Advisories, January 26, 2006

Debian GNU/Linux

Debian Security Advisory DSA 947-2 security@debian.org
http://www.debian.org/security/
Michael Stone
January 25th, 2006 http://www.debian.org/security/faq

Package : clamav
Vulnerability : heap overflow
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2006-0162
Debian Bug : 320014

A heap overflow has been discovered in ClamAV, a virus scanner,
which could allow an attacker to execute arbitrary code by sending
a carefully crafted UPX-encoded executable to a system runnig
ClamAV. In addition, other potential overflows have been
corrected.

Packages for the ARM architecture were not available when DSA
947-1 was released; these packages are now available. Also, DSA
947-1 incorrectly identified the package version which corrected
these issues in the unstable distribution (sid).

The old stable distribution (woody) does not include ClamAV.

For the stable distribution (sarge) this problem has been fixed
in version 0.84-2.sarge.7.

For the unstable distribution (sid) this problem has been fixed
in version 0.88-1.

We recommend that you upgrade your clamav package
immediately.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

ARM architecture:

http://security.debian.org/pool/updates/main/c/clamav/clamav_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 63830
8fcc1f60dffe350cc1138f5217992032
http://security.debian.org/pool/updates/main/c/clamav/clamav-daemon_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 39510
10528078333fbf18bfc3a200d23b977b
http://security.debian.org/pool/updates/main/c/clamav/clamav-freshclam_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 2171192
d45c061628d87b24bab8516564d7e1c0
http://security.debian.org/pool/updates/main/c/clamav/clamav-milter_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 37310
abd9c3c02bf89e8eea072d66f01363eb
http://security.debian.org/pool/updates/main/c/clamav/libclamav-dev_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 174662
2f8277ebe9debd8bf8c997e66999cf82
http://security.debian.org/pool/updates/main/c/clamav/libclamav1_0.84-2.sarge.7_arm.deb

Size/MD5 checksum: 249490
e766e1d75c97b14b086ce0413b2c9cac

These files will probably be moved into the stable distribution
on its next update.

Debian Security Advisory DSA 954-1 security@debian.org
http://www.debian.org/security/
Moritz Muehlenhoff
January 25th, 2006 http://www.debian.org/security/faq

Package : wine
Vulnerability : design flaw
Problem-Type : local (remote)
Debian-specific: no
CVE ID : CVE-2006-0106
Debian Bug : 346197

H D Moore that discovered that Wine, a free implemention of the
Microsoft Windows APIs, inherits a design flaw from the Windows GDI
API, which may lead to the execution of code through GDI escape
functions in WMF files.

The old stable distribution (woody) does not seem to be affected
by this problem.

For the stable distribution (sarge) this problem has been fixed
in version 0.0.20050310-1.2.

For the unstable distribution (sid) this problem has been fixed
in version 0.9.2-1.

We recommend that you upgrade your wine packages.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

http://security.debian.org/pool/updates/main/w/wine/wine_0.0.20050310-1.2.dsc

Size/MD5 checksum: 1321
7955ea0c5382fb0bb4649e07ed82f973
http://security.debian.org/pool/updates/main/w/wine/wine_0.0.20050310-1.2.diff.gz

Size/MD5 checksum: 47563
1973d7684bc3accf3c2eb1f4fa3b80be
http://security.debian.org/pool/updates/main/w/wine/wine_0.0.20050310.orig.tar.gz

Size/MD5 checksum: 11798040
d90d31716ba71211af26ac773934f57e

Architecture independent components:

http://security.debian.org/pool/updates/main/w/wine/wine-doc_0.0.20050310-1.2_all.deb

Size/MD5 checksum: 1780636
c78163bfadc872ca47b19c382f360bf2

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/w/wine/libwine_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 8069792
90ae35746250507071ca6e8d43d9e647
http://security.debian.org/pool/updates/main/w/wine/libwine-alsa_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1128766
38cee9eecc78832a9f8e83385f599d0f
http://security.debian.org/pool/updates/main/w/wine/libwine-arts_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1105648
626dbf5ed914d7dfd080a826b275ebf6
http://security.debian.org/pool/updates/main/w/wine/libwine-capi_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1094760
10c2c64aee60e0473c61f07de3e772f9
http://security.debian.org/pool/updates/main/w/wine/libwine-dev_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 2530646
7d1bc36dbb1dfa57d816ba24e135eadd
http://security.debian.org/pool/updates/main/w/wine/libwine-jack_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1107820
77e61796adc46f530219502b37e0a86c
http://security.debian.org/pool/updates/main/w/wine/libwine-nas_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1102382
af5ef1acdceb8ea0863abd3e6041c825
http://security.debian.org/pool/updates/main/w/wine/libwine-print_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1202416
e504f2d0cdd5f5f0187b0c44abbfdcae
http://security.debian.org/pool/updates/main/w/wine/libwine-twain_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1104750
4edd3e88a7ae7f4e0dc9a42d127a1de2
http://security.debian.org/pool/updates/main/w/wine/wine_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1299408
dbf86414fc89653b4d910d282733e09b
http://security.debian.org/pool/updates/main/w/wine/wine-utils_0.0.20050310-1.2_i386.deb

Size/MD5 checksum: 1659130
7ba1ce62ec17663f390d8b1ea2b45d63

These files will probably be moved into the stable distribution
on its next update.

