Home Security

Advisories, January 4, 2007

By

January 5, 2007

Gentoo Linux

Gentoo Linux Security Advisory GLSA 200701-01

http://security.gentoo.org/

Severity: Normal
Title: DenyHosts: Denial of Service
Date: January 03, 2007
Bugs: #157163
ID: 200701-01

Synopsis

DenyHosts does not correctly parse log entries, potentially
causing a remote Denial of Service.

Background

DenyHosts is designed to monitor SSH servers for repeated failed
login attempts.

Affected packages

     Package              /  Vulnerable  /                  Unaffected

  1  app-admin/denyhosts        < 2.6                           >= 2.6

Description

Tavis Ormandy of the Gentoo Linux Security Audit Team discovered
that DenyHosts used an incomplete regular expression to parse
failed login attempts.

A remote unauthenticated attacker can add arbitrary hosts to the
blacklist by attempting to login with a specially crafted username.
An attacker may use this to prevent legitimate users from accessing
a host remotely.

Workaround

There is no known workaround at this time.

Resolution

All DenyHosts users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-admin/denyhosts-2.6"

References

[ 1 ] CVE-2006-6301

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6301

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200701-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory GLSA 200701-02

http://security.gentoo.org/

Severity: Normal
Title: Mozilla Firefox: Multiple vulnerabilities
Date: January 04, 2007
Bugs: #156023
ID: 200701-02

Synopsis

Multiple vulnerabilities have been reported in Mozilla Firefox,
some of which may allow the remote execution of arbitrary code.

Background

Mozilla Firefox is a popular open-source web browser from the
Mozilla Project.

Affected packages

     Package                         /  Vulnerable  /       Unaffected



  1  www-client/mozilla-firefox          < 1.5.0.9          >= 1.5.0.9
  2  www-client/mozilla-firefox-bin      < 1.5.0.9          >= 1.5.0.9
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.

Description

An anonymous researcher found evidence of memory corruption in
the way Mozilla Firefox handles certain types of SVG comment DOM
nodes. Additionally, Frederik Reiss discovered a heap-based buffer
overflow in the conversion of a CSS cursor. Other issues with
memory corruption were also fixed. Mozilla Firefox also contains
less severe vulnerabilities involving JavaScript and Java.

Impact

An attacker could entice a user to view a specially crafted web
page that will trigger one of the vulnerabilities, possibly leading
to the execution of arbitrary code. It is also possible for an
attacker to perform cross-site scripting attacks, leading to the
exposure of sensitive information, like user credentials.

Workaround

There are no known workarounds for all the issues at this
time.

Resolution

All Mozilla Firefox users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-1.5.0.9"

All Mozilla Firefox binary release users should upgrade to the
latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-firefox-bin-1.5.0.9"

References

[ 1 ] CVE-2006-6497

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497

[ 2 ] CVE-2006-6498

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6498

[ 3 ] CVE-2006-6499

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6499

[ 4 ] CVE-2006-6500

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500

[ 5 ] CVE-2006-6501

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501

[ 6 ] CVE-2006-6502

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502

[ 7 ] CVE-2006-6503

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503

[ 8 ] CVE-2006-6504

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6504

[ 9 ] CVE-2006-6506

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6506

[ 10 ] CVE-2006-6507

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6507

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200701-02.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

Gentoo Linux Security Advisory GLSA 200701-03

http://security.gentoo.org/

Severity: High
Title: Mozilla Thunderbird: Multiple vulnerabilities
Date: January 04, 2007
Bugs: #158571
ID: 200701-03

Synopsis

Multiple vulnerabilities have been reported in Mozilla
Thunderbird, some of which may allow the remote execution of
arbitrary code.

Background

Mozilla Thunderbird is a popular open-source email client from
the Mozilla Project.

Affected packages

     Package                  /  Vulnerable  /              Unaffected



  1  mozilla-thunderbird          < 1.5.0.9                 >= 1.5.0.9
  2  mozilla-thunderbird-bin      < 1.5.0.9                 >= 1.5.0.9
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.

Description

Georgi Guninski and David Bienvenu discovered buffer overflows
in the processing of long “Content-Type:” and long non-ASCII MIME
headers. Additionally, Frederik Reiss discovered a heap-based
buffer overflow in the conversion of a CSS cursor. Different
vulnerabilities involving memory corruption in the browser engine
were also fixed. Mozilla Thunderbird also contains less severe
vulnerabilities involving JavaScript and Java.

Impact

An attacker could entice a user to view a specially crafted
email that will trigger one of these vulnerabilities, possibly
leading to the execution of arbitrary code. An attacker could also
perform cross-site scripting attacks, leading to the exposure of
sensitive information, like user credentials. Note that the
execution of JavaScript or Java applets is disabled by default and
enabling it is strongly discouraged.

Workaround

There are no known workarounds for all the issues at this
time.

