Home Security

Advisories: December 21, 2006

By

December 22, 2006

Debian GNU/Linux

Debian Security Advisory DSA-1240-1 security@debian.org
http://www.debian.org/security/
Steve Kemp
December 21, 2006

Package : links2
Vulnerability : insufficient escaping
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2006-5925
Debian Bug : 400718

Teemu Salmela discovered that the links2 character mode web
browser performs insufficient sanitising of smb:// URIs, which
might lead to the execution of arbitrary shell commands.

For the stable distribution (sarge) this problem has been fixed
in version 2.1pre16-1sarge1.

For the upcoming stable distribution (etch) this problem has
been fixed in version 2.1pre26-1.

For the unstable distribution (sid) this problem has been fixed
in version 2.1pre26-1.

We recommend that you upgrade your links2 package.

Upgrade instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 3.1 (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386,
ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1.diff.gz

Size/MD5 checksum: 28658
a83c79990bbfb6f9ec26d737f767ee90
http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16.orig.tar.gz

Size/MD5 checksum: 4217483
7baf4fc20cc244d80ead21cebff07d89
http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1.dsc

Size/MD5 checksum: 841
ed4853334b7eebef055271df06cdcd7a

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_alpha.deb

Size/MD5 checksum: 2110324
b3633fddb199c45339d3837bb0a519a0

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_amd64.deb

Size/MD5 checksum: 2040922
5fb402e6a833709741d20238346c7597

arm architecture (ARM)

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_arm.deb

Size/MD5 checksum: 1996004
c7c79ddcb82d5758668ed71d74b9685f

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_i386.deb

Size/MD5 checksum: 1997426
4c1ef611e31c57583f7471653962a84a

m68k architecture (Motorola Mc680x0)

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_m68k.deb

Size/MD5 checksum: 1904084
e5c777a07eaa88f4367b51d88c556a14

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_mips.deb

Size/MD5 checksum: 2034596
22854de6eaf3aa1e392291760e85e5e8

These files will probably be moved into the stable distribution
on its next update.

For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>

Fedora Core

Fedora Update Notification
FEDORA-2006-1491
2006-12-20

Product : Fedora Core 6
Name : thunderbird
Version : 1.5.0.9
Release : 2.fc6
Summary : Mozilla Thunderbird mail/newsgroup client

Description :
Mozilla Thunderbird is a standalone mail and newsgroup client.

Update Information:

Mozilla Thunderbird is a standalone mail and newsgroup
client.

Several flaws were found in the way Thunderbird processes
certain malformed JavaScript code. A malicious web page could cause
the execution of JavaScript code in such a way that could cause
Thunderbird to crash or execute arbitrary code as the user running
Thunderbird. JavaScript support is disabled by default in
Thunderbird; this issue is not exploitable without enabling
JavaScript. (CVE-2006-6498, CVE-2006-6501, CVE-2006-6502,
CVE-2006-6503, CVE-2006-6504)

Several flaws were found in the way Thunderbird renders web
pages. A malicious web page could cause the browser to crash or
possibly execute arbitrary code as the user running Thunderbird.
(CVE-2006-6497)

A heap based buffer overflow flaw was found in the way
Thunderbird parses the Content-Type mail header. A malicious mail
message could cause the Thunderbird client to crash or possibly
execute arbitrary code as the user running Thunderbird.
(CVE-2006-6505)

Users of Thunderbird are advised to apply this update, which
contains Thunderbird version 1.5.0.9 that corrects these
issues.

Tue Dec 19 2006 Matthias Clasen <mclasen@redhat.com>
1.5.0.9-2
- Add a Requires: launchmail (#219884)
Tue Dec 19 2006 Christopher Aillon <caillon@redhat.com>
1.5.0.9-1
- Update to 1.5.0.9
- Take firefox’s pango fixes
- Don’t offer to import…nothing.

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/

b412bd483c481eb2adcb833db850a36c333978bf
SRPMS/thunderbird-1.5.0.9-2.fc6.src.rpm
b412bd483c481eb2adcb833db850a36c333978bf
noarch/thunderbird-1.5.0.9-2.fc6.src.rpm
5c371d13b3209d5507448e9ebe9078521deac5fe
ppc/debug/thunderbird-debuginfo-1.5.0.9-2.fc6.ppc.rpm
a44fb695adca3b8addda5c1331a44aeea1825fb1
ppc/thunderbird-1.5.0.9-2.fc6.ppc.rpm
3cd6cc302db68faa3b1e2505820161fcc6af8efc
x86_64/debug/thunderbird-debuginfo-1.5.0.9-2.fc6.x86_64.rpm
3452f2cb4e52493ed7ccd23adae523721a3e7c63
x86_64/thunderbird-1.5.0.9-2.fc6.x86_64.rpm
c13038e3e9c6615e5b9896fc0c979a5535d7ea49
i386/debug/thunderbird-debuginfo-1.5.0.9-2.fc6.i386.rpm
ab9a4abdbad15b2e26b60e112331e5cc2741d1d5
i386/thunderbird-1.5.0.9-2.fc6.i386.rpm

Fedora Update Notification
FEDORA-2006-1492
2006-12-20

Product : Fedora Core 6
Name : firefox
Version : 1.5.0.9
Release : 1.fc6
Summary : Mozilla Firefox Web browser.

Description :
Mozilla Firefox is an open-source web browser, designed for
standards compliance, performance and portability.

Update Information:

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processes certain
malformed JavaScript code. A malicious web page could cause the
execution of JavaScript code in such a way that could cause Firefox
to crash or execute arbitrary code as the user running Firefox.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503,
CVE-2006-6504)

Several flaws were found in the way Firefox renders web pages. A
malicious web page could cause the browser to crash or possibly
execute arbitrary code as the user running Firefox.
(CVE-2006-6497)

Users of Firefox are advised to upgrade to these erratum
packages, which contain Firefox version 1.5.0.9 that corrects these
issues.

Tue Dec 19 2006 Christopher Aillon <caillon@redhat.com>
1.5.0.9-1
- Update to 1.5.0.9
Tue Dec 5 2006 Christopher Aillon <caillon@redhat.com>
1.5.0.8-2
- Updated pango patches from behdad
- Fix a leak in liveconnect
- Fix a potential crash in CSS
- Let Firefox handle gcc warnings; it weeds out frequent
  offenders.

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/

e1fe5ef2c1156a06026b08a9023c05c0f43fd375
SRPMS/firefox-1.5.0.9-1.fc6.src.rpm
e1fe5ef2c1156a06026b08a9023c05c0f43fd375
noarch/firefox-1.5.0.9-1.fc6.src.rpm
0e1d89ab8417844327bf5a503e44eabed4b2989d
ppc/debug/firefox-debuginfo-1.5.0.9-1.fc6.ppc.rpm
4d7214e03d8db9f236073bed272f584f70217c05
ppc/firefox-devel-1.5.0.9-1.fc6.ppc.rpm
212166e344557d93cd340a52f246d7f17e28ac93
ppc/firefox-1.5.0.9-1.fc6.ppc.rpm
ca2fb6249c633971b319363b5940702a4049fe71
x86_64/firefox-devel-1.5.0.9-1.fc6.x86_64.rpm
da7254f374f59aba18d466f025c7145181ba6c9b
x86_64/debug/firefox-debuginfo-1.5.0.9-1.fc6.x86_64.rpm
cfd3064e23d4c97c8bf0167c323b5163d2df97a0
x86_64/firefox-1.5.0.9-1.fc6.x86_64.rpm
03cc7fcdd387fa443b7d2e2b2e199c5af1e98ffd
i386/firefox-devel-1.5.0.9-1.fc6.i386.rpm
1b01573757dfddb260ce4a6f3e3e4e7e2e261f79
i386/debug/firefox-debuginfo-1.5.0.9-1.fc6.i386.rpm
156f9deca5f95a0dbd6770a11ddab7ecb88b6c29
i386/firefox-1.5.0.9-1.fc6.i386.rpm

This update can be installed with the ‘yum’ update program. Use
‘yum update package-name’ at the command line. For more
information, refer to ‘Managing Software with yum,’ available at
http://fedora.redhat.com/docs/yum/.

