Advisories, July 26, 2006

Jul 27, 2006, 03:45 (0 Talkback[s])

Debian GNU/Linux

Debian Security Advisory DSA 1111-2 security@debian.org
http://www.debian.org/security/ Dann Frazier
July 26th, 2006 http://www.debian.org/security/faq

Package : kernel-source-2.6.8 et. al.
Vulnerability : race condition
Problem-Type : local
Debian-specific: no
CVE ID : CVE-2006-3625

It was discovered that a race condition in the process filesystem can lead to privilege escalation.

The following matrix explains which kernel version for which architecture fixes the problem mentioned above:

	Debian 3.1 (sarge)
Source	2.6.8-16sarge4
Alpha architecture	2.6.8-16sarge4
AMD64 architecture	2.6.8-12sarge4
Intel IA-32 architecture	2.6.8-16sarge4
Intel IA-64 architecture	2.6.8-14sarge4
PowerPC architecture	2.6.8-12sarge4
Sun Sparc architecture	2.6.8-15sarge4
IBM S/390	2.6.8-5sarge4
Motorola 680x0	2.6.8-4sarge4
HP Precision	2.6.8-6sarge3
FAI	1.9.1sarge3

The initial advisory lacked builds for the IBM S/390, Motorola 680x0 and HP Precision architectures, which are now provided. Also, the kernels for the FAI installer have been updated.

We recommend that you upgrade your kernel package immediately and reboot the machine. If you have built a custom kernel from the kernel source package, you will need to rebuild to take advantage of these fixes.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

Architecture independent components:

    http://security.debian.org/pool/updates/main/k/kernel-source-2.6.8/kernel-doc-2.6.8_2.6.8-16sarge4_all.deb
      Size/MD5 checksum: 6183402 a4efe296e5fd14d33c6b1ae1f40265c3
    http://security.debian.org/pool/updates/main/k/kernel-source-2.6.8/kernel-patch-debian-2.6.8_2.6.8-16sarge4_all.deb
      Size/MD5 checksum: 1081512 562d408fa5cd936f557eceb74621bff2
    http://security.debian.org/pool/updates/main/k/kernel-source-2.6.8/kernel-source-2.6.8_2.6.8-16sarge4_all.deb
      Size/MD5 checksum: 34943124 7b65a57ca6a2376d8042143244b8f5ab
    http://security.debian.org/pool/updates/main/k/kernel-source-2.6.8/kernel-tree-2.6.8_2.6.8-16sarge4_all.deb
      Size/MD5 checksum: 35134 80f1a94b1542bf3f89bd77d0a69c67c4
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-s390/kernel-patch-2.6.8-s390_2.6.8-5sarge4_all.deb
      Size/MD5 checksum: 10998 c1ec5e030bf9c8f80ce8ddf68f36f74f

Alpha architecture:

    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-alpha/kernel-headers-2.6.8-3_2.6.8-16sarge4_alpha.deb
      Size/MD5 checksum: 2759858 310b0ddfee56412d0fdf827fbb53ad04
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-alpha/kernel-headers-2.6.8-3-generic_2.6.8-16sarge4_alpha.deb
      Size/MD5 checksum: 232256 264fb1d8c9107950918e02b3c8d1b2c5
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-alpha/kernel-headers-2.6.8-3-smp_2.6.8-16sarge4_alpha.deb
      Size/MD5 checksum: 227366 3c43da6bd0a369e67be02af8e3498d60
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-alpha/kernel-image-2.6.8-3-generic_2.6.8-16sarge4_alpha.deb
      Size/MD5 checksum: 20220764 714e37e85c5387ef44ef8ca96608934a
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-alpha/kernel-image-2.6.8-3-smp_2.6.8-16sarge4_alpha.deb
      Size/MD5 checksum: 20073926 24005f33bb551a3dec6cdbbdae45efdf

Intel IA-32 architecture:

Intel IA-64 architecture:

Sun Sparc architecture:

PowerPC architecture:

HP Precision architecture:

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-s390/kernel-headers-2.6.8-3_2.6.8-5sarge4_s390.deb
      Size/MD5 checksum: 5086492 86f40387b635bb06a1b8fddef2533d7b
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-s390/kernel-image-2.6.8-3-s390_2.6.8-5sarge4_s390.deb
      Size/MD5 checksum: 2977982 d3a4e0bf0b13cbaa5dfe13bcd423e66a
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-s390/kernel-image-2.6.8-3-s390-tape_2.6.8-5sarge4_s390.deb
      Size/MD5 checksum: 1142392 9d00d5a3260cbb78ed2660426c64bb87
    http://security.debian.org/pool/updates/main/k/kernel-image-2.6.8-s390/kernel-image-2.6.8-3-s390x_2.6.8-5sarge4_s390.deb
      Size/MD5 checksum: 3186958 d9db19c0b59de9298db549aae01fbd2d

AMD64 architecture:

Motorola 680x0 architecture:

These files will probably be moved into the stable distribution on its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

Ubuntu Linux

Ubuntu Security Notice USN-297-3 July 26, 2006
mozilla-thunderbird vulnerabilities
CVE-2006-2775, CVE-2006-2776, CVE-2006-2778, CVE-2006-2779, CVE-2006-2780, CVE-2006-2781, CVE-2006-2783, CVE-2006-2784, CVE-2006-2787

A security issue affects the following Ubuntu releases:

Ubuntu 5.04
Ubuntu 5.10

This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 5.04:
mozilla-thunderbird 1.0.8-0ubuntu05.04.1

Ubuntu 5.10:
mozilla-thunderbird 1.0.8-0ubuntu05.10.2

After a standard system upgrade you need to restart Thunderbird to effect the necessary changes.

Details follow:

USN-297-1 fixed several vulnerabilities in Thunderbird for the Ubuntu 6.06 LTS release. This update provides the corresponding fixes for Ubuntu 5.04 and Ubuntu 5.10.

For reference, these are the details of the original USN:

Jonas Sicking discovered that under some circumstances persisted XUL attributes are associated with the wrong URL. A malicious web site could exploit this to execute arbitrary code with the privileges of the user. (MFSA 2006-35, CVE-2006-2775)

Paul Nickerson discovered that content-defined setters on an object prototype were getting called by privileged UI code. It was demonstrated that this could be exploited to run arbitrary web script with full user privileges (MFSA 2006-37, CVE-2006-2776).

Mikolaj Habryn discovered a buffer overflow in the crypto.signText() function. By sending an email with malicious JavaScript to an user, and that user enabled JavaScript in Thunderbird (which is not the default and not recommended), this could potentially be exploited to execute arbitrary code with the user's privileges. (MFSA 2006-38, CVE-2006-2778)

The Mozilla developer team discovered several bugs that lead to crashes with memory corruption. These might be exploitable by malicious web sites to execute arbitrary code with the privileges of the user. (MFSA 2006-32, CVE-2006-2779, CVE-2006-2780)

Masatoshi Kimura discovered a memory corruption (double-free) when processing a large VCard with invalid base64 characters in it. By sending a maliciously crafted set of VCards to a user, this could potentially be exploited to execute arbitrary code with the user's privileges. (MFSA 2006-40, CVE-2006-2781)

Masatoshi Kimura found a way to bypass web input sanitizers which filter out JavaScript. By inserting 'Unicode Byte-order-Mark (BOM)' characters into the HTML code (e. g. '<scr[BOM]ipt>'), these filters might not recognize the tags anymore; however, Thunderbird would still execute them since BOM markers are filtered out before processing a mail containing JavaScript. (MFSA 2006-42, CVE-2006-2783)

Kazuho Oku discovered various ways to perform HTTP response smuggling when used with certain proxy servers. Due to different interpretation of nonstandard HTTP headers in Thunderbird and the proxy server, a malicious HTML email can exploit this to send back two responses to one request. The second response could be used to steal login cookies or other sensitive data from another opened web site. (MFSA 2006-33, CVE-2006-2786)

It was discovered that JavaScript run via EvalInSandbox() can escape the sandbox. Malicious scripts received in emails containing JavaScript could use these privileges to execute arbitrary code with the user's privileges. (MFSA 2006-31, CVE-2006-2787)

Updated packages for Ubuntu 5.04:

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.1.diff.gz
      Size/MD5: 98300 a4dffa1705bd280224188e7bbc7781dd
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.1.dsc
      Size/MD5: 946 7eebd4d62af685dd0ce74d5ff741c92c
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8.orig.tar.gz
      Size/MD5: 32849510 ae345f1b722d8f3a977af4fd358d27b0

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04.1_amd64.deb
      Size/MD5: 3347854 519c296b742dc6e6d5c308b0b6c5a433
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.04.1_amd64.deb
      Size/MD5: 145244 9a8d5c4ade62afdb187022df1b188099
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.04.1_amd64.deb
      Size/MD5: 27718 aa28f71d2133d0810bbf166d86c68dc7
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.04.1_amd64.deb
      Size/MD5: 82728 55ede40f0e71d287cfabe73492b3a71a
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.1_amd64.deb
      Size/MD5: 11959242 c6acc1fa0785193f037fb35a14f7505e

i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04.1_i386.deb
      Size/MD5: 3341642 18916c1156df514eb6b538ec63737a8d
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-inspector_1.0.8-0ubuntu05.04.1_i386.deb
      Size/MD5: 140326 b2f8c499a4b160e6131d2fb2278e54b5
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-offline_1.0.8-0ubuntu05.04.1_i386.deb
      Size/MD5: 27724 6bab59d8db842eee01a411c256b64cd8
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-typeaheadfind_1.0.8-0ubuntu05.04.1_i386.deb
      Size/MD5: 80468 114885d918a10761414adafc506be2e5
    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird_1.0.8-0ubuntu05.04.1_i386.deb
      Size/MD5: 10911294 67ab1c44fe9a3d164e0c79755365e2bf

powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/m/mozilla-thunderbird/mozilla-thunderbird-dev_1.0.8-0ubuntu05.04.1_powerpc.deb
      Size/MD5: 3337162 85e96f1fe254dc69170d3fc814110cd2