Advisories: December 20, 2006

Gentoo Linux

Gentoo Linux Security Advisory GLSA 200612-19

http://security.gentoo.org/

Severity: Low
Title: pam_ldap: Authentication bypass vulnerability
Date: December 20, 2006
Bugs: #153916
ID: 200612-19

Synopsis

pam_ldap contains a vulnerability that may allow a remote user
with a locked account to gain unauthorized system access.

Background

pam_ldap is a Pluggable Authentication Module which allows
authentication against LDAP directories.

Affected packages

     Package            /  Vulnerable  /                    Unaffected

  1  sys-auth/pam_ldap        < 183                             >= 183

Steve Rigler discovered that pam_ldap does not correctly handle
“PasswordPolicyResponse” control responses from an LDAP directory.
This causes the pam_authenticate() function to always succeed, even
if the previous authentication failed.

Impact

A locked user may exploit this vulnerability to bypass the LDAP
authentication mechanism, possibly gaining unauthorized access to
the system.

Workaround

There is no known workaround at this time.

Resolution

All pam_ldap users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=sys-auth/pam_ldap-183"

References

[ 1 ] CVE-2006-5170

http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200612-19.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory GLSA 200612-20

http://security.gentoo.org/

Severity: Normal
Title: imlib2: Multiple vulnerabilities
Date: December 20, 2006
Bugs: #154216
ID: 200612-20

Synopsis

imlib2 contains several vulnerabilities that could lead to the
remote execution of arbitrary code or a Denial of Service.

Background

imlib2 is an advanced replacement for image manipulation
libraries such as libXpm. It is utilized by numerous programs,
including gkrellm and several window managers, to display
images.

Affected packages

     Package            /  Vulnerable  /                    Unaffected

  1  media-libs/imlib2       < 1.3.0                          >= 1.3.0

Description

M. Joonas Pihlaja discovered several buffer overflows in
loader_argb.c, loader_png.c, loaderlbm.c,
loader_jpeg.c, loadertiff.c, loader_tga.c, loader_pnm.c and
an out-of-bounds memory read access in loader_tga.c.

Impact

An attacker can entice a user to process a specially crafted
JPG, ARGB, PNG, LBM, PNM, TIFF, or TGA image with an “imlib2*”
binary or another application using the imlib2 libraries.
Successful exploitation of the buffer overflows causes the
execution of arbitrary code with the permissions of the user
running the application.

Workaround

There is no known workaround at this time.

Resolution

All imlib2 users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/imlib2-1.3.0"

References

[ 1 ] CVE-2006-4806

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4806

[ 2 ] CVE-2006-4807

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4807

[ 3 ] CVE-2006-4808

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4808

[ 4 ] CVE-2006-4809

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4809

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200612-20.xml

Concerns?

License

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory GLSA 200612-21

http://security.gentoo.org/

Severity: Normal
Title: Ruby: Denial of Service vulnerability
Date: December 20, 2006
Bugs: #157048
ID: 200612-21

Synopsis

The Ruby cgi.rb CGI library is vulnerable to a Denial of Service
attack.

Background

Ruby is a dynamic, open source programming language with a focus
on simplicity and productivity.

Affected packages

     Package        /  Vulnerable  /                        Unaffected

  1  dev-lang/ruby     < 1.8.5_p2                          >= 1.8.5_p2

Description

The read_multipart function of the CGI library shipped with Ruby
(cgi.rb) does not properly check boundaries in MIME multipart
content. This is a different issue than GLSA 200611-12.

Impact

The vulnerability can be exploited by sending the cgi.rb library
a crafted HTTP request with multipart MIME encoding that contains a
malformed MIME boundary specifier. Successful exploitation of the
vulnerability causes the library to go into an infinite loop.

Workaround

There is no known workaround at this time.

Resolution

All Ruby users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.5_p2"

References

[ 1 ] CVE-2006-6303

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6303

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200612-21.xml

Concerns?

License

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Mandriva Linux

Mandriva Linux Security Advisory MDKSA-2006:234
http://www.mandriva.com/security/

Package : mono
Date : December 20, 2006
Affected: 2007.0

Problem Description:

XSP (the Mono ASP.NET server) is vulnerable to source disclosure
attack which allow a malicious user to obtain the source code of
the server-side application. This vulnerability grants the attacker
deeper knowledge of the Web application logic.

Updated packages have been patched to correct this issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6104

Updated Packages:

Mandriva Linux 2007.0:
372cd7944c4ae044529132a60a0f4cba
2007.0/i586/jay-1.1.17.1-5.2mdv2007.0.i586.rpm
57586c9c8baff2fbe3c59c3529adc5a7
2007.0/i586/libmono-runtime-1.1.17.1-5.2mdv2007.0.i586.rpm
1cf0dcab116f59634f3890fab1cb46eb
2007.0/i586/libmono0-1.1.17.1-5.2mdv2007.0.i586.rpm
1898e4fc4e6f1c671c37a8d76814a89f
2007.0/i586/libmono0-devel-1.1.17.1-5.2mdv2007.0.i586.rpm
7dca6df31b2cac25df9d1568136ab8b3
2007.0/i586/mono-1.1.17.1-5.2mdv2007.0.i586.rpm
cb7c8cd1f5db165f31ea7e139d60fc75
2007.0/i586/mono-data-sqlite-1.1.17.1-5.2mdv2007.0.i586.rpm
73cfb46d15b9b0588f4013781d40a114
2007.0/i586/mono-doc-1.1.17.1-5.2mdv2007.0.i586.rpm
ddc633435f442f9436caec01d9796830
2007.0/SRPMS/mono-1.1.17.1-5.2mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
2b54bfd1164dd9c935b9af5c3297e90a
2007.0/x86_64/jay-1.1.17.1-5.2mdv2007.0.x86_64.rpm
6b137c021b3596699b22af6a8ef919fc
2007.0/x86_64/lib64mono0-1.1.17.1-5.2mdv2007.0.x86_64.rpm
8825990b27f3c66c2e225d483290b41d
2007.0/x86_64/lib64mono0-devel-1.1.17.1-5.2mdv2007.0.x86_64.rpm
a58792e500afc0a1f231a46ba7c8cf96
2007.0/x86_64/libmono-runtime-1.1.17.1-5.2mdv2007.0.x86_64.rpm
6030ac6e852551dea3f36dc2ab54ecb2
2007.0/x86_64/mono-1.1.17.1-5.2mdv2007.0.x86_64.rpm
baec0fa42850f91bb089317f62e5722c
2007.0/x86_64/mono-data-sqlite-1.1.17.1-5.2mdv2007.0.x86_64.rpm
72d633232728911fc9fa428ab3af582f
2007.0/x86_64/mono-doc-1.1.17.1-5.2mdv2007.0.x86_64.rpm
ddc633435f442f9436caec01d9796830
2007.0/SRPMS/mono-1.1.17.1-5.2mdv2007.0.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.

All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>

Ubuntu

Ubuntu Security Notice USN-397-1 December 20, 2006
mono vulnerability
CVE-2006-6104

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:

mono-classlib-1.0 1.1.13.6-0ubuntu3.2
mono-classlib-2.0 1.1.13.6-0ubuntu3.2

Ubuntu 6.10:

libmono-system-web1.0-cil 1.1.17.1-1ubuntu7.1
libmono-system-web2.0-cil 1.1.17.1-1ubuntu7.1

After a standard system upgrade you need to restart any mono web
applications to effect the necessary changes.

Details follow:

Jose Ramon Palanco discovered that the mono System.Web class did
not consistently verify local file paths. As a result, the source
code for mono web applications could be retrieved remotely,
possibly leading to further compromise via the application’s
source.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono_1.1.13.6-0ubuntu3.2.diff.gz

Size/MD5: 48871
95da1c90d723f6849f6996a12a60cbc6
http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono_1.1.13.6-0ubuntu3.2.dsc

Size/MD5: 1047
21557fc891cfdb0a9af47451010c218a
http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono_1.1.13.6.orig.tar.gz

Size/MD5: 18217583
330cc66c6a44525950daf10c4f17c10e

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono-assemblies-base_1.1.13.6-0ubuntu3.2_all.deb

Size/MD5: 42032
11c561430b9d35ebc4c62f5d8982250e
http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono-classlib-1.0-dbg_1.1.13.6-0ubuntu3.2_all.deb

Size/MD5: 3794836
6d7e9dad1a8f98a9e5c9fc704148cc53
http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono-classlib-1.0_1.1.13.6-0ubuntu3.2_all.deb

Size/MD5: 4560128
21602e7ff91b1f711873011ed7d87f66
http://security.ubuntu.com/ubuntu/pool/universe/m/mono/mono-classlib-2.0-dbg_1.1.13.6-0ubuntu3.2_all.deb

Size/MD5: 4568456
9c30b6dcba099ea96eb4f9e8c618a3cc
http://security.ubuntu.com/ubuntu/pool/main/m/mono/mono-classlib-2.0_1.1.13.6-0ubuntu3.2_all.deb