Fedora Update Notification
FEDORA-2006-1492
2006-12-20

Product : Fedora Core 6
Name : epiphany
Version : 2.16.2
Release : 1.fc6
Summary : GNOME web browser based on the Mozilla rendering
engine

Description :
epiphany is a simple GNOME web browser based on the Mozilla
rendering engine

Update Information:

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processes certain
malformed JavaScript code. A malicious web page could cause the
execution of JavaScript code in such a way that could cause Firefox
to crash or execute arbitrary code as the user running Firefox.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503,
CVE-2006-6504)

Several flaws were found in the way Firefox renders web pages. A
malicious web page could cause the browser to crash or possibly
execute arbitrary code as the user running Firefox.
(CVE-2006-6497)

Users of Firefox are advised to upgrade to these erratum
packages, which contain Firefox version 1.5.0.9 that corrects these
issues.

Wed Dec 20 2006 Christopher Aillon <caillon@redhat.com> –
2.16.2-1
- Update to 2.16.2
Tue Dec 19 2006 Christopher Aillon <caillon@redhat.com> –
2.16.0-6.fc6
- Rebuild against newer gecko

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/

bfb64e1c0e2259a474e2199f2656b11d3bb7027e
SRPMS/epiphany-2.16.2-1.fc6.src.rpm
bfb64e1c0e2259a474e2199f2656b11d3bb7027e
noarch/epiphany-2.16.2-1.fc6.src.rpm
de3f1c790567b744101e8bc5f1746e7dfa3dc2a2
ppc/debug/epiphany-debuginfo-2.16.2-1.fc6.ppc.rpm
b1ce27f3ffa935bb993861c794dcfd8d366a50c4
ppc/epiphany-devel-2.16.2-1.fc6.ppc.rpm
f49b97d088b52b7df01cb0f230eb2cee82661c66
ppc/epiphany-2.16.2-1.fc6.ppc.rpm
6cdec2f4dab14b62a028466309539d2bbf64fb40
x86_64/debug/epiphany-debuginfo-2.16.2-1.fc6.x86_64.rpm
d7d66e5ba8f049d8729c6923917421c558907068
x86_64/epiphany-devel-2.16.2-1.fc6.x86_64.rpm
3bad04377ec66504a2431fd017d11cdb62ce0062
x86_64/epiphany-2.16.2-1.fc6.x86_64.rpm
f62e4c0125d73e321a242664347afb8973d3fb00
i386/epiphany-devel-2.16.2-1.fc6.i386.rpm
819bcbed453d82a275410d358cefee62361ca4e0
i386/epiphany-2.16.2-1.fc6.i386.rpm
592eb14f22e58455c0fc9f245cc58d65ce5d8b7a
i386/debug/epiphany-debuginfo-2.16.2-1.fc6.i386.rpm

This update can be installed with the ‘yum’ update program. Use
‘yum update package-name’ at the command line. For more
information, refer to ‘Managing Software with yum,’ available at
http://fedora.redhat.com/docs/yum/.

Fedora Update Notification
FEDORA-2006-1492
2006-12-20

Product : Fedora Core 6
Name : yelp
Version : 2.16.0
Release : 11.fc6
Summary : A system documentation reader from the Gnome project

Description :
Yelp is the Gnome 2 help/documentation browser. It is designed to
help you browse all the documentation on your system in one central
tool.

Update Information:

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processes certain
malformed JavaScript code. A malicious web page could cause the
execution of JavaScript code in such a way that could cause Firefox
to crash or execute arbitrary code as the user running Firefox.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503,
CVE-2006-6504)

Several flaws were found in the way Firefox renders web pages. A
malicious web page could cause the browser to crash or possibly
execute arbitrary code as the user running Firefox.
(CVE-2006-6497)

Users of Firefox are advised to upgrade to these erratum
packages, which contain Firefox version 1.5.0.9 that corrects these
issues.

Tue Dec 19 2006 Christopher Aillon <caillon@redhat.com> –
2.16.0-11
- Rebuild against newer gecko

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/

183f2de75fe16962db17e666ba0b36ee648b9355
SRPMS/yelp-2.16.0-11.fc6.src.rpm
183f2de75fe16962db17e666ba0b36ee648b9355
noarch/yelp-2.16.0-11.fc6.src.rpm
88c500ae9103b82c47c75c3a2f1b408400fd2faf
ppc/debug/yelp-debuginfo-2.16.0-11.fc6.ppc.rpm
ec7fb22ad53b07aef32b950bd4f3a2ed8c73f356
ppc/yelp-2.16.0-11.fc6.ppc.rpm
959e77abffcb43f203c166c28d24d468b92524e3
x86_64/yelp-2.16.0-11.fc6.x86_64.rpm
d04302edda30276d48ed30da14f4129bec78a06c
x86_64/debug/yelp-debuginfo-2.16.0-11.fc6.x86_64.rpm
42050ae7cbcb794a41251fb2160cc42c57d04327
i386/debug/yelp-debuginfo-2.16.0-11.fc6.i386.rpm
94f99544a2851cd4189bd72ee0f5d6c2853e895c
i386/yelp-2.16.0-11.fc6.i386.rpm

This update can be installed with the ‘yum’ update program. Use
‘yum update package-name’ at the command line. For more
information, refer to ‘Managing Software with yum,’ available at
http://fedora.redhat.com/docs/yum/.

Fedora Update Notification
FEDORA-2006-1492
2006-12-20

Product : Fedora Core 6
Name : devhelp
Version : 0.12
Release : 9.fc6
Summary : API document browser

Description :
An API document browser for GNOME 2.

Update Information:

Mozilla Firefox is an open source Web browser.

Several flaws were found in the way Firefox processes certain
malformed JavaScript code. A malicious web page could cause the
execution of JavaScript code in such a way that could cause Firefox
to crash or execute arbitrary code as the user running Firefox.
(CVE-2006-6498, CVE-2006-6501, CVE-2006-6502, CVE-2006-6503,
CVE-2006-6504)

Several flaws were found in the way Firefox renders web pages. A
malicious web page could cause the browser to crash or possibly
execute arbitrary code as the user running Firefox.
(CVE-2006-6497)

Users of Firefox are advised to upgrade to these erratum
packages, which contain Firefox version 1.5.0.9 that corrects these
issues.

Tue Dec 19 2006 Christopher Aillon <caillon@redhat.com> –
0.12.6-9
- Rebuild against newer gecko

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/6/

8fbd10b55a44b7bb837ae1a1dc936b5696798985
SRPMS/devhelp-0.12-9.fc6.src.rpm
8fbd10b55a44b7bb837ae1a1dc936b5696798985
noarch/devhelp-0.12-9.fc6.src.rpm
9145f6ab2a9db597b8c9fb092a7b7336cb89271f
ppc/devhelp-0.12-9.fc6.ppc.rpm
62c7587c16a67bcc2cd8acd11eec6bb6546bbaeb
ppc/debug/devhelp-debuginfo-0.12-9.fc6.ppc.rpm
1631279a8f62e5f09728b48fcee70fc9e65d76dd
ppc/devhelp-devel-0.12-9.fc6.ppc.rpm
9fe76c4f5a4638693d61a28aa5ee7b051072c37f
x86_64/devhelp-devel-0.12-9.fc6.x86_64.rpm
eb78f0a80e8e0197742028836e6264555b5a6f45
x86_64/debug/devhelp-debuginfo-0.12-9.fc6.x86_64.rpm
5a1846f7041c2ce38a87276f936b53813410f207
x86_64/devhelp-0.12-9.fc6.x86_64.rpm
518318082d487d40607080a9489c327e04e2df90
i386/devhelp-0.12-9.fc6.i386.rpm
3e5edd56ddc8c7d441502cef5bc59848dffff390
i386/devhelp-devel-0.12-9.fc6.i386.rpm
96d5ef6f0d226be48029c186721ce45f18b27aca
i386/debug/devhelp-debuginfo-0.12-9.fc6.i386.rpm

This update can be installed with the ‘yum’ update program. Use
‘yum update package-name’ at the command line. For more
information, refer to ‘Managing Software with yum,’ available at
http://fedora.redhat.com/docs/yum/.

SUSE Linux

SUSE Security Announcement

Package: kernel
Announcement ID: SUSE-SA:2006:079
Date: Thu, 21 Dec 2006 14:00:00 +0000
Affected Products: Novell Linux Desktop 9 Novell Linux POS 9 Open
Enterprise Server SUSE LINUX 10.1 SUSE LINUX 10.0 SUSE LINUX 9.3
SUSE SLED 10 SUSE SLES 10 SUSE SLES 9
Vulnerability Type: remote denial of service local denial of
service local privilege escalation
Severity (1-10): 7
SUSE Default Package: yes
Cross-References: CVE-2006-3741, CVE-2006-4145, CVE-2006-4538
CVE-2006-4572, CVE-2006-4623, CVE-2006-4813 CVE-2006-4997,
CVE-2006-5173, CVE-2006-5174 CVE-2006-5619, CVE-2006-5648,
CVE-2006-5649 CVE-2006-5751, CVE-2006-5757, CVE-2006-5823
CVE-2006-6053, CVE-2006-6054, CVE-2006-6056 CVE-2006-6060