Resolution

All Mozilla Thunderbird users should upgrade to the latest
version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/mozilla-thunderbird-1.5.0.9"

All Mozilla Thunderbird binary release users should upgrade to
the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/mozilla-thunderbird-bin-1.5.0.9"

References

[ 1 ] CVE-2006-6497

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6497

[ 2 ] CVE-2006-6500

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6500

[ 3 ] CVE-2006-6501

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6501

[ 4 ] CVE-2006-6502

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6502

[ 5 ] CVE-2006-6503

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6503

[ 6 ] CVE-2006-6505

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6505

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200701-03.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2007 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

SUSE Linux

SUSE Security Announcement

Package: OpenOffice_org
Announcement ID: SUSE-SA:2007:001
Date: Thu, 04 Jan 2007 15:00:00 +0000
Affected Products: Novell Linux Desktop 9 SLE SDK 10 SUSE LINUX
10.1 SUSE LINUX 10.0 SUSE LINUX 9.3 SuSE Linux Desktop 1.0 SUSE
SLED 10
Vulnerability Type: code execution
Severity (1-10): 7
SUSE Default Package: yes
Cross-References: CVE-2006-5870

Content of This Advisory:

Security Vulnerability Resolved: buffer overflows in WMF and
Enhanced WMF handling Problem Description
Solution or Work-Around
Special Instructions and Notes
Package Location and Checksums
Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE
Security Summary Report.
Authenticity Verification and Additional Information

1) Problem Description and Brief Discussion

Security problems were fixed in the WMF and Enhanced WMF
handling in OpenOffice_org These could potentially be used to
execute code or crash OpenOffice when a user could be convinced to
open specially crafted document (for instance a document sent by
E-mail).

This issue is tracked by the Mitre CVE ID CVE-2006-5870.

openSUSE 10.2 is not affected by this problem, it already
contains the fixed OpenOffice_org 2.1 version.

Additionally the OpenOffice_org 2.0 version in SLED 10 was
fitted with hooks to add OfficeXML support with a later update.

Due to the very large size of this update and mirror lag it
might take some hours or days until the updates are available on
our mirrors.

2) Solution or Work-Around

There is no known workaround, please install the update
packages.

3) Special Instructions and Notes

Restart OpenOffice after the update.

4) Package Location and Checksums

The preferred method for installing security updates is to use
the YaST Online Update (YOU) tool. YOU detects which updates are
required and automatically performs the necessary steps to verify
and install them. Alternatively, download the update packages for
your distribution manually and verify their integrity by the
methods listed in Section 6 of this announcement. Then install the
packages using the command

rpm -Fhv <file.rpm>

to apply the update, replacing <file.rpm> with the
filename of the downloaded RPM package.

x86 Platform:

SUSE LINUX 10.1:
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-2.0.2-27.15.i586.rpm
fd03f46c3cb8bef62d6bc717183204e7
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-gnome-2.0.2-27.15.i586.rpm
36bd92eac9d3fd998998625d5f812858
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-kde-2.0.2-27.15.i586.rpm
54dc58b25ed418070f58288c1950d157
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-mono-2.0.2-27.15.i586.rpm
0f89c73067b0a0bc7a387d59c5b0a83f
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/i586/OpenOffice_org-officebean-2.0.2-27.15.i586.rpm
fd487bb53472096452ae5fd9717c2743

Power PC Platform:

SUSE LINUX 10.1:
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-2.0.2-27.15.ppc.rpm
47475bcf3d13d3fe4e03a245de77299a
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-gnome-2.0.2-27.15.ppc.rpm
fdcf3ab9522f5d931ab45aa361d39a71
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-kde-2.0.2-27.15.ppc.rpm
c69710053fee5f830ffa0fe276237db4
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-mono-2.0.2-27.15.ppc.rpm
d6ce3d25640cc1ddbd04969a72601eea
   ftp://ftp.suse.com/pub/suse/update/10.1/rpm/ppc/OpenOffice_org-officebean-2.0.2-27.15.ppc.rpm
7fba6800f065447114d6435e96a0d799

Sources:

SUSE LINUX 10.1:
ftp://ftp.suse.com/pub/suse/update/10.1/rpm/src/OpenOffice_org-2.0.2-27.15.src.rpm
fe0ad3c361d857bc7504bf2215ae8948

SUSE LINUX 10.0:
ftp://ftp.suse.com/pub/suse/i386/update/10.0/rpm/src/OpenOffice_org-2.0.0-1.6.src.rpm
e214e34e63fc0631959d452597025514

SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/OpenOffice_org1-1.1.3-4.7.src.rpm
66f134cb40880d6ee219c8c1a01c1a5b

Our maintenance customers are notified individually. The
packages are offered for installation from the maintenance web:

SLE SDK 10

http://support.novell.com/techcenter/psdb/5de7a5faac735ff75aae048d9aeaa21f.html

SUSE SLED 10

http://support.novell.com/techcenter/psdb/5de7a5faac735ff75aae048d9aeaa21f.html

Novell Linux Desktop 9

http://support.novell.com/techcenter/psdb/b38ccbe0fb2200869a3553e136fde4f2.html

SuSE Linux Desktop 1.0

http://support.novell.com/techcenter/psdb/b38ccbe0fb2200869a3553e136fde4f2.html

5) Pending Vulnerabilities, Solutions, and Work-Arounds:

See SUSE Security Summary Report.

