|
|
| Top White Papers
Current Newswire:
Advisories, February 21, 2006Feb 22, 2006, 04:45 (0 Talkback[s])Debian GNU/LinuxDebian Security Advisory DSA 978-1 security@debian.org Package : gnupg Tavis Ormandy noticed that gnupg, the GNU privacy guard - a free PGP replacement, verifies external signatures of files successfully even though they don't contain a signature at all. For the old stable distribution (woody) this problem has been fixed in version 1.0.6-4woody4. For the stable distribution (sarge) this problem has been fixed in version 1.4.1-1sarge1. For the unstable distribution (sid) this problem will be fixed soon. We recommend that you upgrade your gnupg package. Upgrade Instructions wget url will fetch the file for you will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody Source archives: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4.dsc Alpha architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_alpha.deb ARM architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_arm.deb Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_i386.deb Intel IA-64 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_ia64.deb HP Precision architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_hppa.deb Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_m68k.deb Big endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_mips.deb Little endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_mipsel.deb PowerPC architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_powerpc.deb IBM S/390 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_s390.deb Sun Sparc architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.0.6-4woody4_sparc.deb Debian GNU/Linux 3.1 alias sarge Source archives: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1.dsc Alpha architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_alpha.deb AMD64 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_amd64.deb ARM architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_arm.deb Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_i386.deb Intel IA-64 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_ia64.deb HP Precision architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_hppa.deb Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_m68k.deb Big endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_mips.deb Little endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_mipsel.deb PowerPC architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_powerpc.deb IBM S/390 architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_s390.deb Sun Sparc architecture: http://security.debian.org/pool/updates/main/g/gnupg/gnupg_1.4.1-1sarge1_sparc.deb These files will probably be moved into the stable distribution on its next update. Debian Security Advisory DSA 979-1 security@debian.org Package : pdfkit.framework Derek Noonburg has fixed several potential vulnerabilities in xpdf, the Portable Document Format (PDF) suite, which are also present in pdfkit.framework, the GNUstep framework for rendering PDF content. The old stable distribution (woody) does not contain pdfkit.framework packages. For the stable distribution (sarge) these problems have been fixed in version 0.8-2sarge3. The unstable distribution (sid) is not affected by these problems. We recommend that you upgrade your pdfkit.framework package. Upgrade Instructions wget url will fetch the file for you will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge Source archives: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3.dsc Alpha architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_alpha.deb AMD64 architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_amd64.deb ARM architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_arm.deb Intel IA-32 architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_i386.deb Intel IA-64 architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_ia64.deb HP Precision architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_hppa.deb Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_m68k.deb Big endian MIPS architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_mips.deb Little endian MIPS architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_mipsel.deb PowerPC architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_powerpc.deb IBM S/390 architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_s390.deb Sun Sparc architecture: http://security.debian.org/pool/updates/main/p/pdfkit.framework/pdfkit.framework_0.8-2sarge3_sparc.deb These files will probably be moved into the stable distribution on its next update. For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg> Fedora CoreFedora Update Notification FEDORA-2006-116 2006-02-17 Product : Fedora Core 4 Description : Update Information: The GNU Privacy Guard provides encryption and signing for messages and arbitrary files, and implements the OpenPGP standard as described by IETF RFC2440. Version 1.4.2 of GnuPG would in some cases erroneously exit with status 0 (signalling no errors) if it was invoked to check a signature but found no signature to check. This should be corrected in version 1.4.2.1.
This update can be downloaded from: http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/ a1a4ce41efd41cb8ade2b4413072fb4c00e8b9e3
SRPMS/gnupg-1.4.2.1-1.src.rpm This update can be installed with the 'yum' update program. Use 'yum update package-name' at the command line. For more information, refer to 'Managing Software with yum,' available at http://fedora.redhat.com/docs/yum/. Fedora LegacyFedora Legacy Update Advisory Synopsis: Updated squid package fixes security issues 1. Topic: An updated Squid package that fixes several security issues is now available. Squid is a full-featured Web proxy cache. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A buffer overflow was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could potentially execute arbitrary code by sending a lengthy password. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2004-0541 to this issue. An out of bounds memory read bug was found within the NTLM authentication helper routine. If Squid is configured to use the NTLM authentication helper, a remote attacker could send a carefully crafted NTLM authentication packet and cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2004-0832 to this issue. iDEFENSE reported a flaw in the squid SNMP module. This flaw could allow an attacker who has the ability to send arbitrary packets to the SNMP port to restart the server, causing it to drop all open connections. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2004-0918 to this issue. A buffer overflow flaw was found in the Gopher relay parser. This bug could allow a remote Gopher server to crash the Squid proxy that reads data from it. Although Gopher servers are now quite rare, a malicious web page (for example) could redirect or contain a frame pointing to an attacker's malicious gopher server. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0094 to this issue. An integer overflow flaw was found in the WCCP message parser. It is possible to crash the Squid server if an attacker is able to send a malformed WCCP message with a spoofed source address matching Squid's "home router". The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0095 to this issue. A memory leak was found in the NTLM fakeauth_auth helper. It is possible that an attacker could place the Squid server under high load, causing the NTML fakeauth_auth helper to consume a large amount of memory, resulting in a denial of service. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0096 to this issue. A NULL pointer de-reference bug was found in the NTLM fakeauth_auth helper. It is possible for an attacker to send a malformed NTLM type 3 message, causing the Squid server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0097 to this issue. A username validation bug was found in squid_ldap_auth. It is possible for a username to be padded with spaces, which could allow a user to bypass explicit access control rules or confuse accounting. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0173 to this issue. The way Squid handles HTTP responses was found to need strengthening. It is possible that a malicious web server could send a series of HTTP responses in such a way that the Squid cache could be poisoned, presenting users with incorrect webpages. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CVE-2005-0174 and CVE-2005-0175 to these issues. When processing the configuration file, Squid parses empty Access Control Lists (ACLs) and proxy_auth ACLs without defined auth schemes in a way that effectively removes arguments, which could allow remote attackers to bypass intended ACLs. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0194 to this issue. A buffer overflow bug was found in the WCCP message parser. It is possible that an attacker could send a malformed WCCP message which could crash the Squid server or execute arbitrary code. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0211 to this issue. A bug was found in the way Squid handled oversized HTTP response headers. It is possible that a malicious web server could send a specially crafted HTTP header which could cause the Squid cache to be poisoned, presenting users with incorrect webpages. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0241 to this issue. A bug was found in the way Squid handles FQDN lookups. It was possible to crash the Squid server by sending a carefully crafted DNS response to an FQDN lookup. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0446 to this issue. A race condition bug was found in the way Squid handles the now obsolete Set-Cookie header. It is possible that Squid can leak Set-Cookie header information to other clients connecting to Squid. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0626 to this issue. A bug was found in the way Squid handles PUT and POST requests. It is possible for an authorised remote user to cause a failed PUT or POST request which can cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-0718 to this issue. A bug was found in the way Squid processes errors in the access control list. It is possible that an error in the access control list could give users more access than intended. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-1345 to this issue. A bug was found in the way Squid handles access to the cachemgr.cgi script. It is possible for an authorised remote user to bypass access control lists with this flaw. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-1999-0710 to this issue. A bug was found in the way Squid handles DNS replies. If the port Squid uses for DNS requests is not protected by a firewall it is possible for a remote attacker to spoof DNS replies, possibly redirecting a user to spoofed or malicious content. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-1519 to this issue. A bug was found in the way Squid displays error messages. A remote attacker could submit a request containing an invalid hostname which would result in Squid displaying a previously used error message. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2004-2479 to this issue. Two denial of service bugs were found in the way Squid handles malformed requests. A remote attacker could submit a specially crafted request to Squid that would cause the server to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the names CVE-2005-2794 and CVE-2005-2796 to these issues. A bug was found in the way Squid handles certain request sequences while performing NTLM authentication. It is possible for an attacker to cause Squid to crash. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2005-2917 to this issue. Users of Squid should upgrade to this updated package, which contains backported patches, and is not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory only contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152809 6. RPMs required: Red Hat Linux 7.3: i386: Red Hat Linux 9: SRPM: i386: Fedora Core 1: SRPM: i386: Fedora Core 2: SRPM: i386: 7. Verification: SHA1 sum Package Name 5db383926b0358e7b1a74cd0c84d3c253fae82a6
redhat/7.3/updates/i386/squid-2.4.STABLE7-0.73.3.legacy.i386.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0541 9. Contact: The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org Fedora Legacy Update Advisory Synopsis: Updated openssh packages fix security issues 1. Topic: Updated openssh packages that fix security issues are now available. OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. SSH replaces rlogin and rsh, and provides secure encrypted communications between two untrusted hosts over an insecure network. X11 connections and arbitrary TCP/IP ports can also be forwarded over a secure channel. Public key authentication can be used for "passwordless" access to servers. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A bug was found in the way the OpenSSH server handled the MaxStartups and LoginGraceTime configuration variables. A malicious user could connect to the SSH daemon in such a way that it would prevent additional logins from occuring until the malicious connections are closed. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2004-2069 to this issue. The scp command was found to expose filenames twice to shell expansion. A malicious user could execute arbitrary commands by using specially crafted filenames containing shell metacharacters or spaces. The Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name CVE-2006-0225 to this issue. Users of openssh should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory only contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=168935 6. RPMs required: Red Hat Linux 7.3: i386: Red Hat Linux 9: SRPM: i386: Fedora Core 1: SRPM: i386: Fedora Core 2: SRPM: i386: Fedora Core 3: SRPM: i386: x86_64: 7. Verification: SHA1 sum Package Name 5c732eac2396d1dbc767c6706b936177b04e3ba9
redhat/7.3/updates/i386/openssh-3.1p1-14.3.legacy.i386.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-2069 9. Contact: The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More project details at http://www.fedoralegacy.org Fedora Legacy Update Advisory Synopsis: Updated Apache httpd packages fix security issues 1. Topic: Updated Apache httpd packages that correct three security issues are now available. The Apache HTTP Server is a popular and freely-available Web server. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: A memory leak in the worker MPM could allow remote attackers to cause a denial of service (memory consumption) via aborted connections, which prevents the memory for the transaction pool from being reused for other connections. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2970 to this issue. This vulnerability only affects users who are using the non-default worker MPM. A flaw in mod_imap when using the Referer directive with image maps was discovered. With certain site configurations, a remote attacker could perform a cross-site scripting attack if a victim can be forced to visit a malicious URL using certain web browsers. (CVE-2005-3352) A NULL pointer dereference flaw in mod_ssl was discovered affecting server configurations where an SSL virtual host is configured with access control and a custom 400 error document. A remote attacker could send a carefully crafted request to trigger this issue which would lead to a crash. This crash would only be a denial of service if using the non-default worker MPM. (CVE-2005-3357) Users of httpd should update to these erratum packages which contain backported patches to correct these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory only contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=175406 6. RPMs required: Red Hat Linux 7.3: i386:
0 Talkback[s]
(click to add your comment)
|
