dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Advisories, June 1, 2006

Jun 02, 2006, 04:45 (0 Talkback[s])

Debian GNU/Linux


Debian Security Advisory DSA 1085-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
June 1st, 2006 http://www.debian.org/security/faq


Package : lynx-ssl
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2004-1617 CAN-2005-3120
BugTraq ID : 11443
Debian Bug : 296340

Several vulnerabilities have been discoverd in lynx, the popular text-mode WWW browser. The Common Vulnerabilities and Exposures Project identifies the following vulnerabilities:

CVE-2004-1617

Michal Zalewski discovered that lynx is not able to grok invalid HTML including a TEXTAREA tag with a large COLS value and a large tag name in an element that is not terminated, and loops forever trying to render the broken HTML.

CAN-2005-3120

Ulf Härnhammar discovered a buffer overflow that can be remotely exploited. During the handling of Asian characters when connecting to an NNTP server lynx can be tricked to write past the boundary of a buffer which can lead to the execution of arbitrary code.

For the old stable distribution (woody) these problems have been fixed in version 2.8.5-2.5woody1.

For the stable distribution (sarge) these problems have been fixed in version 2.8.6-9sarge1.

For the unstable distribution (sid) these problems will be fixed soon.

We recommend that you upgrade your lynx-cur package.

Upgrade Instructions


wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given at the end of this advisory:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody


Source archives:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1.dsc
      Size/MD5 checksum: 640 e6f29a507e298508f72eb24c21b1bdde
    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1.diff.gz
      Size/MD5 checksum: 634446 19fad72695b064d6a6e893bb1ea1006f
    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5.orig.tar.gz
      Size/MD5 checksum: 2557113 81764528e685747ec00e7e23f18fd6d3

Architecture independent components:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur-wrapper_2.8.5-2.5woody1_all.deb
      Size/MD5 checksum: 161086 eec2317cf887d4d8762866c26b6783ad

Alpha architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_alpha.deb
      Size/MD5 checksum: 1419168 50e1763a404316ec33802c77f55180ee

ARM architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_arm.deb
      Size/MD5 checksum: 1292792 e922a7feefe43f2e0bff7713ed292403

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_i386.deb
      Size/MD5 checksum: 1252720 667586b0cb239a23efaa03a45e44ba41

Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_ia64.deb
      Size/MD5 checksum: 1573108 88a04e9032f61055812cbbdc5b66ebcc

HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_hppa.deb
      Size/MD5 checksum: 1361852 2cf253de737b654ee1cce1b13b43639a

Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_m68k.deb
      Size/MD5 checksum: 1212894 07b758555efaeff043595c2338dece95

Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_mips.deb
      Size/MD5 checksum: 1314946 b737ed585f45a69a19f2f5314509918b

Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_mipsel.deb
      Size/MD5 checksum: 1310968 a82a5f1be84d27067c9b63b8af540dd6

PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_powerpc.deb
      Size/MD5 checksum: 1299254 a5498c2256c092e2a8ebef012df0f4b2

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_s390.deb
      Size/MD5 checksum: 1271028 44125629519a455e212ae5397071e7bd

Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.5-2.5woody1_sparc.deb
      Size/MD5 checksum: 1297518 33c40521d500228c1973f4e67b424f40

Debian GNU/Linux 3.1 alias sarge


Source archives:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1.dsc
      Size/MD5 checksum: 667 af1fc2fa2f7673145760fe57c0aea8fb
    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1.diff.gz
      Size/MD5 checksum: 5605374 2deb21954ef7e8e39dfd26abdf1f2e64
    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6.orig.tar.gz
      Size/MD5 checksum: 3023366 02f47f32cb2b96ea5dc1bd335e19ef4a

Architecture independent components:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur-wrapper_2.8.6-9sarge1_all.deb
      Size/MD5 checksum: 12296 a615ca6b426011b3f40cd20ad48cb2cb

Alpha architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_alpha.deb
      Size/MD5 checksum: 2017328 ff45d271444be4f6560372dfb0b274b2

AMD64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_amd64.deb
      Size/MD5 checksum: 1901508 bb17d7c45e77910289765aec3f77c30c

ARM architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_arm.deb
      Size/MD5 checksum: 1871322 2555b982f070c91e00348370eaa48244

Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_i386.deb
      Size/MD5 checksum: 1876050 4dd3066564cd0fc919bc326c51686f26

Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_ia64.deb
      Size/MD5 checksum: 2155322 3736a40dd67ccba9a9f90e44f6a8ada7

HP Precision architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_hppa.deb
      Size/MD5 checksum: 1930998 6402a13b8834d92d2e01a306eb374d0f

Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_m68k.deb
      Size/MD5 checksum: 1797494 01b7c40f1acfcc91c2ac467c867503e9

Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_mips.deb
      Size/MD5 checksum: 1914628 87ae23a7369ea464d3840653ac1522b6

Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_mipsel.deb
      Size/MD5 checksum: 1911160 8cff5b755921183a11062644001e0759

PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_powerpc.deb
      Size/MD5 checksum: 1898106 e907c041632012ad322f3c701b6696cd

IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_s390.deb
      Size/MD5 checksum: 1886340 e2f640b6e388de70f160c6fe68dff134

Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/lynx-cur/lynx-cur_2.8.6-9sarge1_sparc.deb
      Size/MD5 checksum: 1878152 f0a57a2d5ac589bec4e7994bc3ac2030

These files will probably be moved into the stable distribution on its next update.


For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

Mandriva Linux


Mandriva Linux Security Advisory MDKSA-2006:094
http://www.mandriva.com/security/


Package : evolution
Date : June 1, 2006
Affected: 2006.0


Problem Description:

Evolution, as shipped in Mandriva Linux 2006.0, can crash displaying certain carefully crafted images, if the "Load images if sender is in address book" option in enabled in Edit | Preferences | Mail Preferences | HTML.

Packages have been patched to correct this issue.


References:

http://bugzilla.gnome.org/show_bug.cgi?id=311440


Updated Packages:

Mandriva Linux 2006.0:
75199e55e145d09497764b4143549ac4 2006.0/RPMS/evolution-2.2.3-10.1.20060mdk.i586.rpm
46edcf05163d0ee772cfcc3c1577dbf8 2006.0/RPMS/evolution-devel-2.2.3-10.1.20060mdk.i586.rpm
5aca2f9ce26cec6cd3a89f7aa599b904 2006.0/RPMS/evolution-pilot-2.2.3-10.1.20060mdk.i586.rpm
d326ae2751e8a3ddbdf4419885c83f51 2006.0/SRPMS/evolution-2.2.3-10.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
323551a68ef4d398fb81b74b417b55c9 x86_64/2006.0/RPMS/evolution-2.2.3-10.1.20060mdk.x86_64.rpm
20367f9039030077603899382d5980fa x86_64/2006.0/RPMS/evolution-devel-2.2.3-10.1.20060mdk.x86_64.rpm
e983bfa5ce3cde13610477fb8b377292 x86_64/2006.0/RPMS/evolution-pilot-2.2.3-10.1.20060mdk.x86_64.rpm
d326ae2751e8a3ddbdf4419885c83f51 x86_64/2006.0/SRPMS/evolution-2.2.3-10.1.20060mdk.src.rpm


To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com>

Red Hat Linux


Red Hat Security Advisory

Synopsis: Moderate: quagga security update
Advisory ID: RHSA-2006:0525-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0525.html
Issue date: 2006-06-01
Updated on: 2006-06-01
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-2223 CVE-2006-2224 CVE-2006-2276


1. Summary:

Updated quagga packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Quagga manages the TCP/IP based routing protocol. It takes a multi-server and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect Quagga configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an attacker is able to connect to the Quagga telnet interface, it is possible to cause Quagga to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain backported patches that correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

191080 - CVE-2006-2223 Quagga RIPd information disclosure
191084 - CVE-2006-2224 Quagga RIPd route injection
191376 - CVE-2006-2276 quagga locks with command sh ip bgp

