Advisories: July 19, 2005

Package : affix
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-2250 CAN-2005-2277
BugTraq ID : 14230
Debian Bug : 318327 318328

Kevin Finisterre discovered two problems in the Bluetooth FTP
client from affix, user space utilities for the Affix Bluetooth
protocol stack. The Common Vulnerabilities and Exposures project
identifies the following vulnerabilities:

CAN-2005-2250

A buffer overflow allows remote attackers to execute arbitrary
code via a long filename in an OBEX file share.

CAN-2005-2277

Missing input sanitising before executing shell commands allow
an attacker to execute arbitrary commands as root.

The old stable distribution (woody) is not affected by these
problems.

For the stable distribution (sarge) these problems have been
fixed in version 2.1.1-2.

For the unstable distribution (sid) these problems have been
fixed in version 2.1.2-2.

We recommend that you upgrade your affix package.

Upgrade Instructions

wget url

will fetch the file for you
dpkg -i file.deb

will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update

will update the internal database apt-get upgrade

will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.1 alias sarge

Source archives:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2.dsc

Size/MD5 checksum: 669
bb24e5747a984193075e7ad2cde94bd2
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2.diff.gz

Size/MD5 checksum: 81326
c1e434ed0667a4e0f60d6e8f431fbc11
http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1.orig.tar.gz

Size/MD5 checksum: 415816
34af8e6b1d20d99d01427f7da5c777ef

Alpha architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_alpha.deb

Size/MD5 checksum: 103006
d897078ef26ac210835785a60f63ba40
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_alpha.deb

Size/MD5 checksum: 93410
d606fe680c82300c17f821ab0238517d
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_alpha.deb

Size/MD5 checksum: 75560
50dd674ab6f58b456152bd65232ef486

ARM architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_arm.deb

Size/MD5 checksum: 85840
47fe949ac3eaf11e40785d535df13de5
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_arm.deb

Size/MD5 checksum: 69494
17cbdd22f998e972d6d3719509766f1c
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_arm.deb

Size/MD5 checksum: 56790
a1f04650c5e0f086e95a3c90d87f0a14

Intel IA-32 architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_i386.deb

Size/MD5 checksum: 84860
7f5b869acb23ff4d03074e72c5848972
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_i386.deb

Size/MD5 checksum: 63308
c6931e79eb3f8ab121a6211bcb09d71c
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_i386.deb

Size/MD5 checksum: 59606
2b52f0d5ce8c700b50a2119c70e38330

Intel IA-64 architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_ia64.deb

Size/MD5 checksum: 122082
e674b494cc0738be0ca67fe58e6fd366
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_ia64.deb

Size/MD5 checksum: 93876
40a4a3b972b76d84839b22ec0047a1de
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_ia64.deb

Size/MD5 checksum: 83630
c5af3eee5c18f3783d306bfcf2e6a3cf

HP Precision architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_hppa.deb

Size/MD5 checksum: 94884
f1fc0e6bd41671594f4ee434cad99505
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_hppa.deb

Size/MD5 checksum: 76596
e1f3ed8b636875f9dfb744b71af2f172
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_hppa.deb

Size/MD5 checksum: 68508
a3312999b8c7fea595e12a67b8d10640

Motorola 680×0 architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_m68k.deb

Size/MD5 checksum: 79808
d2e87f6c2ccb4f8b47c863e0d487d80b
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_m68k.deb

Size/MD5 checksum: 58412
b118a825ac9844a648fe576389b3900c
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_m68k.deb

Size/MD5 checksum: 54900
6dea7ad75560dda0689e77b0325df561

Big endian MIPS architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mips.deb

Size/MD5 checksum: 97384
c29b563a1f965492e4a50fe0f563ae67
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_mips.deb

Size/MD5 checksum: 76390
f0cc63d8b1cecdf0dc2947800e2f2452
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_mips.deb

Size/MD5 checksum: 61332
ecb60a17b182d2a2324f329c5a7564da

Little endian MIPS architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_mipsel.deb

Size/MD5 checksum: 97114
719915fc14b4892bc0f7bc5d5158cf46
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_mipsel.deb

Size/MD5 checksum: 76264
af38e4dc83f10cce8d5cee6da728be1b
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_mipsel.deb

Size/MD5 checksum: 60964
51af51daffb9106b7a882ac60ce603eb

PowerPC architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_powerpc.deb

Size/MD5 checksum: 94696
b2ffdb13a801392080093183099f564d
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_powerpc.deb

Size/MD5 checksum: 70040
3beda3ff644615921cb6f70670c0a712
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_powerpc.deb

Size/MD5 checksum: 65412
a05f1b318e88ce0f152558ed6919632f

IBM S/390 architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_s390.deb

Size/MD5 checksum: 92346
bbb62a4e6378d311414ee0740e94b712
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_s390.deb

Size/MD5 checksum: 72978
364b0841f0806b6cfdf4f1b10b3d270b
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_s390.deb

Size/MD5 checksum: 66764
41c5dad2e40c6771b6179b5567b39681

Sun Sparc architecture:

http://security.debian.org/pool/updates/main/a/affix/affix_2.1.1-2_sparc.deb

Size/MD5 checksum: 84660
021fa0ec494ff7066f79ef40475ad5dd
http://security.debian.org/pool/updates/main/a/affix/libaffix-dev_2.1.1-2_sparc.deb

Size/MD5 checksum: 66050
b450abbd6079f564c4c285eeec220434
http://security.debian.org/pool/updates/main/a/affix/libaffix2_2.1.1-2_sparc.deb

Size/MD5 checksum: 57714
e09e4599c7bfc96493d0d6185d8c0ca0

These files will probably be moved into the stable distribution
on its next update.