Debian Security Advisory DSA 955-1 security@debian.org
http://www.debian.org/security/
Michael Stone
January 25th, 2006 http://www.debian.org/security/faq

Package : clamav
Vulnerability : DoS
Problem type : remote
Debian-specific: no
CVE IDs : CVE-2005-3573, CVE-2005-4153
Debian Bug : 339095, 326024

Two denial of service bugs were found in the mailman list
server. In one, attachment filenames containing UTF8 strings were
not properly parsed, which could cause the server to crash. In
another, a message containing a bad date string could cause a
server crash.

The old stable distribution (woody) is not vulnerable to this
issue.

For the stable distribution (sarge) this problem has been fixed
in version 2.1.5-8sarge1.

For the unstable distribution (sid) this problem has been fixed
in version 2.1.5-10.

We recommend that you upgrade your mailman package
immediately.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1.dsc

Size/MD5 checksum: 738
da48d99072879f627fbba7d57f8b9449
http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1.diff.gz

Size/MD5 checksum: 188686
f6b707d6165c4e2def0a37ecaa9d0237
http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5.orig.tar.gz

Size/MD5 checksum: 5745912
f5f56f04747cd4aff67427e7a45631af

Alpha architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_alpha.deb

Size/MD5 checksum: 6612108
0c91e09a0ac1b146f9c9b2a5567b6b62

AMD64 architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_amd64.deb

Size/MD5 checksum: 6610470
971f05595431464b627c9f0d782c3f3d

ARM architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_arm.deb

Size/MD5 checksum: 6610082
7c1f992caa3bd026a0e0a0d0fb2da90b

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_i386.deb

Size/MD5 checksum: 6611458
6887debd5526800e45691c7f69a67004

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_ia64.deb

Size/MD5 checksum: 6611922
6608017e09f4cf2103677ea2abc0ab64

HP Precision architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_hppa.deb

Size/MD5 checksum: 6617272
21dc663d4ff65619a0eb5ba1efb2fd38

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_m68k.deb

Size/MD5 checksum: 6616562
34978e9fe8dd54ed594ea8aac7f524e1

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_mips.deb

Size/MD5 checksum: 6660790
18c26f54237f2c2debbe979f6f2ab4dc

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_mipsel.deb

Size/MD5 checksum: 6652282
458f7ada6fad580545d54a67e3c75dad

PowerPC architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_powerpc.deb

Size/MD5 checksum: 6617334
a79738f25904b0cca44a2eda89322014

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_s390.deb

Size/MD5 checksum: 6616708
f09da905ce4d8e521002850a466dcaf7

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/m/mailman/mailman_2.1.5-8sarge1_sparc.deb

Size/MD5 checksum: 6616064
343a2acc7348c2c547922ecc79ad4c1a

These files will probably be moved into the stable distribution
on its next update.

Debian Security Advisory DSA 956-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 26th, 2006 http://www.debian.org/security/faq

Package : lsh-utils
Vulnerability : filedescriptor leak
Problem type : local
Debian-specific: no
CVE ID : CVE-2006-0353
Debian Bug : 349303

Stefan Pfetzing discovered that lshd, a Secure Shell v2 (SSH2)
protocol server, leaks a couple of file descriptors, related to the
randomness generator, to user shells which are started by lshd. A
local attacker can truncate the server’s seed file, which may
prevent the server from starting, and with some more effort, maybe
also crack session keys.

After applying this update, you should remove the server’s seed
file (/var/spool/lsh/yarrow-seed-file) and then regenerate it with
“lsh-make-seed –server” as root.

For security reasons, lsh-make-seed really needs to be run from
the console of the system you are running it on. If you run
lsh-make-seed using a remote shell, the timing information
lsh-make-seed uses for its random seed creation is likely to be
screwed. If need be, you can generate the random seed on a
different system than that which it will eventually be on, by
installing the lsh-utils package and running “lsh-make-seed -o
my-other-server-seed-file”. You may then transfer the seed to the
destination system as using a secure connection.

The old stable distribution (woody) may not be affected by this
problem.

For the stable distribution (sarge) this problem has been fixed
in version 2.0.1-3sarge1.

For the unstable distribution (sid) this problem has been fixed
in version 2.0.1cdbs-4.