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/quagga-0.96.2-11.3E.src.rpm
fcd880dd2f1f922e8dc02160a947ec1d quagga-0.96.2-11.3E.src.rpm

i386:
9161564a5722cb4bfe0ae7beb2b86057 quagga-0.96.2-11.3E.i386.rpm
34df55b9aab74f0dfa8dbb95318af308
quagga-debuginfo-0.96.2-11.3E.i386.rpm

ia64:
c44d0a382713b4c0af22df5c1caa6d26 quagga-0.96.2-11.3E.ia64.rpm
f8660048798bdc57c577b081fb1e39bb
quagga-debuginfo-0.96.2-11.3E.ia64.rpm

ppc:
22137d5727fe3fc6ec094c792735a6ac quagga-0.96.2-11.3E.ppc.rpm
21a0593e16f0cb55f9ebcfdc431cd594
quagga-debuginfo-0.96.2-11.3E.ppc.rpm

s390:
6b9f107b9c8e403cc70084e644047d60 quagga-0.96.2-11.3E.s390.rpm
45316c7dc06db75489f8cf534fb76d25
quagga-debuginfo-0.96.2-11.3E.s390.rpm

s390x:
23524c23823e5b2c5c936be3f924a2ba quagga-0.96.2-11.3E.s390x.rpm
4c22b6cd495766672968f874ad87a527
quagga-debuginfo-0.96.2-11.3E.s390x.rpm

x86_64:
8e752b034be7388f9487ccd502767699 quagga-0.96.2-11.3E.x86_64.rpm
5ce61ba937c19527617c9f2db2f817de
quagga-debuginfo-0.96.2-11.3E.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/quagga-0.96.2-11.3E.src.rpm
fcd880dd2f1f922e8dc02160a947ec1d quagga-0.96.2-11.3E.src.rpm

i386:
9161564a5722cb4bfe0ae7beb2b86057 quagga-0.96.2-11.3E.i386.rpm
34df55b9aab74f0dfa8dbb95318af308
quagga-debuginfo-0.96.2-11.3E.i386.rpm

ia64:
c44d0a382713b4c0af22df5c1caa6d26 quagga-0.96.2-11.3E.ia64.rpm
f8660048798bdc57c577b081fb1e39bb
quagga-debuginfo-0.96.2-11.3E.ia64.rpm

x86_64:
8e752b034be7388f9487ccd502767699 quagga-0.96.2-11.3E.x86_64.rpm
5ce61ba937c19527617c9f2db2f817de
quagga-debuginfo-0.96.2-11.3E.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0 quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2
quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee
quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18 quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565
quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24
quagga-devel-0.98.3-2.4E.ia64.rpm

ppc:
c5e07e8add5263b5d6fd48ca8f626f86 quagga-0.98.3-2.4E.ppc.rpm
23b66824e77246d0d66288c960d59e23
quagga-contrib-0.98.3-2.4E.ppc.rpm
18db7cc3db560be1606cff7285df7443 quagga-debuginfo-0.98.3-2.4E.ppc.rpm
08d3640a55e8c4324a3920f69520eaaa
quagga-devel-0.98.3-2.4E.ppc.rpm

s390:
046f86b73376db4020dbfb1e86035e68 quagga-0.98.3-2.4E.s390.rpm
9b98a6ede299736704f3d936f0b1d504
quagga-contrib-0.98.3-2.4E.s390.rpm
3ff1c0c9c283f58a8958859d4efadf2a quagga-debuginfo-0.98.3-2.4E.s390.rpm
0219dc67fd0a6ce68f872d8e3e4a4414
quagga-devel-0.98.3-2.4E.s390.rpm

s390x:
9bf4e48db2b520bc6b961439d83a7a93 quagga-0.98.3-2.4E.s390x.rpm
9c063760f39f25aad41268d84053fe71
quagga-contrib-0.98.3-2.4E.s390x.rpm
33f8fb06581e74361664c1e7a5afdcbf quagga-debuginfo-0.98.3-2.4E.s390x.rpm
a91489306834d2101f437082aa6204ad
quagga-devel-0.98.3-2.4E.s390x.rpm

x86_64:
3445db9b16c81b7949c292093447696e quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59
quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94 quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250
quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0 quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2
quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee
quagga-devel-0.98.3-2.4E.i386.rpm

x86_64:
3445db9b16c81b7949c292093447696e quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59
quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94 quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250
quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0 quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2
quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee
quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18 quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565
quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24
quagga-devel-0.98.3-2.4E.ia64.rpm

x86_64:
3445db9b16c81b7949c292093447696e quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59
quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94 quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250
quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0 quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2
quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee
quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18 quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565
quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24
quagga-devel-0.98.3-2.4E.ia64.rpm

x86_64:
3445db9b16c81b7949c292093447696e quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59
quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94 quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250
quagga-devel-0.98.3-2.4E.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2276 http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.


Red Hat Security Advisory

Synopsis: Moderate: zebra security update
Advisory ID: RHSA-2006:0533-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0533.html
Issue date: 2006-06-01
Updated on: 2006-06-01
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-2223 CVE-2006-2224 CVE-2006-2276


1. Summary:

Updated zebra packages that fix several security vulnerabilities are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64

3. Problem description:

GNU Zebra is a free software that manages TCP/IP based routing protocol.

An information disclosure flaw was found in the way GNU Zebra interprets RIP REQUEST packets. RIPd in GNU Zebra will respond to RIP REQUEST packets for RIP versions that have been disabled or that have authentication enabled, allowing a remote attacker to acquire information about the local network. (CVE-2006-2223)

A route injection flaw was found in the way GNU Zebra interprets RIPv1 RESPONSE packets when RIPv2 authentication is enabled. It is possible for a remote attacker to inject arbitrary route information into the RIPd routing tables. This issue does not affect GNU Zebra configurations where only RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in GNU Zebra's telnet interface. If an attacker is able to connect to the GNU Zebra telnet interface, it is possible to cause GNU Zebra to consume vast quantities of CPU resources by issuing a malformed 'sh' command. (CVE-2006-2276)

Users of GNU Zebra should upgrade to these updated packages, which contain backported patches that correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

192757 - CVE-2006-2224 zebra RIPd route injection
192758 - CVE-2006-2276 zebra locks with command sh ip bgp
192759 - CVE-2006-2223 zebra RIPd information disclosure

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/zebra-0.91a-11.21AS.src.rpm
b6e01074d122bd8b5c4058fb38b7fec9 zebra-0.91a-11.21AS.src.rpm

i386:
4d2926158a338aa627b941e3e03e9fbc zebra-0.91a-11.21AS.i386.rpm

ia64:
abb964bf1fe301e0faea7e05c4bd048f zebra-0.91a-11.21AS.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/zebra-0.91a-11.21AS.src.rpm
b6e01074d122bd8b5c4058fb38b7fec9 zebra-0.91a-11.21AS.src.rpm

ia64:
abb964bf1fe301e0faea7e05c4bd048f zebra-0.91a-11.21AS.ia64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2276
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.


Red Hat Security Advisory

Synopsis: Moderate: dia security update
Advisory ID: RHSA-2006:0541-02
Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0541.html
Issue date: 2006-06-01
Updated on: 2006-06-01
Product: Red Hat Enterprise Linux
CVE Names: CVE-2006-2453 CVE-2006-2480


1. Summary:

Updated Dia packages that fix several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The Dia drawing program is designed to draw various types of diagrams.

Several format string flaws were found in the way dia displays certain messages. If an attacker is able to trick a Dia user into opening a carefully crafted file, it may be possible to execute arbitrary code as the user running Dia. (CVE-2006-2453, CVE-2006-2480)

Users of Dia should update to these erratum packages, which contain backported patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

192698 - CVE-2006-2480 Dia format string issue (CVE-2006-2453)

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380 dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15 dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785
dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562 dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c
dia-debuginfo-0.94-5.7.1.ia64.rpm

ppc:
c468d0fda6ef02ef7ed3706701b5ef80 dia-0.94-5.7.1.ppc.rpm
6e913ed7eb05ff1764178822ab0ea249
dia-debuginfo-0.94-5.7.1.ppc.rpm

s390:
fb8026ab24b596855a59552f78efcc44 dia-0.94-5.7.1.s390.rpm
4159c13dca73903490b98499c5c60eb2
dia-debuginfo-0.94-5.7.1.s390.rpm

s390x:
aa3cd319dac56c3b8f423cda410eef53 dia-0.94-5.7.1.s390x.rpm
579389e8483e1b94e381c2801e17d752
dia-debuginfo-0.94-5.7.1.s390x.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8 dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110
dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380 dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15 dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785
dia-debuginfo-0.94-5.7.1.i386.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8 dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110
dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380 dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15 dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785
dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562 dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c
dia-debuginfo-0.94-5.7.1.ia64.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8 dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110
dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380 dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15 dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785
dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562 dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c
dia-debuginfo-0.94-5.7.1.ia64.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8 dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110
dia-debuginfo-0.94-5.7.1.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2480
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.

SUSE Linux


SUSE Security Announcement

Package: rug
Announcement ID: SUSE-SA:2006:029
Date: Wed, 31 May 2006 11:00:00 +0000
Affected Products: Novell Linux Desktop 9 SUSE SLES 9
Vulnerability Type: remote command execution
Severity (1-10): 10
SUSE Default Package: yes
Cross-References: CVE-2006-2703

Content of This Advisory:

  1. Security Vulnerability Resolved:
    • SSL man-in-the-middle attack
    • world-readable configuration file Problem Description
  2. Solution or Work-Around
  3. Special Instructions and Notes
  4. Package Location and Checksums
  5. Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE Security Summary Report.
  6. Authenticity Verification and Additional Information

1) Problem Description and Brief Discussion

RedCarpet allows the remote administration of systems by running the rc daemon (rcd) on the server side to accept SSL encrypted commands from the client.
The tool rug is such a client application that can be run from command-line. The client does not verify the SSL certificates received from the server and is therefore vulnerable to a man-in-the-middle attack which allows an attacker to read traffic and to insert commands.

Additionally the permissions of /etc/ximian/rcd.conf were changed to avoid the possible leakage of the rc password.

2) Solution or Work-Around

No work-around is known for the man-in-the-middle attack. The permissions of the configuration file can be changed using the chmod(1) command as root.

3) Special Instructions and Notes

Please restart the redcarpet daemon (rcd) after installing the update.

4) Package Location and Checksums

The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command

rpm -Fhv <file.rpm>

to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package.

Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web:

http://support.novell.com/cgi-bin/search/searchtid.cgi?psdb/2dfe32452eaf3613da33cce7326c9b95.html


5) Pending Vulnerabilities, Solutions, and Work-Arounds:

See SUSE Security Summary Report.


6) Authenticity Verification and Additional Information

  • Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file and run the command

    gpg --verify <file>

    replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like:

    gpg: Signature made <DATE> using RSA key ID 3D25D3D9
    gpg: Good signature from "SuSE Security Team <security@suse.de>"

    where <DATE> is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command

    gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  • Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with.

    There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or RPM package:

    1. Using the internal gpg signatures of the rpm package
    2. MD5 checksums as provided in this announcement
    1. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command

      rpm -v --checksig <file.rpm>

      to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build@suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement.

    2. If you need an alternative means of verification, use the md5sum

      command to verify the authenticity of the packages. Execute the command

      md5sum <filename.rpm>

      after you downloaded the file from a SUSE FTP server or its mirrors. Then compare the resulting md5sum with the one that is listed in the SUSE security announcement. Because the announcement containing the checksums is cryptographically signed (by security@suse.de), the checksums show proof of the authenticity of the package if the signature of the announcement is valid. Note that the md5 sums published in the SUSE Security Announcements are valid for the respective packages only. Newer versions of these packages cannot be verified.

  • SUSE runs two security mailing lists to which any interested party may subscribe:

        suse-security@suse.com

  • General Linux and SUSE security discussion.
    All SUSE security announcements are sent to this list. To subscribe, send an e-mail to

    <suse-security-subscribe@suse.com>.

        suse-security-announce@suse.com

  • SUSE's announce-only mailing list.
    Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to

    <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (FAQ), send mail to <suse-security-info@suse.com> or <suse-security-faq@suse.com>.


    SUSE's security contact is <security@suse.com> or <security@suse.de>.
    The <security@suse.de> public key is listed below.


The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text.

SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory.

Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>