Content of This Advisory:

Security Vulnerability Resolved: various kernel security
problems Problem Description
Solution or Work-Around
Special Instructions and Notes
Package Location and Checksums
Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE
Security Summary Report.
Authenticity Verification and Additional Information

1) Problem Description and Brief Discussion

The Linux 2.6 kernel has been updated to fix various security
issues.

On SUSE Linux Enterprise Server 9 and SUSE Linux Enterprise 10
and their derived products this update also contains various
bugfixes.

CVE-2006-4145: A bug within the UDF filesystem that caused
machine hangs when truncating files on the filesystem was
fixed.
CVE-2006-4623: A problem in DVB packet handling could be used
to crash the machine when receiving DVB net packages is
active.
CVE-2006-3741: A struct file leak was fixed in the perfmon(2)
system call on the Itanium architecture.
CVE-2006-4538: A malformed ELF image can be used on the Itanium
architecture to trigger a kernel crash (denial of service) when a
local attacker can supply it to be started.
CVE-2006-4997: A problem in the ATM protocol handling clip_mkip
function could be used by remote attackers to potentially crash the
machine.
CVE-2006-5757/ CVE-2006-6060: A problem in the grow_buffers
function could be used to crash or hang the machine using a
corrupted filesystem. This affects filesystem types ISO9660 and
NTFS.
CVE-2006-5173: On the i386 architecture the EFLAGS content was
not correctly saved, which could be used by local attackers to
crash other programs using the AC and NT flag or to escalate
privileges by waiting for iopl privileges to be leaked.
CVE-2006-5174: On the S/390 architecture copy_from_user() could
be used by local attackers to read kernel memory.
CVE-2006-5619: A problem in IPv6 flow label handling can be
used by local attackers to hang the machine.
CVE-2006-5648: On the PowerPC architecture a syscall has been
wired without the proper futex implementation that can be exploited
by a local attacker to hang the machine.
CVE-2006-5649: On the PowerPC architecture the proper futex
implementation was missing a fix for alignment check which could be
used by a local attacker to crash the machine.
CVE-2006-5823: A problem in cramfs could be used to crash the
machine during mounting a crafted cramfs image. This requires an
attacker to supply such a crafted image and have a user mount
it.
CVE-2006-6053: A problem in the ext3 filesystem could be used
by attackers able to supply a crafted ext3 image to cause a denial
of service or further data corruption if a user mounts this
image.
CVE-2006-6054: A problem in the ext2 filesystem could be used
by attackers supplying crafted ext2 images to users could crash the
machine during mount.
CVE-2006-6056: Missing return code checking in the HFS could be
used to crash machine when a user complicit attacker is able to
supply a specially crafted HFS image.
CVE-2006-4572: Multiple unspecified vulnerabilities in
netfilter for IPv6 code allow remote attackers to bypass intended
restrictions via fragmentation attack vectors, aka (1) “ip6_tables
protocol bypass bug” and (2) “ip6_tables extension header bypass
bug”.
CVE-2006-5751: An integer overflow in the networking bridge
ioctl starting with Kernel 2.6.7 could be used by local attackers
to overflow kernel memory buffers and potentially escalate
privileges.
CVE-2006-4813: A information leak in __block_prepare_write was
fixed, which could disclose private information of previously
unlinked files.

2) Solution or Work-Around

There is no known workaround, please install the update
packages.

3) Special Instructions and Notes

Reboot the machine after installing this update.

4) Package Location and Checksums

The preferred method for installing security updates is to use
the YaST Online Update (YOU) tool. YOU detects which updates are
required and automatically performs the necessary steps to verify
and install them. Alternatively, download the update packages for
your distribution manually and verify their integrity by the
methods listed in Section 6 of this announcement. Then install the
packages using the command

rpm -Fhv <file.rpm>

to apply the update, replacing <file.rpm> with the
filename of the downloaded RPM package.

x86 Platform: