Conectiva Linux
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : kernel
SUMMARY : Kernel fixes
DATE : 2005-03-07 17:08:00
ID : CLA-2005:930
RELEVANT RELEASES : 10
DESCRIPTION
The Linux kernel is responsible for handling the basic functions of
the GNU/Linux operating system.
This announcement has the following important changes:
The following issues have been fixed:
1.1 a.out local DoS (CAN-2004-1074)[1]
1.2 IGMP vulnerability (CAN-2004-1137)[2]
1.3 uselib local privilege escalation vulnerability
(CAN-2004-1235)[3]
1.4 LSM Module Local Privilege Elevation (CAN 2004-1337)[4]
1.5 i386 SMP page fault handler privilege escalation
(CAN-2005-0001)[5]
1.6 SHM insufficient permission checking (CAN-2005-0176)[6]
1.7 Local DoS in nls_ascii.c (CAN-2005-0177)[7]
1.8 setsid local DoS (CAN-2005-0178)[8]
1.9 mlockall local DoS (CAN-2005-0179)[9]
1.10 Integer signedness errors in scsi functions
(CAN-2005-0180)[10]
1.11 NFS client O_DIRECT error (CAN-2005-0207)[11][12]
1.12 /proc heap overflow (CAN-2005-0529)[13][14]
1.13 Signedess error in n_tty.c (CAN-2005-0530)[13][15]
1.14 Possible buffer oferflow in atm_get_addr()
(CAN-2005-0531)[13][16]
1.15 read/write VFS range checking [17][18]
2. Other
changes
2.1 NVidia
The NVidia driver has been updated to version 6629.
Unfortunately, some NVidia boards do not work well with this
driver. In those cases, the workaround is to use the opensource
“nv” driver or boot into the previous kernel until NVidia releases
a new version which fixes the problem.
2.2 SATA modules
Some SATA modules changed behaviour and started using SCSI
device names instead of IDE ones, particularly with VIA
motherboards. In these machines, the hard disk device changed from
/dev/hdX to /dev/sdX (for example, /dev/hde to /dev/sda). In order
to be able to boot the new kernel, some manual changes are
necessary.
The following example assumes the device name changed from
/dev/hde to /dev/sda and that the root partition was /dev/hde3:
- /boot/grub/menu.lst:
- change “root=/dev/hde3” to “root=/dev/sda3”
- if using LILO, make the same change in /etc/lilo.conf and run
“lilo” afterwards
- /etc/fstab
- change all occurrences of “/dev/hde” to “/dev/sda”, keeping the
partition number. For example, change “/dev/hde1” to “/dev/sda1”
and so on.
- change all occurrences of “/dev/hde” to “/dev/sda”, keeping the
The best way to check for the name change is to observe the boot
messages from the new kernel. There would be references to SCSI
devices which were previously not there such as “sda”, “sdb”,
etc.
2.3 Winmodem modules
Some winmodem modules unfortunately do not work with the new
kernel (in particular, slmodem and ltmodem). It is expected that
future versions will have this fixed.
2.4 DRBD
This update finally brings back DRBD support, used in High
Availability clusters.
SOLUTION
It is recommended that all Conectiva Linux users perform the
upgrade.
IMPORTANT: exercise caution and preparation when upgrading the
kernel, since it will require a reboot after the new packages are
installed. More detailed instructions are available in Portuguese
at our Q&A page[19].
REFERENCES
1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1074
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1137
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1235
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1337
5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0001
6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0176
7.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0177
8.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0178
9.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0179
10.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0180
11.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0207
12.http://linux.bkbits.net:8080/linux-2.6/cset@41db2d65wbgJvuXTv4x9_quExW0vEA
13.http://www.guninski.com/where_do_you_want_billg_to_go_today_3.html
14.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0529
15.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0530
16.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0531
17.http://linux.bkbits.net:8080/linux-2.6/patch@1.1966.1.68
18.http://linux.bkbits.net:8080/linux-2.6/patch@1.1966.1.67
19.http://www.conectiva.com.br/suporte/pr/sistema.kernel.atualizar.html
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/kernel26-module-drbd-2.6.10.72032U10_12cl.0.7.5-71801U10_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/xfree86-driver-nvidia-1.0.6629-71010U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/drbd-utils-0.7.5-71689U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/heartbeat-1.2.3-72193U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/iptables-1.2.11-72578U10_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/libalsa2-1.0.7-72296U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/SRPMS/libaoss0-1.0.7-72293U10_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-2.6.10-72032U10_12cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-2.6.10-72032U10_12cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-2.6.10-72032U10_12cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-2.6.10-72032U10_12cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-2.6.10-72032U10_12cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-BOOT-2.6.10-72032U10_12cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-doc-2.6.10-72032U10_12cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-enterprise-2.6.10-72032U10_12cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-enterprise-2.6.10-72032U10_12cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-enterprise-2.6.10-72032U10_12cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-2.6.10-72032U10_12cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-2.6.10-72032U10_12cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-2.6.10-72032U10_12cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-smp-2.6.10-72032U10_12cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-smp-2.6.10-72032U10_12cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-highmem-smp-2.6.10-72032U10_12cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-smp-2.6.10-72032U10_12cl.athlon.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-smp-2.6.10-72032U10_12cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-smp-2.6.10-72032U10_12cl.i586.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-smp-2.6.10-72032U10_12cl.i686.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-smp-2.6.10-72032U10_12cl.pentium4.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/kernel26-source-2.6.10-72032U10_12cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/drbd-utils-0.7.5-71689U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/drbd-utils-heartbeat-0.7.5-71689U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-devel-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-devel-static-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-ldirectord-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-pils-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/heartbeat-stonith-1.2.3-72193U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/alsa-lib-devel-1.0.7-72296U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/alsa-lib-devel-static-1.0.7-72296U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/alsa-oss-devel-1.0.7-72293U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/alsa-oss-devel-static-1.0.7-72293U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/alsa-server-1.0.7-72296U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libalsa2-1.0.7-72296U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libalsatoss0-1.0.7-72293U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/iptables-1.2.11-72578U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/iptables-devel-1.2.11-72578U10_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/libgl1-nvidia-1.0.6629-71010U10_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/xfree86-driver-nvidia-1.0.6629-71010U10_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : squid
SUMMARY : Fixes for multiple squid vulnerabilities
DATE : 2005-03-08 10:06:00
ID : CLA-2005:931
RELEVANT RELEASES : 9, 10
DESCRIPTION
Squid[1] is a full-featured web proxy cache.
This announcement fixes the following vulnerabilities for
Squid:
1.Strengthen Squid from HTTP response splitting cache pollution
attack[2]
This patch additionaly strengthens Squid from the HTTP response
splitting cache pollution attack described by Sanctum.
2.Reject malformed HTTP requests and responses that conflict
with the HTTP specifications[3]
This patch makes Squid considerably stricter while parsing the HTTP
protocol and also adds a new relaxed_header_parser directive which
defaults to on. If set off Squid will become really strict about CR
characters and whitespace in header names, while in the default on
setting Squid will ignore (and automatically clean up) common
deviations from these parts of the HTTP specification.
3.Correct handling of oversized reply headers[4] This patch
addresses a HTTP protocol mismatch related to oversized reply
headers. In addition it enhances the cache.log reporting on reply
header parsing failures to make it easier to track down which sites
are malfunctioning.
4.Segmentation fault on failed PUT/POST request[5] An
inconsistent state is entered on a failed PUT/POST request making a
high risk for segmentation faults or other strange errors.
5.Data corruption when HTTP reply headers is split in several
packets[6]
Under certain conditions involving HTTP headers split over multiple
reply packets the HTTP reply may be corrupted by Squid. Symptoms
range from hanging requests to corrupted data or error messages
about the reply sent to the clients (usually
“httpProcessReplyHeader: Too large reply header”).
6.Assertion failure on certain odd DNS responses[7] Squid may
abort with “xstrndup: Asserton ‘n’ failed” or other errors when
receiving certain odd DNS responses.
For Conectiva Linux 9, the Squid package has been merged with
Conectiva Linux 10 package, since both used the same base
version.
SOLUTION
It is recommended that all squid users upgrade to the latest
packages. This update will automatically restart the service if it
is already running.
REFERENCES
1.http://www.squid-cache.org/
2.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-response_splitting
3.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-header_parsing
4.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headers
5.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-post
6.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-split_headers
7.http://www1.uk.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE8-dns_assert
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/10/SRPMS/squid-2.5.5-63116U10_8cl.src.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-2.5.5-63116U10_8cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-auth-2.5.5-63116U10_8cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/10/RPMS/squid-extra-templates-2.5.5-63116U10_8cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/squid-2.5.5-76327U90_10cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-2.5.5-76327U90_10cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-auth-2.5.5-76327U90_10cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/squid-extra-templates-2.5.5-76327U90_10cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com
Debian GNU/Linux
Debian Security Advisory DSA 691-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
March 7th, 2005 http://www.debian.org/security/faq
Package : abuse
Vulnerability : several
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2005-0098 CAN-2005-0099
Several vulnerabilities have been discovered in abuse, the SDL
port of the Abuse action game. The Common Vulnerabilities and
Exposures project identifies the following problems:
CAN-2005-0098
Erik Sjölund discovered several buffer overflows in the
command line handling, which could lead to the execution of
arbitrary code with elevated privileges since it is installed
setuid root.
CAN-2005-0099
Steve Kemp discoverd that that abuse creates some files without
dropping privileges first, which may lead to the creation and
overwriting of arbitrary files.
For the stable distribution (woody) these problems have been
fixed in version 2.00+-3woody4.
The unstable distribution (sid) does not contain an abuse
package anymore.
We recommend that you upgrade your abuse package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4.dsc
Size/MD5 checksum: 623 7a65008ae232f2b2a3b07d093229ba21
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4.diff.gz
Size/MD5 checksum: 58555 02fdd3983b67b8ab482a9ec6156a39bd
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+.orig.tar.gz
Size/MD5 checksum: 2511544 ca758e0b9b566f374700da4e62288c1f
Alpha architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_alpha.deb
Size/MD5 checksum: 368092 5b33e629303f3e361664dd2ad68c184e
ARM architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_arm.deb
Size/MD5 checksum: 293216 889469d2dc501b17d8b397b959c43b2b
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_i386.deb
Size/MD5 checksum: 481882 c6ca713c2c83bb83863fdf700282054d
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_ia64.deb
Size/MD5 checksum: 470086 3cfa84160fb3daaadac03e8df13ca60d
HP Precision architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_hppa.deb
Size/MD5 checksum: 337144 54a2fe9a5b23fd84423e3420b160d728
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_m68k.deb
Size/MD5 checksum: 228178 e359e7ef29b6f79c399dc9bd99a85408
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_mips.deb
Size/MD5 checksum: 326616 bc7db32c0729ca361de0634b88cc4674
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_mipsel.deb
Size/MD5 checksum: 322142 c840c20fd82e03f45cebc0146baba7cc
PowerPC architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_powerpc.deb
Size/MD5 checksum: 282222 1ec1f756e714395821111ea8f6cb4652
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_s390.deb
Size/MD5 checksum: 270788 fd981943304e5c207b0b5877e052a478
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/a/abuse/abuse_2.00+-3woody4_sparc.deb
Size/MD5 checksum: 272080 dbecc678daa315f1b6ff418c819ca443
These files will probably be moved into the stable distribution
on its next update.
Debian Security Advisory DSA 692-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
March 8th, 2005 http://www.debian.org/security/faq
Package : kdenetwork
Vulnerability : design flaw
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2005-0205
The KDE team fixed a bug in kppp in 2002 which was now
discovered to be exploitable by iDEFENSE. By opening a sufficiently
large number of file descriptors before executing kppp which is
installed setuid root a local attacker is able to take over
privileged file descriptors.
For the stable distribution (woody) this problem has been fixed
in version 2.2.2-14.7.
The testing (sarge) and unstable (sid) distributions are not
affected since KDE 3.2 already contained the correction.
We recommend that you upgrade your kppp package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.7.dsc
Size/MD5 checksum: 902 ad4a663d3fa5d1f401c1de23b491ce24
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2-14.7.diff.gz
Size/MD5 checksum: 29835 f79db588c576a8cc1d5febb65f87f545
http://security.debian.org/pool/updates/main/k/kdenetwork/kdenetwork_2.2.2.orig.tar.gz
Size/MD5 checksum: 3319181 25fbfc5d2592937480c0d3796a2416e0
Alpha architecture:
http://security.debian.org/pool/updates/main/k/kdenetwork/kdict_2.2.2-14.7_alpha.deb
Size/MD5 checksum: 231920 c062aa249f621d5093ac193046c0cc80
http://security.debian.org/pool/updates/main/k/kdenetwork/kit_2.2.2-14.7_alpha.deb
Size/MD5 checksum: 154758 25dfcfccc46e8302663f11f09e9ce0c0
http://security.debian.org/pool/updates/main/k/kdenetwork/klisa_2.2.2-14.7_alpha.deb
Size/MD5 checksum: 189244 9a3a01822530a9caf7e93da2f19c5c0d
http://security.debian.org/pool/updates/main/k/kdenetwork/kmail_2.2.2-14.7_alpha.deb
Size/MD5 checksum: 999248 0fe2d1678cbd97f85c06fe446635d4e5
http://security.debian.org/pool/updates/main/k/kdenetwork/knewsticker_2.2.2-14.7_alpha.deb
Size/MD5 checksum: 439772 ec0df6689965ff930fc39389a220062e
http://security.debian.org/pool/updates/main/k/kdenetwork/knode_2.2.2-14.7_alpha.deb