For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org

Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>

Mandriva Linux

Mandriva Linux Security Update Advisory

Package name: nss_ldap
Advisory ID: MDKSA-2005:121
Date: July 18th, 2005
Affected versions: 10.0, 10.1, 10.2, Corporate 3.0, Corporate
Server 2.1, Multi Network Firewall 2.0

Problem Description:

Rob Holland, of the Gentoo Security Audit Team, discovered that
pam_ldap and nss_ldap would not use TLS for referred connections if
they are referred to a master after connecting to a slave,
regardless of the “ssl start_tls” setting in ldap.conf.

As well, a bug in nss_ldap in Corporate Server and Mandrake 10.0
has been fixed that caused crond, and other applications, to crash
as a result of clients receiving a SIGPIPE signal when attempting
to issue a new search request to a directory server that is no
longer available.

The updated packages have been patched to address this
issue.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2069

Updated Packages:

Mandrakelinux 10.0:
914dcae90f53c038cfc011abe891ab4d
10.0/RPMS/nss_ldap-212-4.1.100mdk.i586.rpm
072543f7406517e0515d35d39e5f5f40
10.0/RPMS/pam_ldap-167-4.1.100mdk.i586.rpm
541c2b177143c43b743b8d3fe5509ea9
10.0/SRPMS/nss_ldap-212-4.1.100mdk.src.rpm

Mandrakelinux 10.0/AMD64:
5235319856a96b9a1ef18a2913f6adcf
amd64/10.0/RPMS/nss_ldap-212-4.1.100mdk.amd64.rpm
20aa9281762673b4ff2a79e4c108faf8
amd64/10.0/RPMS/pam_ldap-167-4.1.100mdk.amd64.rpm
541c2b177143c43b743b8d3fe5509ea9
amd64/10.0/SRPMS/nss_ldap-212-4.1.100mdk.src.rpm

Mandrakelinux 10.1:
b0e26a28478136804d4aeb39d44c8d82
10.1/RPMS/nss_ldap-220-3.1.101mdk.i586.rpm
700a3f02f035626e93fe9de327df9d52
10.1/RPMS/pam_ldap-170-3.1.101mdk.i586.rpm
0292807cd0a28d55ca8e59489761bf25
10.1/SRPMS/nss_ldap-220-3.1.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
707a0491faf0022727255c56dc14c508
x86_64/10.1/RPMS/nss_ldap-220-3.1.101mdk.x86_64.rpm
066cfd679a2d6ccb8f2f04cc223c8cb9
x86_64/10.1/RPMS/pam_ldap-170-3.1.101mdk.x86_64.rpm
0292807cd0a28d55ca8e59489761bf25
x86_64/10.1/SRPMS/nss_ldap-220-3.1.101mdk.src.rpm

Mandrakelinux 10.2:
e51a248257f108f311a774d58f6c04fc
10.2/RPMS/nss_ldap-220-5.2.102mdk.i586.rpm
f8716c332eaa6a29013dc9e69c164f3d
10.2/RPMS/pam_ldap-170-5.2.102mdk.i586.rpm
9e638e127e5a8107ee23c0c1c9f76fd1
10.2/SRPMS/nss_ldap-220-5.2.102mdk.src.rpm

Mandrakelinux 10.2/X86_64:
a00d92227ecbd7ce25bd144c4a9d4ffe
x86_64/10.2/RPMS/nss_ldap-220-5.2.102mdk.x86_64.rpm
87b5b7aac3a835d6e90d2ea916f0e530
x86_64/10.2/RPMS/pam_ldap-170-5.2.102mdk.x86_64.rpm
9e638e127e5a8107ee23c0c1c9f76fd1
x86_64/10.2/SRPMS/nss_ldap-220-5.2.102mdk.src.rpm

Multi Network Firewall 2.0:
bb3ebbd81508ff14425daaac2e6eb339
mnf/2.0/RPMS/nss_ldap-212-4.1.M20mdk.i586.rpm
b1ad2c72353d0e1213c9e0ae81c61ff9 mnf/2.0/RPMS/pam_

Advisories: July 19, 2005

Debian GNU/Linux

Mandriva Linux

Get the Free Newsletter!

Must Read

Raspberry Pi Connect Goes Stable

Mesa 25.1 Lands with PanVK Feature Surge, Vulkan 1.4 Enhancements

How to Install Passbolt on Ubuntu 24.04

Linux Kernel to Drop Support for Legacy i486 and Early 586 CPUs

6 Best Free and Open Source Virtual Globes

Our Brands