Package : kernel-source-2.4.19 kernel-patch-2.4.19-mips
Vulnerability : several vulnerabilities
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177
CAN-2004-0178
Several serious problems have been discovered in the Linux
kernel. This update takes care of Linux 2.4.17 for the MIPS
architecture. The Common Vulnerabilities and Exposures project
identifies the following problems that will be fixed with this
update:
CAN-2004-0003
A vulnerability has been discovered in the R128 drive in the
Linux kernel which could potentially lead an attacker to gain
unauthorised privileges. Alan Cox and Thomas Biege developed a
correction for this
CAN-2004-0010
Arjan van de Ven discovered a stack-based buffer overflow in the
ncp_lookup function for ncpfs in the Linux kernel, which could lead
an attacker to gain unauthorised privileges. Petr Vandrovec
developed a correction for this.
CAN-2004-0109
zen-parse discovered a buffer overflow vulnerability in the
ISO9660 filesystem component of Linux kernel which could be abused
by an attacker to gain unauthorised root access. Sebastian Krahmer
and Ernie Petrides developed a correction for this.
CAN-2004-0177
Solar Designer discovered an information leak in the ext3 code
of Linux. In a worst case an attacker could read sensitive data
such as cryptographic keys which would otherwise never hit disk
media. Theodore Ts'o developed a correction for this.
CAN-2004-0178
Andreas Kies discovered a denial of service condition in the
Sound Blaster driver in Linux. He also developed a correction for
this.
These problems are also fixed by upstream in Linux 2.4.26 and
future versions of 2.6.
The following security matrix explains which kernel versions for
which architectures are already fixed and which will be removed
instead.
Architecture
stable (woody)
unstable (sid)
remove in sid
source
2.4.19-4.woody2
2.4.25-3
2.4.19-11
mips
2.4.19-0.020911.1.woody4
2.4.25-0.040415.1
2.4.19-0.020911.8
We recommend that you upgrade your kernel packages immediately,
either with a Debian provided kernel or with a self compiled one.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : zope
Vulnerability : arbitrary code execution
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2002-0688
A vulnerability has been discovered in the index support of the
ZCatalog plug-in in Zope, an open source web application server. A
flaw in the security settings of ZCatalog allows anonymous users to
call arbitrary methods of catalog indexes. The vulnerability also
allows untrusted code to do the same.
For the stable distribution (woody) this problem has been fixed
in version 2.5.1-1woody1.
For the unstable distribution (sid) this problem has been fixed
in version 2.6.0-0.1 and higher.
We recommend that you upgrade your zope package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : kernel-source-2.4.17 kernel-patch-2.4.17-mips
Vulnerability : several vulnerabilities
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177
CAN-2004-0178
Several serious problems have been discovered in the Linux
kernel. This update takes care of Linux 2.4.17 for the PowerPC/apus
and S/390 architectures. The Common Vulnerabilities and Exposures
project identifies the following problems that will be fixed with
this update:
CAN-2004-0003
A vulnerability has been discovered in the R128 drive in the
Linux kernel which could potentially lead an attacker to gain
unauthorised privileges. Alan Cox and Thomas Biege developed a
correction for this
CAN-2004-0010
Arjan van de Ven discovered a stack-based buffer overflow in the
ncp_lookup function for ncpfs in the Linux kernel, which could lead
an attacker to gain unauthorised privileges. Petr Vandrovec
developed a correction for this.
CAN-2004-0109
zen-parse discovered a buffer overflow vulnerability in the
ISO9660 filesystem component of Linux kernel which could be abused
by an attacker to gain unauthorised root access. Sebastian Krahmer
and Ernie Petrides developed a correction for this.
CAN-2004-0177
Solar Designer discovered an information leak in the ext3 code
of Linux. In a worst case an attacker could read sensitive data
such as cryptographic keys which would otherwise never hit disk
media. Theodore Ts'o developed a correction for this.
CAN-2004-0178
Andreas Kies discovered a denial of service condition in the
Sound Blaster driver in Linux. He also developed a correction for
this.
These problems are also fixed by upstream in Linux 2.4.26 and
future versions of 2.6.
The following security matrix explains which kernel versions for
which architectures are already fixed and which will be removed
instead.
Architecture
stable (woody)
unstable (sid)
remove in sid
source
2.4.17-1woody3
2.4.25-3
2.4.19-11
mips
2.4.17-0.020226.2.woody6
fixed soon
2.4.19-0.020911.8
mipsel
2.4.17-0.020226.2.woody6
2.4.25-0.040415.1
2.4.19-0.020911.9
We recommend that you upgrade your kernel packages immediately,
either with a Debian provided kernel or with a self compiled
one.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : perl
Vulnerability : information leak
Problem-Type : local
Debian-specific: no
CVE Ids : CAN-2003-0618
Paul Szabo discovered a number of similar bugs in suidperl, a
helper program to run perl scripts with setuid privileges. By
exploiting these bugs, an attacker could abuse suidperl to discover
information about files (such as testing for their existence and
some of their permissions) that should not be accessible to
unprivileged users.
DSA 431-1 incorporated a partial fix for this problem. This
advisory includes a more complete fix which corrects some
additional cases.
For the current stable distribution (woody) this problem has
been fixed in version 5.6.1-8.7.
For the unstable distribution, this problem has been fixed in
version 5.8.3-3.
We recommend that you update your perl package if you have the
"perl-suid" package installed.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : logcheck
Vulnerability : insecure temporary directory
Problem-Type : local
Debian-specific: no
CVE Ids : CAN-2004-0404
Christian Jaeger reported a bug in logcheck which could
potentially be exploited by a local user to overwrite files with
root privileges. logcheck utilized a temporary directory under
/var/tmp without taking security precautions. While this directory
is created when logcheck is installed, and while it exists there is
no vulnerability, if at any time this directory is removed, the
potential for exploitation exists.
For the current stable distribution (woody) this problem has
been fixed in version 1.1.1-13.1woody1.
For the unstable distribution (sid), this problem has been fixed
in version 1.1.1-13.2.
We recommend that you update your logcheck package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : neon
Vulnerability : format string
Problem-Type : remote
Debian-specific: no
CVE Ids : CAN-2004-0179
Multiple format string vulnerabilities were discovered in neon,
an HTTP and WebDAV client library. These vulnerabilities could
potentially be exploited by a malicious WebDAV server to execute
arbitrary code with the privileges of the process using
libneon.
For the current stable distribution (woody) these problems have
been fixed in version 0.19.3-2woody3.
For the unstable distribution (sid), these problems have been
fixed in version 0.24.5-1.
We recommend that you update your neon package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Package : cvs
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE Ids : CAN-2004-0180 CAN-2004-0405
Two vulnerabilities have been discovered and fixed in CVS:
CAN-2004-0180 - Sebastian Krahmer discovered a vulnerability
whereby a malicious CVS pserver could create arbitary files on the
client system during an update or checkout operation, by supplying
absolute pathnames in RCS diffs.
CAN-2004-0405 - Derek Robert Price discovered a vulnerability
whereby a CVS pserver could be abused by a malicious client to view
the contents of certain files outside of the CVS root directory
using relative pathnames containing "../".
For the current stable distribution (woody) these problems have
been fixed in version 1.11.1p1debian-9woody2.
For the unstable distribution (sid), these problems will be
fixed soon.
We recommend that you update your cvs package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