6) Authenticity Verification and Additional Information

Announcement authenticity verification:
SUSE security announcements are published via mailing lists and
on Web sites. The authenticity and integrity of a SUSE security
announcement is guaranteed by a cryptographic signature in each
announcement. All SUSE security announcements are published with a
valid signature.

To verify the signature of the announcement, save it as text
into a file and run the command

gpg –verify <file>

replacing <file> with the name of the file containing the
announcement. The output for a valid signature looks like:

gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg:
Good signature from “SuSE Security Team <security@suse.de>”

where <DATE> is replaced by the date the document was
signed.

If the security team’s key is not contained in your key ring,
you can import it from the first installation CD. To import the
key, use the command

gpg –import gpg-pubkey-3d25d3d9-36e12d04.asc
Package authenticity verification:
SUSE update packages are available on many mirror FTP servers
all over the world. While this service is considered valuable and
important to the free and open source software community, the
authenticity and integrity of a package needs to be verified to
ensure that it has not been tampered with.

The internal RPM package signatures provide an easy way to
verify the authenticity of an RPM package. Use the command

rpm -v –checksig <file.rpm>

to verify the signature of the package, replacing
<file.rpm> with the filename of the RPM package downloaded.
The package is unmodified if it contains a valid signature from
build@suse.de with the key ID
9C800ACA.

This key is automatically imported into the RPM database (on
RPMv4-based distributions) and the gpg key ring of ‘root’ during
installation. You can also find it on the first installation CD and
included at the end of this announcement.
SUSE runs two security mailing lists to which any interested
party may subscribe:
- opensuse-security@opensuse.org
  General Linux and SUSE security discussion.
  All SUSE security announcements are sent to this list.
  To subscribe, send an e-mail to
  <opensuse-security+subscribe@opensuse.org>.
- suse-security-announce@suse.com
  SUSE’s announce-only mailing list.
  Only SUSE’s security announcements are sent to this list.
  To subscribe, send an e-mail to
  <suse-security-announce-subscribe@suse.com>.

SUSE’s security contact is <security@suse.com> or
<security@suse.de>.
The <security@suse.de>
public key is listed below.

The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, the clear text signature should show proof of the
authenticity of the text.

SUSE Linux Products GmbH provides no warranties of any kind
whatsoever with respect to the information contained in this
security advisory.

Type Bits/KeyID Date User ID
pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>

SUSE Security Announcement

Package: mono-web
Announcement ID: SUSE-SA:2007:002
Date: Thu, 04 Jan 2007 18:00:00 +0000
Affected Products: openSUSE 10.2 SLE SDK 10 SUSE LINUX 10.1 SUSE
SLED 10 SUSE SLES 10
Vulnerability Type: remote source code disclosure
Severity (1-10): 4
SUSE Default Package: no
Cross-References: CVE-2006-6104

Content of This Advisory:

Security Vulnerability Resolved: ASP.net source code disclosure
Problem Description
Solution or Work-Around
Special Instructions and Notes
Package Location and Checksums
Pending Vulnerabilities, Solutions, and Work-Arounds: See SUSE
Security Summary Report.
Authenticity Verification and Additional Information

1) Problem Description and Brief Discussion

A security problem was found and fixed in the Mono / C# web
server implementation.

By appending spaces to URLs attackers could download the source
code of ASP.net scripts that would normally get executed by the web
server.

This issue is tracked by the Mitre CVE ID CVE-2006-6104 and only
affects SUSE Linux 10.1, openSUSE 10.2 and SUSE Linux Enterprise
10.

Older products are not affected.

The updated packages for this problem were released on December
29th 2006.

2) Solution or Work-Around

There is no known workaround, please install the update
packages.

3) Special Instructions and Notes

None.

4) Package Location and Checksums

The preferred method for installing security updates is to use
the YaST Online Update (YOU) tool. YOU detects which updates are
required and automatically performs the necessary steps to verify
and install them. Alternatively, download the update packages for
your distribution manually and verify their integrity by the
methods listed in Section 6 of this announcement. Then install the
packages using the command

rpm -Fhv <file.rpm>

to apply the update, replacing <file.rpm> with the
filename of the downloaded RPM package.

x86 Platform:

Advisories, January 4, 2007

Gentoo Linux

SUSE Linux

Get the Free Newsletter!

Must Read

Our Brands