We recommend that you upgrade your lsh-server package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1.dsc

Size/MD5 checksum: 827
27a08dea0eb4d51595d12325dd2dc9b9
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1.diff.gz

Size/MD5 checksum: 65643
ce143cd95c98d22be17702cfa7d00883
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1.orig.tar.gz

Size/MD5 checksum: 1866063
25ca0b4385779de3d58d2d5757f495c3

Architecture independent components:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils-doc_2.0.1-3sarge1_all.deb

Size/MD5 checksum: 167108
8a72fcaeee3a9e87bb2f596790e0ed0d

Alpha architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_alpha.deb

Size/MD5 checksum: 401168
b3c017e4498e57576f75c8c6a4141bd1
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_alpha.deb

Size/MD5 checksum: 338576
573bddb6eaf7a2488199c4559aae3c29
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_alpha.deb

Size/MD5 checksum: 1024694
db2d07041589921cea746b35970448c9

ARM architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_arm.deb

Size/MD5 checksum: 295730
dbbf6d2c5a9a78d8757536c0a91c12b1
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_arm.deb

Size/MD5 checksum: 263990
524f432ff03e1e4e0de80868b5251dc1
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_arm.deb

Size/MD5 checksum: 751640
662e1c293a3ad6ee830e0c154899a5e3

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_i386.deb

Size/MD5 checksum: 300088
5038534a8bf05c1afe3b6a02d949d19e
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_i386.deb

Size/MD5 checksum: 265836
6236889e8e52a65e3302a9cde882b46d
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_i386.deb

Size/MD5 checksum: 746754
a8608dc7abfb61b37b49985d6914939d

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_ia64.deb

Size/MD5 checksum: 447126
6e6ea9ed0b40b44f6a77de4bff109d15
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_ia64.deb

Size/MD5 checksum: 374070
9c7aea3671804cbd9e67c621aa08ae11
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_ia64.deb

Size/MD5 checksum: 1164462
e73a3d57a099a72d436f071d8666c41f

HP Precision architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_hppa.deb

Size/MD5 checksum: 343638
de455b0e097e6702ada6deaaf8803898
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_hppa.deb

Size/MD5 checksum: 295558
225a99b05fafbe38ecba5ed54ae56997
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_hppa.deb

Size/MD5 checksum: 868638
79878de6808ade34d2551aae99f9cd7b

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_m68k.deb

Size/MD5 checksum: 272632
01605d69846557dfc5b2d3f802eeb9c2
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_m68k.deb

Size/MD5 checksum: 244748
ae046120b9001ef2109b83ae014e7206
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_m68k.deb

Size/MD5 checksum: 669880
1ba0c5ea28762faaaffebf763666c7b9

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_mips.deb

Size/MD5 checksum: 352524
b760940edecb51c6f138f92ed79e1027
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_mips.deb

Size/MD5 checksum: 305572
42622131e45e23460a40a168b22f2cdf
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_mips.deb

Size/MD5 checksum: 886516
0a3a7d73e941ccb3d042a17ed91757e2

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_mipsel.deb

Size/MD5 checksum: 353328
3aae28d22cd30aa12f9cc1edcc3f1800
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_mipsel.deb

Size/MD5 checksum: 306144
3d47e49fa2507587cb1d92992e593081
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_mipsel.deb

Size/MD5 checksum: 888880
0afea7b20d9dc5c12ca7cce15c74643f

PowerPC architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_powerpc.deb

Size/MD5 checksum: 316982
d6bbece27b282748d90d5938a8111f21
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_powerpc.deb

Size/MD5 checksum: 282628
9c7a4830a74bc90a5832e6160e1e082d
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_powerpc.deb

Size/MD5 checksum: 809622
31709a65f368f7a068dcbdce4e1aff06

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_s390.deb

Size/MD5 checksum: 343902
6f3d3524ce342b6a2497940d4bc4bb40
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_s390.deb

Size/MD5 checksum: 297426
50e9c6e52e3c32c6a8597d2a0475b0d4
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_s390.deb

Size/MD5 checksum: 883990
8683782431b1e5e418265972c8877f81

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-client_2.0.1-3sarge1_sparc.deb

Size/MD5 checksum: 292410
44c4c08694ffc59077c2f1fc1112d33f
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-server_2.0.1-3sarge1_sparc.deb

Size/MD5 checksum: 262056
05063d13ff9e2b43a4e27e915507d932
http://security.debian.org/pool/updates/main/l/lsh-utils/lsh-utils_2.0.1-3sarge1_sparc.deb

Size/MD5 checksum: 751050
a2f59d44ed6b8c7759a240f491416b63

These files will probably be moved into the stable distribution
on its next update.

Debian Security Advisory DSA 957-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 26th, 2006 http://www.debian.org/security/faq

Package : imagemagick
Vulnerability : missing shell meta sanitising Problem type : local
(remote)
Debian-specific: no
CVE ID : CVE-2005-4601
BugTraq ID : 16093
Debian Bug : 345238

Florian Weimer discovered that delegate code in ImageMagick is
vulnerable to shell command injection using specially crafted file
names. This allows attackers to encode commands inside of graphic
commands. With some user interaction, this is exploitable through
Gnus and Thunderbird.

For the old stable distribution (woody) this problem has been
fixed in version 5.4.4.5-1woody7.

For the stable distribution (sarge) this problem has been fixed
in version 6.0.6.2-2.5.

For the unstable distribution (sid) this problem has been fixed
in version 6.2.4.5-0.6.

We recommend that you upgrade your imagemagick packages.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages