca20d6840ca8381eee1dcfa34ad89a

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_ia64.deb
Size/MD5 checksum: 77534 4e626bf47842d551ed1761336259fcfe

HP Precision architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_hppa.deb
Size/MD5 checksum: 51558 34d2c5c50af71e9ade2c3b608041cbc5

Motorola 680x0 architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_m68k.deb
Size/MD5 checksum: 42514 747eeb6b49dc1c7e43f6d0e4034fa2c7

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_mips.deb
Size/MD5 checksum: 54364 9e797dbb849cbe5f65f61d5e052902e5

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_mipsel.deb
Size/MD5 checksum: 53938 aef1b01344791cdefed5f837b66bf9aa

PowerPC architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_powerpc.deb
Size/MD5 checksum: 45412 621dafe9070b461d0f86655a1dda9507

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_s390.deb
Size/MD5 checksum: 49970 2f6a285270fcd8084f9e2948e87ebfc4

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/u/unalz/unalz_0.30.1_sparc.deb
Size/MD5 checksum: 46612 2142655456c03385e69d156a7831005c

These files will probably be moved into the stable distribution on its next update.

Gentoo Linux

Gentoo Linux Security Advisory GLSA 200601-15

http://security.gentoo.org/

Severity: High
Title: Paros: Default administrator password
Date: January 29, 2006
Bugs: #120352
ID: 200601-15

Synopsis

Paros's database component is installed without a password, allowing execution of arbitrary system commands.

Background

Paros is an intercepting proxy between a web server and a client meant to be used for security assessments. It allows the user to watch and modify the HTTP(S) traffic.

Affected packages

     Package          /  Vulnerable  /                      Unaffected

  1  net-proxy/paros      <= 3.2.5                             > 3.2.5

Description

Andrew Christensen discovered that in older versions of Paros the database component HSQLDB is installed with an empty password for the database administrator "sa".

Impact

Since the database listens globally by default, an attacker can connect and issue arbitrary commands, including execution of binaries installed on the host.

Workaround

There is no known workaround at this time.

Resolution

All Paros users should upgrade to the latest version:

    # emerge --snyc
    # emerge --ask --oneshot --verbose ">=net-proxy/paros-3.2.8"

References

[ 1 ] CVE-2005-3280

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3280

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200601-15.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Gentoo Linux Security Advisory GLSA 200601-16

http://security.gentoo.org/

Severity: Normal
Title: MyDNS: Denial of Service
Date: January 30, 2006
Bugs: #119548
ID: 200601-16

Synopsis

MyDNS contains a vulnerability that may lead to a Denial of Service attack.

Background

MyDNS is a DNS server using a MySQL database as a backend. It is designed to allow for fast updates and small resource usage.

Affected packages

     Package        /  Vulnerable  /                        Unaffected

  1  net-dns/mydns       < 1.1.0                              >= 1.1.0

Description

MyDNS contains an unspecified flaw that may allow a remote Denial of Service.

Impact

An attacker could cause a Denial of Service by sending malformed DNS queries to the MyDNS server.

Workaround

There is no known workaround at this time.

Resolution

All MyDNS users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-dns/mydns-1.1.0"

References

[ 1 ] CVE-2006-0351

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0351

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200601-16.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Gentoo Linux Security Advisory GLSA 200601-17

http://security.gentoo.org/

Severity: Normal
Title: Xpdf, Poppler, GPdf, libextractor, pdftohtml: Heap overflows
Date: January 30, 2006
Bugs: #117481, #117494, #117495, #115789, #118665
ID: 200601-17

Synopsis

Xpdf, Poppler, GPdf, libextractor and pdftohtml are vulnerable to integer overflows that may be exploited to execute arbitrary code.

Background

Xpdf is a PDF file viewer that runs under the X Window System. Poppler is a PDF rendering library based on the Xpdf 3.0 code base. GPdf is a PDF file viewer for the GNOME 2 platform, also based on Xpdf. libextractor is a library which includes Xpdf code to extract arbitrary meta-data from files. pdftohtml is a utility to convert PDF files to HTML or XML formats that makes use of Xpdf code to decode PDF files.

Affected packages

     Package                  /   Vulnerable   /            Unaffected



  1  app-text/xpdf                 < 3.01-r5                >= 3.01-r5
  2  app-text/poppler             < 0.4.3-r4               >= 0.4.3-r4
  3  app-text/gpdf                < 2.10.0-r3             >= 2.10.0-r3
  4  media-libs/libextractor        < 0.5.9                   >= 0.5.9
  5  app-text/pdftohtml            < 0.36-r4               Vulnerable!
    -------------------------------------------------------------------
     NOTE: Certain packages are still vulnerable. Users should migrate
           to another package if one is available or wait for the
           existing packages to be marked stable by their
           architecture maintainers.
    -------------------------------------------------------------------
     5 affected packages on all of their supported architectures.

Description

Chris Evans has reported some integer overflows in Xpdf when attempting to calculate buffer sizes for memory allocation, leading to a heap overflow and a potential infinite loop when handling malformed input files.

Impact

By sending a specially crafted PDF file to a victim, an attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.

Workaround

There is no known workaround at this time.

Resolution

All Xpdf users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/xpdf-3.01-r5"

All Poppler users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/poppler-0.4.3-r4"

All GPdf users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r3"

All libextractor users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/libextractor-0.5.9"

All pdftohtml users should migrate to the latest stable version of Poppler.

References

[ 1 ] CVE-2005-3627

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3627

[ 2 ] CVE-2005-3626

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3626

[ 3 ] CVE-2005-3625

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3625

[ 4 ] CVE-2005-3624

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3624

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200601-17.xml

Concerns?

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Mandriva Linux

Mandriva Linux Security Advisory MDKSA-2006:026
http://www.mandriva.com/security/

Package : bzip2
Date : January 30, 2006
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0, Multi Network Firewall 2.0

Problem Description:

A bug was found in the way that bzgrep processed file names. If a user could be tricked into running bzgrep on a file with a special file name, it would be possible to execute arbitrary code with the privileges of the user running bzgrep.

As well, the bzip2 package provided with Mandriva Linux 2006 did not the patch applied to correct CVE-2005-0953 which was previously fixed by MDKSA-2005:091; those packages are now properly patched.

The updated packages have been patched to correct these problems.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0758
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0953

Updated Packages:

Mandriva Linux 10.1:
9ba66ec27bbf76ba782127e9d35b47cf 10.1/RPMS/bzip2-1.0.2-20.4.101mdk.i586.rpm
aa67aef5d33f2d63dbe1970b75feeb6c 10.1/RPMS/libbzip2_1-1.0.2-20.4.101mdk.i586.rpm
39ac11e51b9891bdbc781a5f57802532 10.1/RPMS/libbzip2_1-devel-1.0.2-20.4.101mdk.i586.rpm
7af647d2bd9ed2235ce9f48e45b88510 10.1/SRPMS/bzip2-1.0.2-20.4.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
c482a9d432f31f6ae2de7b2a68547b97 x86_64/10.1/RPMS/bzip2-1.0.2-20.4.101mdk.x86_64.rpm
e9ae19f83d4156ff00b64c3bb738094e x86_64/10.1/RPMS/lib64bzip2_1-1.0.2-20.4.101mdk.x86_64.rpm
464e89b49a8e8b50bf90c2591d0fe773 x86_64/10.1/RPMS/lib64bzip2_1-devel-1.0.2-20.4.101mdk.x86_64.rpm
7af647d2bd9ed2235ce9f48e45b88510 x86_64/10.1/SRPMS/bzip2-1.0.2-20.4.101mdk.src.rpm

Mandriva Linux 10.2:
7df4a217662f8c37e245eb93d93a371d 10.2/RPMS/bzip2-1.0.2-20.3.102mdk.i586.rpm
8f786bbbddacf81ccf78858566f4b61e 10.2/RPMS/libbzip2_1-1.0.2-20.3.102mdk.i586.rpm
560e3fcafd35a390acc92b3585c3e209 10.2/RPMS/libbzip2_1-devel-1.0.2-20.3.102mdk.i586.rpm
70536dcc4a48fd2c927533f5610e4c30 10.2/SRPMS/bzip2-1.0.2-20.3.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
fbb29ba214b192f71f93e1651e2859f6 x86_64/10.2/RPMS/bzip2-1.0.2-20.3.102mdk.x86_64.rpm
fad0d57ba24c7c2564a052621dabef6f x86_64/10.2/RPMS/lib64bzip2_1-1.0.2-20.3.102mdk.x86_64.rpm
e88392d200f33e476e43ff9d07576173 x86_64/10.2/RPMS/lib64bzip2_1-devel-1.0.2-20.3.102mdk.x86_64.rpm
70536dcc4a48fd2c927533f5610e4c30 x86_64/10.2/SRPMS/bzip2-1.0.2-20.3.102mdk.src.rpm

Mandriva Linux 2006.0:
4e0529ee4c44182a0595aafaa4cc5f07 2006.0/RPMS/bzip2-1.0.3-1.2.20060mdk.i586.rpm
bce98fe9a3066968923b0bd067908777 2006.0/RPMS/libbzip2_1-1.0.3-1.2.20060mdk.i586.rpm
cbed01da9b0111e3f47f59735ec16a09 2006.0/RPMS/libbzip2_1-devel-1.0.3-1.2.20060mdk.i586.rpm
d099cf8e4a81702f32efbd9afe92f208 2006.0/SRPMS/bzip2-1.0.3-1.2.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
c2c65e542f1e9b34a801f578f3ce0920 x86_64/2006.0/RPMS/bzip2-1.0.3-1.2.20060mdk.x86_64.rpm
e401cf58458c72b0fa8de87352f81ecf x86_64/2006.0/RPMS/lib64bzip2_1-1.0.3-1.2.20060mdk.x86_64.rpm
920aa42c55fc7a97912433ca2c9f5adb x86_64/2006.0/RPMS/lib64bzip2_1-devel-1.0.3-1.2.20060mdk.x86_64.rpm
d099cf8e4a81702f32efbd9afe92f208 x86_64/2006.0/SRPMS/bzip2-1.0.3-1.2.20060mdk.src.rpm

Corporate Server 2.1:
521d044c36980ad67d31d235cf1290bf corporate/2.1/RPMS/bzip2-1.0.2-10.4.C21mdk.i586.rpm
dafdb66e984581813890aa05a9e597e3 corporate/2.1/RPMS/libbzip2_1-1.0.2-10.4.C21mdk.i586.rpm
5470771fb2586bf4c28439d7923cbf60 corporate/2.1/RPMS/libbzip2_1-devel-1.0.2-10.4.C21mdk.i586.rpm
9215603a9dc985117ec1f5476fb0e05e corporate/2.1/SRPMS/bzip2-1.0.2-10.4.C21mdk.src.rpm

Corporate Server 2.1/X86_64:
ec9760c37823edd74fbe67e4f7467607 x86_64/corporate/2.1/RPMS/bzip2-1.0.2-10.4.C21mdk.x86_64.rpm
709e7e4d97e553500c334d443a99289d x86_64/corporate/2.1/RPMS/libbzip2_1-1.0.2-10.4.C21mdk.x86_64.rpm
032616025d51bb2e2c0d957deb606016 x86_64/corporate/2.1/RPMS/libbzip2_1-devel-1.0.2-10.4.C21mdk.x86_64.rpm
9215603a9dc985117ec1f5476fb0e05e x86_64/corporate/2.1/SRPMS/bzip2-1.0.2-10.4.C21mdk.src.rpm

Corporate 3.0:
abf848e7e0779c5df11a9f52a33c952e corporate/3.0/RPMS/bzip2-1.0.2-17.4.C30mdk.i586.rpm
ea41c2d1db6197763b8ae5602de69d47 corporate/3.0/RPMS/libbzip2_1-1.0.2-17.4.C30mdk.i586.rpm
ae5a1944fc833de24f3d6845e815fb91 corporate/3.0/RPMS/libbzip2_1-devel-1.0.2-17.4.C30mdk.i586.rpm
8f3a578903df91bcc206e20f51219063 corporate/3.0/SRPMS/bzip2-1.0.2-17.4.C30mdk.src.rpm

Corporate 3.0/X86_64:
66856ec28ef826f1eeaca20fb71d1555 x86_64/corporate/3.0/RPMS/bzip2-1.0.2-17.4.C30mdk.x86_64.rpm
9e46e6e8bc7eb84d74578339ab19dbd3 x86_64/corporate/3.0/RPMS/lib64bzip2_1-1.0.2-17.4.C30mdk.x86_64.rpm
8a15e6bfcfcf7daee02a3c4770b85b25 x86_64/corporate/3.0/RPMS/lib64bzip2_1-devel-1.0.2-17.4.C30mdk.x86_64.rpm
8f3a578903df91bcc206e20f51219063 x86_64/corporate/3.0/SRPMS/bzip2-1.0.2-17.4.C30mdk.src.rpm

Multi Network Firewall 2.0:
99d1d85e93178ef63268c0127b22b0ab mnf/2.0/RPMS/bzip2-1.0.2-17.4.M20mdk.i586.rpm
624b0cca4f32689662f41862783ec701 mnf/2.0/RPMS/libbzip2_1-1.0.2-17.4.M20mdk.i586.rpm
384d5f1755aac9bef93454c394a38ba0 mnf/2.0/RPMS/libbzip2_1-devel-1.0.2-17.4.M20mdk.i586.rpm
2426bf6007f6ed217ccbab7304a7bae6 mnf/2.0/SRPMS/bzip2-1.0.2-17.4.M20mdk.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com>

Mandriva Linux Security Advisory MDKSA-2006:027
http://www.mandriva.com/security/

Package : gzip
Date : January 30, 2006
Affected: 10.1, 10.2, 2006.0, Corporate 2.1, Corporate 3.0, Multi Network Firewall 2.0

Problem Description:

Zgrep in gzip before 1.3.5 does not properly sanitize arguments, which allows local users to execute arbitrary commands via filenames that are injected into a sed script.

This was previously corrected in MDKSA-2005:092, however the fix was incomplete. These updated packages provide a more comprehensive fix to the problem.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0758

Updated Packages:

Mandriva Linux 10.1:
62937bbc65984b8f32a8817ca9d0a83a 10.1/RPMS/gzip-1.2.4a-13.3.101mdk.i586.rpm
03b66c3fff9a34edf0f714f773755d94 10.1/SRPMS/gzip-1.2.4a-13.3.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
fc3cc9dbcf1ca6b67f19a512ca555ed9 x86_64/10.1/RPMS/gzip-1.2.4a-13.3.101mdk.x86_64.rpm
03b66c3fff9a34edf0f714f773755d94 x86_64/10.1/SRPMS/gzip-1.2.4a-13.3.101mdk.src.rpm

Mandriva Linux 10.2:
431066b4062f9f23a09a137edb20b7b6 10.2/RPMS/gzip-1.2.4a-14.2.102mdk.i586.rpm
15e833f4126a3708773a7f055c24e21e 10.2/SRPMS/gzip-1.2.4a-14.2.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
b18f7f611c82083e8e5605687165f1f3 x86_64/10.2/RPMS/gzip-1.2.4a-14.2.102mdk.x86_64.rpm
15e833f4126a3708773a7f055c24e21e x86_64/10.2/SRPMS/gzip-1.2.4a-14.2.102mdk.src.rpm

Mandriva Linux 2006.0:
9a496bbbe2e1a07096c7ac536fc2456c 2006.0/RPMS/gzip-1.2.4a-15.1.20060mdk.i586.rpm
da6e6cd98d8e37904c6e5140950367ac 2006.0/SRPMS/gzip-1.2.4a-15.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
e1e5bf8168bdd95291364b4078504df5 x86_64/2006.0/RPMS/gzip-1.2.4a-15.1.20060mdk.x86_64.rpm
da6e6cd98d8e37904c6e5140950367ac x86_64/2006.0/SRPMS/gzip-1.2.4a-15.1.20060mdk.src.rpm

Corporate Server 2.1:
3b8cb2a9448fc5411bd8e49bb7037ffe corporate/2.1/RPMS/gzip-1.2.4a-11.5.C21mdk.i586.rpm
3baf958e1a8159e1621f7d1694b24a24 corporate/2.1/SRPMS/gzip-1.2.4a-11.5.C21mdk.src.rpm

Corporate Server 2.1/X86_64:
996b5e2b2b3f330fa9387e18e9f7d422 x86_64/corporate/2.1/RPMS/gzip-1.2.4a-11.5.C21mdk.x86_64.rpm
3baf958e1a8159e1621f7d1694b24a24 x86_64/corporate/2.1/SRPMS/gzip-1.2.4a-11.5.C21mdk.src.rpm

Corporate 3.0:
8d5bbe00592a9830ce4ac5d2b120e867 corporate/3.0/RPMS/gzip-1.2.4a-13.3.C30mdk.i586.rpm
5baa56e8feb905c9fb48629344a88b02 corporate/3.0/SRPMS/gzip-1.2.4a-13.3.C30mdk.src.rpm

Corporate 3.0/X86_64:
0fd942e8d92942d5cee224263a27db9c x86_64/corporate/3.0/RPMS/gzip-1.2.4a-13.3.C30mdk.x86_64.rpm
5baa56e8feb905c9fb48629344a88b02 x86_64/corporate/3.0/SRPMS/gzip-1.2.4a-13.3.C30mdk.src.rpm

Multi Network Firewall 2.0:
1c2352fc2445c452769181be3d4e85a1 mnf/2.0/RPMS/gzip-1.2.4a-13.3.M20mdk.i586.rpm
601229e6188ad8ee34ff12f1147c5381 mnf/2.0/SRPMS/gzip-1.2.4a-13.3.M20mdk.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com>

Trustix Secure Linux

Trustix Secure Linux Security Advisory #2006-0004

Package names: kernel, openssh
Summary: Multiple vulnerabilities
Date: 2006-01-27
Affected versions: Trustix Secure Linux 2.2 Trustix Secure Linux 3.0 Trustix Operating System - Enterprise Server 2

Package description:
kernel
The kernel package contains the Linux kernel (vmlinuz), the core of your Trustix Secure Linux operating system. The kernel handles the basic functions of the operating system: memory allocation, process allocation, device input and output, etc.

openssh
Ssh (Secure Shell) a program for logging into a remote machine and for executing commands in a remote machine. It is intended to replace rlogin and rsh, and provide secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over the secure channel.

Problem description:
kernel < TSL 3.0 >

SECURITY Fix: Missing validation of the "nlmsg_len" value in "netlink_rcv_skb()" can cause an infinite loop which can be exploited by local users to cause a DoS by setting the value to 0.
An error in the PPTP NAT helper in the handling of inbound PPTP_IN_CALL_REQUEST packets can cause an error in offset calculation. This can be exploited to cause random memory corruption and can crash the kernel.
ip_nat_pptp in the PPTP NAT helper (netfilter/ip_nat_helper_pptp.c) in Linux kernel 2.6.14, and other versions, allows local users to cause a denial of service via a crafted outbound packet that causes an incorrect offset to be calculated from pointer arithmetic when non-linear SKBs (socket buffers) are used.
Stefan Rompf has reported a vulnerability caused due to the "dm-crypt" driver failing to clear memory before freeing it. This can be exploited by local users to obtain sensitive information.

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CVE-2006-0035, CVE-2006-0036, CVE-2006-0037 and CVE-2006-0095 to these issues.

openssh < TSL 3.0 > < TSL 2.2 > < TSEL 2 >

SECURITY Fix: Josh Bressers has reported a weakness in OpenSSH caused due to the insecure use of the "system()" function in scp when performing copy operations using filenames that are supplied by the user from the command line. This can be exploited to execute shell commands with privileges of the user running scp.

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CVE-2006-0225 to this issue.

Action:
We recommend that all systems with this package installed be upgraded. Please note that if you do not need the functionality provided by this package, you may want to remove it from your system.

Location:
All Trustix Secure Linux updates are available from <URI:http://http.trustix.org/pub/trustix/updates/>
<URI:ftp://ftp.trustix.org/pub/trustix/updates/>

About Trustix Secure Linux:
Trustix Secure Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater.

Automatic updates:
Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'.

Questions?
Check out our mailing lists:
<URI:http://www.trustix.org/support/>

Verification:
This advisory along with all Trustix packages are signed with the TSL sign key.
This key is available from:
<URI:http://www.trustix.org/TSL-SIGN-KEY>

The advisory itself is available from the errata pages at <URI:http://www.trustix.org/errata/trustix-2.2/> and
<URI:http://www.trustix.org/errata/trustix-3.0/>
or directly at
<URI:http://www.trustix.org/errata/2006/0004/>

MD5sums of the packages:

027cea1f2f987f710fe2680337a4774f 3.0/rpms/kernel-2.6.15.1-1tr.i586.rpm
9f6cc359c94b874a8160b2744fb6d510 3.0/rpms/kernel-doc-2.6.15.1-1tr.i586.rpm
f6c272fadee97f280adee5f9a00576b0 3.0/rpms/kernel-headers-2.6.15.1-1tr.i586.rpm
31150a8b714720f20e290dccec845826 3.0/rpms/kernel-smp-2.6.15.1-1tr.i586.rpm
fce9c0bf230300cec808aea31ff7f718 3.0/rpms/kernel-smp-headers-2.6.15.1-1tr.i586.rpm
cf6368abb17f22b64826d00bd8336cf5 3.0/rpms/kernel-source-2.6.15.1-1tr.i586.rpm
0608ad6bd8e97ddadd0b501206a11d20 3.0/rpms/kernel-utils-2.6.15.1-1tr.i586.rpm
ab20e49ff562fa8accc40ecbf13e7799 3.0/rpms/openssh-4.2p1-2tr.i586.rpm
ade6e066afe6e83bd99975bfa252f608 3.0/rpms/openssh-clients-4.2p1-2tr.i586.rpm
7290bb4c93f08314b72b589e6ed3b0b3 3.0/rpms/openssh-server-4.2p1-2tr.i586.rpm
934477d687fb6cb48b78fceb87e187e2 3.0/rpms/openssh-server-config-4.2p1-2tr.i586.rpm

3bfc8e25184b964391c8c71ad95b2778 2.2/rpms/openssh-4.2p1-2tr.i586.rpm
8a3a8e810c8121ac10846922e0bffe6a 2.2/rpms/openssh-clients-4.2p1-2tr.i586.rpm
33c754e2048bb85822145c2063f63463 2.2/rpms/openssh-server-4.2p1-2tr.i586.rpm
0abb95f1c3c13c491e0233ae6f3a9944 2.2/rpms/openssh-server-config-4.2p1-2tr.i586.rpm

Trustix Security Team

Top White Papers

Subscribe to Our Daily Newsletter

Current Newswire:

More on LinuxToday

Advisories, January 30, 2006

Debian GNU/Linux

Gentoo Linux

Mandriva Linux

Trustix Secure Linux