Debian GNU/Linux
Debian Security Advisory DSA 1164-1 security@debian.org
http://www.debian.org/security/
Noah Meyerhans
August 31st, 2006 http://www.debian.org/security/faq
Package : sendmail
Vulnerability : programming error
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2006-4434
BugTraq ID : 19714
Debian Bug : 385054
A programming error has been discovered in sendmail, an
alternative mail transport agent for Debian, that could allow a
remote attacker to crash the sendmail process by sending a
specially crafted email message.
Please note that in order to install this update you also need
libsasl2 library from proposed updates as outlined in DSA
1155-2.
For the stable distribution (sarge) this problem has been fixed
in version 8.13.3-3sarge3
For the unstable distribution (sid) this problem has been fixed
in version 8.13.8-1
We recommend that you upgrade your sendmail package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge3.dsc
Size/MD5 checksum: 911
89bbdc6b7a1d33146d978408ac7feee2
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge3.diff.gz
Size/MD5 checksum: 385075
a1408b377f382dacfc7d87ef880af60b
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4.orig.tar.gz
Size/MD5 checksum: 1968047
d80dc659df96c63d227ed80c0c71b708
Architecture independent components:
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-base_8.13.4-3sarge3_all.deb
Size/MD5 checksum: 340668
0fd9a5ace798e807cbc60b7a31919a28
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-cf_8.13.4-3sarge3_all.deb
Size/MD5 checksum: 279382
1e8db425833f332fa8a525dc107e4614
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8.13.4-3sarge3_all.deb
Size/MD5 checksum: 692570
b07b9cfd99ee3bfe38feb62ec408d494
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.13.4-3sarge3_all.deb
Size/MD5 checksum: 192242
ce9a17d66058281af9d69563e11c910c
Alpha architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_alpha.deb
Size/MD5 checksum: 319082
223ecb915309c2f467fee4dc70dbb29a
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_alpha.deb
Size/MD5 checksum: 215652
ed63343a42038fdbf292d20e582a9fa3
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_alpha.deb
Size/MD5 checksum: 228890
8d087fceb3d923f4892d550419fe6f88
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_alpha.deb
Size/MD5 checksum: 953980
f50d2db2a52e150ec7466750a5e44bc5
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_alpha.deb
Size/MD5 checksum: 198182
af2d885e481c00326b2353a071df40b9
AMD64 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_amd64.deb
Size/MD5 checksum: 296634
6bd8032a3c89d24f918c544ec87794cc
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_amd64.deb
Size/MD5 checksum: 213268
41723080176c78d5f2cf1d5764bba131
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_amd64.deb
Size/MD5 checksum: 225344
27729b95e621ad6fc194e45c845268c7
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_amd64.deb
Size/MD5 checksum: 851254
4928097e8c69f01e33d29bd0e371e796
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_amd64.deb
Size/MD5 checksum: 197736
f5e2dde229ccd6457323c6d7dc746420
ARM architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_arm.deb
Size/MD5 checksum: 291974
abf756019dd7a2f75b3bc5c6fc858ec0
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_arm.deb
Size/MD5 checksum: 211618
bc7b0597b85aeedbd891d1782aea9b0f
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_arm.deb
Size/MD5 checksum: 223712
904f2d271dd078850291aa63fed9c077
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_arm.deb
Size/MD5 checksum: 829384
96686dd8dcd45be34f2f34f64222f558
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_arm.deb
Size/MD5 checksum: 197276
714fd487ba82221cf9261d61c833b20b
HP Precision architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_hppa.deb
Size/MD5 checksum: 301562
6991aa63aa29e3753ea4eda0e74004f6
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_hppa.deb
Size/MD5 checksum: 215700
cc89d2e0be9162c065467bfb3e5fc5e8
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_hppa.deb
Size/MD5 checksum: 229448
4ed50645b31de5c3b7747286a1de8ce9
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_hppa.deb
Size/MD5 checksum: 919852
50e486568dec792055f001172a38d45c
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_hppa.deb
Size/MD5 checksum: 198168
3802ef117e38733a991721a6e70167a5
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_i386.deb
Size/MD5 checksum: 287344
23bd405e21c9de501d7e8957ed5b2eae
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_i386.deb
Size/MD5 checksum: 211730
2edbe3c6b12742657071e43618211f97
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_i386.deb
Size/MD5 checksum: 222522
907a59032ba64011292bbff04e001409
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_i386.deb
Size/MD5 checksum: 812646
8dc795ba8ffc47659d95f727c20c4711
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_i386.deb
Size/MD5 checksum: 197428
64eab16e247f5ed9af468e2e804a3e53
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_ia64.deb
Size/MD5 checksum: 330754
6f32b98862faace5980f5a809acbdbf7
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_ia64.deb
Size/MD5 checksum: 220496
f94e024b1d70452c6e31aae8032c80cf
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_ia64.deb
Size/MD5 checksum: 239734
77b337f036edd22ffee5bcd26ccc53fd
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_ia64.deb
Size/MD5 checksum: 1162690
39b68375190c0ed7b7f6ec42cc08feb3
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_ia64.deb
Size/MD5 checksum: 199028
ac0d46969e6f38ba6ea9695ba012fb83
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_m68k.deb
Size/MD5 checksum: 272860
8b2a2e0cb36979ec484ae21ee7b952f3
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_m68k.deb
Size/MD5 checksum: 210922
2c80dc1697abb910900d9dea976e0111
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_m68k.deb
Size/MD5 checksum: 218922
63292f132b4c14935d66eafbd10c8b59
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_m68k.deb
Size/MD5 checksum: 728606
396de790dcc5135069bbb4374c27ae41
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_m68k.deb
Size/MD5 checksum: 197236
9241946b199056978336c255c072d348
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_mips.deb
Size/MD5 checksum: 293200
0e8866145d40f303d076b2529038bad3
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_mips.deb
Size/MD5 checksum: 212100
55ba2084a7d0b43994a8c983c11e08d8
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_mips.deb
Size/MD5 checksum: 227434
c559e338459cefee76c1a2ab3efc40e6
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_mips.deb
Size/MD5 checksum: 883544
29e2b015a7e86d0ef26a779b73e23c11
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_mips.deb
Size/MD5 checksum: 198194
3fd107d5b11c0b83d6894b360f5d2f2e
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_mipsel.deb
Size/MD5 checksum: 293842
787fb9e91e842e7f712396a8d585da95
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_mipsel.deb
Size/MD5 checksum: 212282
4e19166d5eb89e0d30dd0a632f0efba3
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_mipsel.deb
Size/MD5 checksum: 227590
aa971533751193be6b37b1616f321cad
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_mipsel.deb
Size/MD5 checksum: 886922
98ee38b69275c0dd03425316c8c288bc
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_mipsel.deb
Size/MD5 checksum: 198222
a04e73c2282781f36cd8323297f5d5b0
PowerPC architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_powerpc.deb
Size/MD5 checksum: 294438
1a5d40faaf7c440b9a37c808df4bd252
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_powerpc.deb
Size/MD5 checksum: 214504
ea3bd8e59d8d2a9987fde2a5bbc1073b
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_powerpc.deb
Size/MD5 checksum: 226918
25f3b5b6310e41eb0f151dfddc556caa
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_powerpc.deb
Size/MD5 checksum: 865018
88a5ffaa0bbc0c856c0402f9bc4a9479
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_powerpc.deb
Size/MD5 checksum: 197786
0959fe3b6f7e445abed6b5f2c9992684
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_s390.deb
Size/MD5 checksum: 295212
e6095777105434012463b4e3009cb332
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_s390.deb
Size/MD5 checksum: 213348
0bda9d806c5006edea39afecae1ad329
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_s390.deb
Size/MD5 checksum: 228722
90e47d3b0839b7ad337b29a3b212ee09
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_s390.deb
Size/MD5 checksum: 875318
9c6a10583814ce3ba0b0fcde1aab1893
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_s390.deb
Size/MD5 checksum: 197708
f03a2ce3e1d9644eef33a805e42f3705
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.13.4-3sarge3_sparc.deb
Size/MD5 checksum: 285462
76b0de0933652b1010ec2ac044b8081b
http://security.debian.org/pool/updates/main/s/sendmail/libmilter0_8.13.4-3sarge3_sparc.deb
Size/MD5 checksum: 211670
8fd780da99800d30ab26755790b37eb6
http://security.debian.org/pool/updates/main/s/sendmail/rmail_8.13.4-3sarge3_sparc.deb
Size/MD5 checksum: 222924
5cc657807e798fb6dfc6910c4d3c13ae
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-bin_8.13.4-3sarge3_sparc.deb
Size/MD5 checksum: 819536
232fadedc528ab4962c543796a277055
http://security.debian.org/pool/updates/main/s/sendmail/sensible-mda_8.13.4-3sarge3_sparc.deb
Size/MD5 checksum: 197440
a6775780418e0729d016ae80774b336d
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>
Mandriva Linux
Mandriva Linux Security Advisory MDKSA-2006:158
http://www.mandriva.com/security/
Package : MySQL
Date : August 31, 2006
Affected: 2006.0
Problem Description:
MySQL before 4.1.13 allows local users to cause a denial of
service (persistent replication slave crash) via a query with
multiupdate and subselects. (CVE-2006-4380)
There is a bug in the MySQL-Max (and MySQL) init script where
the script was not waiting for the mysqld daemon to fully stop.
This impacted the restart beahvior during updates, as well as
scripted setups that temporarily stopped the server to backup the
database files. (Bug #15724)
The Corporate 3 and MNF2 products are not affected by these
issues.
Packages have been patched to correct these issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4389
http://qa.mandriva.com/show_bug.cgi?id=15724
Updated Packages:
Mandriva Linux 2006.0:
493567c0514a9823ff00ad729a8bd465
2006.0/RPMS/libmysql14-4.1.12-4.8.20060mdk.i586.rpm
49e04e83e5494e5e649e347bd1afe926
2006.0/RPMS/libmysql14-devel-4.1.12-4.8.20060mdk.i586.rpm
94d9cd0ba5b17473feeb23d56b90c61b
2006.0/RPMS/MySQL-4.1.12-4.8.20060mdk.i586.rpm
445d926ba55cc764d19aacfd8fffabad
2006.0/RPMS/MySQL-bench-4.1.12-4.8.20060mdk.i586.rpm
0bffe1233e429c393dee9e60cc3e3f84
2006.0/RPMS/MySQL-client-4.1.12-4.8.20060mdk.i586.rpm
064949a85982662857c5f063d20769df
2006.0/RPMS/MySQL-common-4.1.12-4.8.20060mdk.i586.rpm
6bff9b2d2d6c06220eca96b97e63df52
2006.0/RPMS/MySQL-Max-4.1.12-4.8.20060mdk.i586.rpm
7ebcd09dd60b04e988156a241e2d5f18
2006.0/RPMS/MySQL-NDB-4.1.12-4.8.20060mdk.i586.rpm
d009b4c577873cc13f68dbc85bc792cd
2006.0/SRPMS/MySQL-4.1.12-4.8.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
d408fc51953b3aa78388ce09f47a8487
x86_64/2006.0/RPMS/lib64mysql14-4.1.12-4.8.20060mdk.x86_64.rpm
9145678262d216544c814ba7ceedac9d
x86_64/2006.0/RPMS/lib64mysql14-devel-4.1.12-4.8.20060mdk.x86_64.rpm
cb98cbb09991b13a1300c0446d8e3764
x86_64/2006.0/RPMS/MySQL-4.1.12-4.8.20060mdk.x86_64.rpm
f5db648daa13716b9ba1d910010a52f4
x86_64/2006.0/RPMS/MySQL-bench-4.1.12-4.8.20060mdk.x86_64.rpm
9cc2996dc0bcf73e054819880d2d780e
x86_64/2006.0/RPMS/MySQL-client-4.1.12-4.8.20060mdk.x86_64.rpm
3b79a86727bf12654c541a2c0b9b3d3c
x86_64/2006.0/RPMS/MySQL-common-4.1.12-4.8.20060mdk.x86_64.rpm
c8eefc94838cba03c03fd9493718b8bb
x86_64/2006.0/RPMS/MySQL-Max-4.1.12-4.8.20060mdk.x86_64.rpm
4f9e728df755920855f2ac93a3d66bfd
x86_64/2006.0/RPMS/MySQL-NDB-4.1.12-4.8.20060mdk.x86_64.rpm
d009b4c577873cc13f68dbc85bc792cd
x86_64/2006.0/SRPMS/MySQL-4.1.12-4.8.20060mdk.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
rPath Linux
rPath Security Advisory: 2006-0161-1
Published: 2006-08-30
Products: rPath Linux 1
Rating: Minor
Exposure Level Classification: Indirect User Deterministic
Unauthorized Access
Updated Versions:
libmusicbrainz=/conary.rpath.com@rpl:devel//1/2.1.4-0.1-1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4197
https://issues.rpath.com/browse/RPL-610
Description:
Previous versions of the libmusicbrainz package are vulnerable
to compromised or otherwise malicious servers, if a client attempts
to access the server. While this is a remote source of data, it
cannot be triggered directly by a remote attacker, and requires
explicit or implicit user complicity. It is therefore similar to
mail client IMAP parsing vulnerabilities.
rPath Security Advisory: 2006-0162-1
Published: 2006-08-31
Products: rPath Linux 1
Rating: Major
Exposure Level Classification: Local Root Deterministic Privilege
Escalation
Updated Versions:
kernel=/conary.rpath.com@rpl:devel//1/2.6.17.11-1-0.1
References:
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2935
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4145
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3745
https://issues.rpath.com/browse/RPL-611
https://issues.rpath.com/browse/RPL-524
Description:
Previous versions of the kernel package are subject to several
vulnerabilities. Certain malformed UDF filesystems can cause the
system to crash (denial of service). Malformed CDROM firmware or
USB storage devices (such as USB keys) could cause system crash
(denial of service), and if they were intentionally malformed, can
cause arbitrary code to run with elevated privileges. In addition,
the SCTP protocol is subject to a remote system crash (denial of
service) attack, but rPath Linux does not include the tools
required to configure the SCTP protocol, so rPath Linux is not
configured by default to be vulnerable to this attack.
This update requires a system reboot to implement the fixes.