Debian GNU/Linux
Debian Security Advisory DSA 1207-2 security@debian.org
http://www.debian.org/security/
Moritz Muehlenhoff
November 19th, 2006 http://www.debian.org/security/faq
Package : phpmyadmin
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2006-1678 CVE-2006-2418 CVE-2005-3621 CVE-2005-3665
CVE-2006-5116
Debian Bug : 339437 340438 362567 368082 391090
The phpmyadmin update in DSA 1207 introduced a regression. This
update corrects this flaw. For completeness, the original advisory
text below:
Several remote vulnerabilities have been discovered in
phpMyAdmin, a program to administrate MySQL over the web. The
Common Vulnerabilities and Exposures project identifies the
following problems:
CVE-2005-3621
CRLF injection vulnerability allows remote attackers to conduct
HTTP response splitting attacks.
CVE-2005-3665
Multiple cross-site scripting (XSS) vulnerabilities allow remote
attackers to inject arbitrary web script or HTML via the (1)
HTTP_HOST variable and (2) various scripts in the libraries
directory that handle header generation.
CVE-2006-1678
Multiple cross-site scripting (XSS) vulnerabilities allow remote
attackers to inject arbitrary web script or HTML via scripts in the
themes directory.
CVE-2006-2418
A cross-site scripting (XSS) vulnerability allows remote
attackers to inject arbitrary web script or HTML via the db
parameter of
footer.inc.php/.
CVE-2006-5116
A remote attacker could overwrite internal variables through the
_FILES global variable.
For the stable distribution (sarge) these problems have been
fixed in version 2.6.2-3sarge3.
For the upcoming stable release (etch) and unstable distribution
(sid) these problems have been fixed in version 2.9.0.3-1.
We recommend that you upgrade your phpmyadmin package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.dsc
Size/MD5 checksum: 604
32ee16f4370604bc150d93c5676fface
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3.diff.gz
Size/MD5 checksum: 38520
f27c4b99bbdb3dc13fb71aef99749247
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2.orig.tar.gz
Size/MD5 checksum: 2654418
05e33121984824c43d94450af3edf267
Architecture independent components:
http://security.debian.org/pool/updates/main/p/phpmyadmin/phpmyadmin_2.6.2-3sarge3_all.deb
Size/MD5 checksum: 2769182
00f14fb52a14546e92ece84c16cd249f
These files will probably be moved into the stable distribution
on its next update.
Debian Security Advisory DSA 1218-1 security@debian.org
http://www.debian.org/security/
Moritz Muehlenhoff
November 21st, 2006 http://www.debian.org/security/faq
Package : proftpd
Vulnerability : programming error
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2006-5815
Debian Bug : 399070
It was discovered that the proftpd FTP daemon performs
insufficient validation of FTP command buffer size limits, which
may lead to denial of service.
For the stable distribution (sarge) this problem has been fixed
in version 1.2.10-15sarge2.
For the unstable distribution (sid) this problem has been fixed
in version 1.3.0-13 of the proftpd-dfsg package.
We recommend that you upgrade your proftpd package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.1 alias sarge
Source archives:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2.dsc
Size/MD5 checksum: 897
fe043ac01a1753ba7d47e169d7863039
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2.diff.gz
Size/MD5 checksum: 127600
d1611a9db379bee3e1f137c4c09d4b13
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10.orig.tar.gz
Size/MD5 checksum: 920495
7d2bc5b4b1eef459a78e55c027a4f3c4
Architecture independent components:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-doc_1.2.10-15sarge2_all.deb
Size/MD5 checksum: 422520
784f6a1ead480a7198dd0ad7df4c6d7d
Alpha architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_alpha.deb
Size/MD5 checksum: 444406
dd457de80a77a65ea56f917ed8503641
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_alpha.deb
Size/MD5 checksum: 200788
0d3e2ba8ea9082b304a2c7f4d6af8df9
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_alpha.deb
Size/MD5 checksum: 457204
17af0e330f48108785aa9d00507c5291
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_alpha.deb
Size/MD5 checksum: 476800
dffaa2aad3f25eb2887005c27059b241
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_alpha.deb
Size/MD5 checksum: 476468
0c7be08d97b11f187c39f8a965b9e3c6
AMD64 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_amd64.deb
Size/MD5 checksum: 389010
2fd7461b794783671e641d72488c4585
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_amd64.deb
Size/MD5 checksum: 194562
3113db8aa6ba8e67dcea03632cf6fe67
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_amd64.deb
Size/MD5 checksum: 400008
3a89749eb456ea237ca4d82ae18e4beb
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_amd64.deb
Size/MD5 checksum: 415382
302debcfd6ff112e7294959addcdc1d6
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_amd64.deb
Size/MD5 checksum: 415174
51c2c6374d0483191874f96dd7318a27
ARM architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_arm.deb
Size/MD5 checksum: 373836
b740b9aa079946e4d2cbf323ae72a978
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_arm.deb
Size/MD5 checksum: 188754
5ffae3af9d619b301595ea9b1175ef37
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_arm.deb
Size/MD5 checksum: 384048
8beac5c897580847d39427097efd5116
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_arm.deb
Size/MD5 checksum: 398914
5470be96f5ad34f83d1042139c6a639e
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_arm.deb
Size/MD5 checksum: 398778
ae4abd419715b09b9a7bcc1f3e23eb96
HP Precision architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_hppa.deb
Size/MD5 checksum: 403664
e19be25ea86f75de8fb0015837e47e57
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_hppa.deb
Size/MD5 checksum: 194452
65616d5eed9a3270e0df3086ad87a8a7
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_hppa.deb
Size/MD5 checksum: 414846
5ce90027122e3a27646cc314854ea37e
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_hppa.deb
Size/MD5 checksum: 431778
5deb145cbaacd0cbee298a0f6a02f6d2
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_hppa.deb
Size/MD5 checksum: 431492
9b950e59b183a6795d5eacb2002bf03c
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_i386.deb
Size/MD5 checksum: 371202
efa3cca67db44225ecf7990ee8b76808
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_i386.deb
Size/MD5 checksum: 188864
6129e4a1b65440c57e6e76e104025cf4
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_i386.deb
Size/MD5 checksum: 380918
2de20dc3d336007347871007ad2aa9b6
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_i386.deb
Size/MD5 checksum: 396670
2b6a3833f37f256ac0268bf03d25dfd8
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_i386.deb
Size/MD5 checksum: 396432
ba26cbd5cfa7cd9d06c94baad26864b3
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_ia64.deb
Size/MD5 checksum: 519710
30aa10cfda1d97d81772d9a9fff3ef4c
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_ia64.deb
Size/MD5 checksum: 206994
1eefe822ebe9df3b584f719db1e6e263
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_ia64.deb
Size/MD5 checksum: 535338
4108fe33e7d1e6827e1545ea6ebfff7e
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_ia64.deb
Size/MD5 checksum: 562320
0ee714edb0c79544904c0db855daf174
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_ia64.deb
Size/MD5 checksum: 562214
4714a62fff2346f1d376f4306e0c6974
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_m68k.deb
Size/MD5 checksum: 332528
3ad435ced0a1492fd61ae55c90204ad1
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_m68k.deb
Size/MD5 checksum: 187148
312a33fd15cfc35bd182d84ea847c852
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_m68k.deb
Size/MD5 checksum: 340916
adf942ec807fd5a39fdb9707226921bc
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_m68k.deb
Size/MD5 checksum: 353106
d724b6da9758c7bd3c4a4dfee4411306
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_m68k.deb
Size/MD5 checksum: 352830
5a090fa4b611c42a907919a88861eb9a
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_mips.deb
Size/MD5 checksum: 382394
7e6c7b8b92827f3a6644689b0d06ef4e
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_mips.deb
Size/MD5 checksum: 201616
fb61630fd14f0520518f78d198b15480
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_mips.deb
Size/MD5 checksum: 391986
0ffbc86ea82bd910466c367f156af4be
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_mips.deb
Size/MD5 checksum: 406488
2dff85fe8dc813c5be15780765a90a74
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_mips.deb
Size/MD5 checksum: 406238
1d658816888f361611ef7c7a41062f62
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_mipsel.deb
Size/MD5 checksum: 384334
ea408f73dd5288c3dbdd15556cb4c884
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_mipsel.deb
Size/MD5 checksum: 201838
a2c8ed17d8c6dbfe3ff0a359ec8402fd
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_mipsel.deb
Size/MD5 checksum: 393390
f6396ba4684fec2a4bd2b8a156c617a8
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_mipsel.deb
Size/MD5 checksum: 409460
403eb9064b44dfb5c4f5c64e3d11b43e
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_mipsel.deb
Size/MD5 checksum: 409212
e1226c8b018ced87ad77118c660d0361
PowerPC architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_powerpc.deb
Size/MD5 checksum: 384414
3cc172a7ddaf95a37905ce0ca2fc340f
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_powerpc.deb
Size/MD5 checksum: 195366
d3db9b92cf67136399f153e804a168bd
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_powerpc.deb
Size/MD5 checksum: 395170
9f26106f211808f807bfde1c2911629a
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_powerpc.deb
Size/MD5 checksum: 412014
3a0d74322ba454ee72e0925cb871c3f5
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_powerpc.deb
Size/MD5 checksum: 411760
2611181a4d8cb329bea9d9d0db130b31
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_s390.deb
Size/MD5 checksum: 379686
06371d89be06ba9c16152ef8d0164f9b
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_s390.deb
Size/MD5 checksum: 192976
5a2c80cb11cd89c008a978b2e235bd45
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_s390.deb
Size/MD5 checksum: 390112
ee494ba31925ba491ba72152a7fd0a88
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_s390.deb
Size/MD5 checksum: 403944
c38a72652bef06f11e87fa28ab48d86c
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_s390.deb
Size/MD5 checksum: 403734
2af77df7a25f5f5ed2b2d06c6fcd6ae3
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/p/proftpd/proftpd_1.2.10-15sarge2_sparc.deb
Size/MD5 checksum: 369674
8dd5a9ec08ae54bcbc89ba8b6d695c87
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-common_1.2.10-15sarge2_sparc.deb
Size/MD5 checksum: 188988
03998811bf00f61f9c52f79ee5150978
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-ldap_1.2.10-15sarge2_sparc.deb
Size/MD5 checksum: 379464
fefd89407a8e0fdbc50a5398820aaa3c
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-mysql_1.2.10-15sarge2_sparc.deb
Size/MD5 checksum: 394890
6d62112d1257db0c993e33d075f7adb3
http://security.debian.org/pool/updates/main/p/proftpd/proftpd-pgsql_1.2.10-15sarge2_sparc.deb
Size/MD5 checksum: 394654
ada057a72951b1aa06d599b6e41bc503
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>
Gentoo Linux
Gentoo Linux Security Advisory GLSA 200611-11
Severity: Normal
Title: TikiWiki: Multiple vulnerabilities
Date: November 20, 2006
Bugs: #153820
ID: 200611-11
Synopsis
TikiWiki allows for the disclosure of MySQL database
authentication credentials and for cross-site scripting
attacks.
Background
TikiWiki is an open source content management system written in
PHP.
Affected packages
Package / Vulnerable / Unaffected
1 www-apps/tikiwiki < 1.9.6 >= 1.9.6
Description
In numerous files TikiWiki provides an empty sort_mode
parameter, causing TikiWiki to display additional information,
including database authentication credentials, in certain error
messages. TikiWiki also improperly sanitizes the “url” request
variable sent to tiki-featured_link.php.
Impact
An attacker could cause a database error in various pages of a
TikiWiki instance by providing an empty sort_mode request variable,
and gain unauthorized access to credentials of the MySQL databases
used by TikiWiki. An attacker could also entice a user to browse to
a specially crafted URL that could run scripts in the scope of the
user’s browser.
Workaround
There is no known workaround at this time.
Resolution
All TikiWiki users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-apps/tikiwiki-1.9.6"
References
[ 1 ] CVE-2006-5702
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5702
[ 2 ] CVE-2006-5703
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5703
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-11.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 200611-12
Severity: Normal
Title: Ruby: Denial of Service vulnerability
Date: November 20, 2006
Bugs: #153497
ID: 200611-12
Synopsis
The Ruby cgi.rb CGI library is vulnerable to a Denial of Service
attack.
Background
Ruby is a dynamic, open source programming language with a focus
on simplicity and productivity.
Affected packages
Package / Vulnerable / Unaffected
1 dev-lang/ruby < 1.8.5-r3 >= 1.8.5-r3
Description
Zed Shaw, Jeremy Kemper, and Jamis Buck of the Mongrel project
reported that the CGI library shipped with Ruby is vulnerable to a
remote Denial of Service by an unauthenticated user.
Impact
The vulnerability can be exploited by sending the cgi.rb library
an HTTP request with multipart MIME encoding that contains a
malformed MIME boundary specifier beginning with “-” instead of
“–“. Successful exploitation of the vulnerability causes the
library to go into an infinite loop waiting for additional
non-existent input.
Workaround
There is no known workaround at this time.
Resolution
All Ruby users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-lang/ruby-1.8.5-r3"
References
[ 1 ] CVE-2006-5467
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5467
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-12.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 200611-13
Severity: Normal
Title: Avahi: “netlink” message vulnerability
Date: November 20, 2006
Bugs: #154322
ID: 200611-13
Synopsis
Avahi fails to verify the origin of netlink messages, which
could allow local users to spoof network changes.
Background
Avahi is a system that facilitates service discovery on a local
network.
Affected packages
Package / Vulnerable / Unaffected
1 net-dns/avahi < 0.6.15 >= 0.6.15
Description
Avahi does not check that the netlink messages come from the
kernel instead of a user-space process.
Impact
A local attacker could exploit this vulnerability by crafting
malicious netlink messages and trick Avahi to react to fake network
changes. This could lead users to connect to untrusted services
without knowing.
Workaround
There is no known workaround at this time.
Resolution
All Avahi users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-dns/avahi-0.6.15"
References
[ 1 ] CVE-2006-5461
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5461
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-13.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 200611-14
Severity: High
Title: TORQUE: Insecure temproary file creation
Date: November 20, 2006
Bugs: #152104
ID: 200611-14
Synopsis
TORQUE creates temporary files in an insecure manner which could
lead to the execution of arbitrary code with elevated
privileges.
Background
TORQUE is a resource manager providing control over batch jobs
and distributed compute nodes.
Affected packages
Package / Vulnerable / Unaffected
1 sys-cluster/torque < 2.1.2-r2 >= 2.1.2-r2
Description
TORQUE creates temporary files with predictable names. Please
note that the TORQUE package shipped in Gentoo Portage is not
vulnerable in the default configuration. Only systems with more
permissive access rights to the spool directory are vulnerable.
Impact
A local attacker could create links in the temporary file
directory, pointing to a valid file somewhere on the filesystem.
This could lead to the execution of arbitrary code with elevated
privileges.
Workaround
Ensure that untrusted users don’t have write access to the spool
directory.
Resolution
All TORQUE users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-cluster/torque-2.1.2-r2"
References
[ 1 ] CVE-2006-5677
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5677
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-14.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 200611-15
Severity: High
Title: qmailAdmin: Buffer overflow
Date: November 21, 2006
Bugs: #153896
ID: 200611-15
Synopsis
qmailAdmin is vulnerable to a buffer overflow that could lead to
the remote execution of arbitrary code.
Background
qmailAdmin is a free software package that provides a web
interface for managing a qmail system with virtual domains.
Affected packages
Package / Vulnerable / Unaffected
1 net-mail/qmailadmin < 1.2.10 >= 1.2.10
Description
qmailAdmin fails to properly handle the “PATH_INFO” variable in
qmailadmin.c. The PATH_INFO is a standard CGI environment variable
filled with user supplied data.
Impact
A remote attacker could exploit this vulnerability by sending
qmailAdmin a maliciously crafted URL that could lead to the
execution of arbitrary code with the permissions of the user
running qmailAdmin.
Workaround
There is no known workaround at this time.
Resolution
All qmailAdmin users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/qmailadmin-1.2.10"
References
[ 1 ] CVE-2006-1141
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1141
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-15.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Gentoo Linux Security Advisory GLSA 200611-16
Severity: Normal
Title: Texinfo: Buffer overflow
Date: November 21, 2006
Bugs: #154316
ID: 200611-16
Synopsis
Texinfo is vulnerable to a buffer overflow that could lead to
the execution of arbitrary code.
Background
Texinfo is the official documentation system of the GNU
project.
Affected packages
Package / Vulnerable / Unaffected
1 sys-apps/texinfo < 4.8-r5 >= 4.8-r5
Description
Miloslav Trmac from Red Hat discovered a buffer overflow in the
“readline()” function of texindex.c. The “readline()” function is
called by the texi2dvi and texindex commands.
Impact
By enticing a user to open a specially crafted Texinfo file, an
attacker could execute arbitrary code with the rights of the user
running Texinfo.
Workaround
There is no known workaround at this time.
Resolution
All Texinfo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-apps/texinfo-4.8-r5"
References
[ 1 ] CVE-2006-4810
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4810
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200611-16.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2006 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
Mandriva Linux
Mandriva Linux Security Advisory MDKSA-2006:215
http://www.mandriva.com/security/
Package : avahi
Date : November 20, 2006
Affected: 2007.0
Problem Description:
Steve Grubb discovered that netlink messages were not being
checked for their sender identity. This could lead to local users
manipulating the Avahi service.
Packages have been patched to correct this issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5461
Updated Packages:
Mandriva Linux 2007.0:
8b8082eb0c550bfa56e1ab6df6c26224
2007.0/i586/avahi-0.6.13-4.1mdv2007.0.i586.rpm
54b76c1c12ed46b8e5983e1f71eb9b06
2007.0/i586/avahi-dnsconfd-0.6.13-4.1mdv2007.0.i586.rpm
8284c933fed872b3e3f5817645c0ef92
2007.0/i586/avahi-python-0.6.13-4.1mdv2007.0.i586.rpm
dbb80e6511092bb8f1c6d0d6a06c6abf
2007.0/i586/avahi-sharp-0.6.13-4.1mdv2007.0.i586.rpm
d7b2c63469f8d7e02bd7a2b54e116bbe
2007.0/i586/avahi-x11-0.6.13-4.1mdv2007.0.i586.rpm
f7fa07cccd9dd0830250db788a2a1b81
2007.0/i586/libavahi-client3-0.6.13-4.1mdv2007.0.i586.rpm
eecd18f14552d70f1b18249fe7b1195f
2007.0/i586/libavahi-client3-devel-0.6.13-4.1mdv2007.0.i586.rpm
4bc4663193c8761ffad6fe5e22ef541e
2007.0/i586/libavahi-common3-0.6.13-4.1mdv2007.0.i586.rpm
ebdba95e5e7e8c5a681fc56165ada153
2007.0/i586/libavahi-common3-devel-0.6.13-4.1mdv2007.0.i586.rpm
950af5ad6ac377561ab7179e99aefb55
2007.0/i586/libavahi-compat-howl0-0.6.13-4.1mdv2007.0.i586.rpm
cb102e130142c9838f071136a5b3ec57
2007.0/i586/libavahi-compat-howl0-devel-0.6.13-4.1mdv2007.0.i586.rpm
1b7ef31a64921cb0562c757a9d0528bd
2007.0/i586/libavahi-compat-libdns_sd1-0.6.13-4.1mdv2007.0.i586.rpm
bd9acd313bac2d123926d14aa7db2fb4
2007.0/i586/libavahi-compat-libdns_sd1-devel-0.6.13-4.1mdv2007.0.i586.rpm
14369ebc6ae7a7d0b1b52b4996b3ae0c
2007.0/i586/libavahi-core4-0.6.13-4.1mdv2007.0.i586.rpm
e4e8f50ba75b30f9ff631c3aeefc18af
2007.0/i586/libavahi-core4-devel-0.6.13-4.1mdv2007.0.i586.rpm
13e2a3acd9536e836c3b446af59adeff
2007.0/i586/libavahi-glib1-0.6.13-4.1mdv2007.0.i586.rpm
cfe0b49f30234f8be62b0f3914979523
2007.0/i586/libavahi-glib1-devel-0.6.13-4.1mdv2007.0.i586.rpm
6c9058272513502a4d5980b63a19b530
2007.0/i586/libavahi-qt3_1-0.6.13-4.1mdv2007.0.i586.rpm
d846e199c543903d0ce9eeed2c2e9445
2007.0/i586/libavahi-qt3_1-devel-0.6.13-4.1mdv2007.0.i586.rpm
315e4463187ffc1d5492445af479615d
2007.0/i586/libavahi-qt4_1-0.6.13-4.1mdv2007.0.i586.rpm
606d90de97300ce0a8c648f1ec305ada
2007.0/i586/libavahi-qt4_1-devel-0.6.13-4.1mdv2007.0.i586.rpm
65a7cba76e2824cbab5797b38ed8ccc1
2007.0/SRPMS/avahi-0.6.13-4.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
9b25dad2dbf79d86c8c9c727f61e0a03
2007.0/x86_64/avahi-0.6.13-4.1mdv2007.0.x86_64.rpm
d7a8aabf6ab859767041c9abe20d51cd
2007.0/x86_64/avahi-dnsconfd-0.6.13-4.1mdv2007.0.x86_64.rpm
0117840569b82bddc137b8e78ea5f08b
2007.0/x86_64/avahi-python-0.6.13-4.1mdv2007.0.x86_64.rpm
e9332cffa74eb39a50488471d6ffa193
2007.0/x86_64/avahi-sharp-0.6.13-4.1mdv2007.0.x86_64.rpm
9a84e81be93c4f5609e3fafaf4f0309b
2007.0/x86_64/avahi-x11-0.6.13-4.1mdv2007.0.x86_64.rpm
7f9549b1457023b2b9fe4c2f9c8d2b53
2007.0/x86_64/lib64avahi-client3-0.6.13-4.1mdv2007.0.x86_64.rpm
299db6bd0cf61a35cea1c3753a191694
2007.0/x86_64/lib64avahi-client3-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
3edcf95944dac478d0bc3c804acf833d
2007.0/x86_64/lib64avahi-common3-0.6.13-4.1mdv2007.0.x86_64.rpm
b04bb0a5da39a6eee3b23b96374c1b19
2007.0/x86_64/lib64avahi-common3-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
6fc42297b5fa1253b718a81cbb1d4fd2
2007.0/x86_64/lib64avahi-compat-howl0-0.6.13-4.1mdv2007.0.x86_64.rpm
126c86c305e1e8acf3c6f93a078bf868
2007.0/x86_64/lib64avahi-compat-howl0-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
f5dbb9e0fa82ba39c19c1797391aa5d3
2007.0/x86_64/lib64avahi-compat-libdns_sd1-0.6.13-4.1mdv2007.0.x86_64.rpm
f579c55f1f3c6984a54cae5917156ae6
2007.0/x86_64/lib64avahi-compat-libdns_sd1-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
cdf62c1243fe9018809d7135968f12e1
2007.0/x86_64/lib64avahi-core4-0.6.13-4.1mdv2007.0.x86_64.rpm
6bee1aa33a4f7dfd58db568c29936482
2007.0/x86_64/lib64avahi-core4-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
750eef176729afa38c61b5688047cb5e
2007.0/x86_64/lib64avahi-glib1-0.6.13-4.1mdv2007.0.x86_64.rpm
83cd5fc0401ae0dc0b39f0e905938889
2007.0/x86_64/lib64avahi-glib1-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
53341592e5ab2b187367e1c673030a60
2007.0/x86_64/lib64avahi-qt3_1-0.6.13-4.1mdv2007.0.x86_64.rpm
3b001c78e6e8a5e8caf4b8edb9382a33
2007.0/x86_64/lib64avahi-qt3_1-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
92e05b16be7967c540d54cb19770a692
2007.0/x86_64/lib64avahi-qt4_1-0.6.13-4.1mdv2007.0.x86_64.rpm
dc322609350d49ee527b3e59679b2b79
2007.0/x86_64/lib64avahi-qt4_1-devel-0.6.13-4.1mdv2007.0.x86_64.rpm
65a7cba76e2824cbab5797b38ed8ccc1
2007.0/SRPMS/avahi-0.6.13-4.1mdv2007.0.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Mandriva Linux Security Advisory MDKSA-2006:216
http://www.mandriva.com/security/
Package : links
Date : November 20, 2006
Affected: 2006.0, 2007.0
Problem Description:
The links web browser with smbclient installed allows remote
attackers to execute arbitrary code via shell metacharacters in an
smb:// URI, as demonstrated by using PUT and GET statements.
Corporate 3.0 is not affected by this issue, as that version of
links does not have smb:// URI support.
Updated packages have disabled access to smb:// URIs.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5925
Updated Packages:
Mandriva Linux 2006.0:
ea08f62d39a09dea86b7d1a5cb51e327
2006.0/i586/links-2.1-0.pre18.5.1.20060mdk.i586.rpm
adbcd46c1caf25846b7ff382ac6eee7d
2006.0/i586/links-common-2.1-0.pre18.5.1.20060mdk.i586.rpm
e87b887c09df5e888c097766e7ec619c
2006.0/i586/links-graphic-2.1-0.pre18.5.1.20060mdk.i586.rpm
ee822254533bf4719ee94223161b7de0
2006.0/SRPMS/links-2.1-0.pre18.5.1.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
796b482155ea5ab249bbe1baabcdd419
2006.0/x86_64/links-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
5f897e5f5d1c712b547bce7fdb7b61d4
2006.0/x86_64/links-common-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
93e5c42924fcafb2fc121c0d69b7f398
2006.0/x86_64/links-graphic-2.1-0.pre18.5.1.20060mdk.x86_64.rpm
ee822254533bf4719ee94223161b7de0
2006.0/SRPMS/links-2.1-0.pre18.5.1.20060mdk.src.rpm
Mandriva Linux 2007.0:
27f5da60ae0072b509e17326146922c1
2007.0/i586/links-2.1-0.pre18.13.1mdv2007.0.i586.rpm
b4dac2435e4622cabf537c4df1749d83
2007.0/i586/links-common-2.1-0.pre18.13.1mdv2007.0.i586.rpm
d33ab06111f877fbccb8f85ceb4044af
2007.0/i586/links-graphic-2.1-0.pre18.13.1mdv2007.0.i586.rpm
04961b71a4a04032a6e335dcaf91aa9d
2007.0/SRPMS/links-2.1-0.pre18.13.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
fe702c658fd4b931c8c79efd9c77010b
2007.0/x86_64/links-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
5d8d03edf4217e9d3a6ab7f006c5613a
2007.0/x86_64/links-common-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
e1c5effc08dfbc2e2c8b1bc351f4ea50
2007.0/x86_64/links-debug-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
8fd02e550d5310ae74e48f002d7da45b
2007.0/x86_64/links-graphic-2.1-0.pre18.13.1mdv2007.0.x86_64.rpm
04961b71a4a04032a6e335dcaf91aa9d
2007.0/SRPMS/links-2.1-0.pre18.13.1mdv2007.0.src.rpm
To upgrade automatically use MandrivaUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
All packages are signed by Mandriva for security. You can obtain
the GPG public key of the Mandriva Security Team by executing:
gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
Mandriva Linux Security Advisory MDKSA-2006:217
http://www.mandriva.com/security/
Package : proftpd
Date : November 20, 2006
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0
Problem Description:
As disclosed by an exploit (vd_proftpd.pm) and a related vendor
bugfix, a Denial of Service (DoS) vulnerability exists in the FTP
server ProFTPD, up to and including version 1.3.0. The flaw is due
to both a potential bus error and a definitive buffer overflow in
the code which determines the FTP command buffer size limit. The
vulnerability can be exploited only if the “CommandBufferSize”
directive is explicitly used in the server configuration, which is
not the case in the default configuration of ProFTPD.
Packages have been patched to correct these issues.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5815
Updated Packages:
Mandriva Linux 2006.0:
0053ca9816e0bc25bccfe2f44d908eda
2006.0/i586/proftpd-1.2.10-13.2.20060mdk.i586.rpm
b01ed124f81f9f57c3217638f2b248fe
2006.0/i586/proftpd-anonymous-1.2.10-13.2.20060mdk.i586.rpm
0baf0a1757155c41e5a9748f3b5a2977
2006.0/SRPMS/proftpd-1.2.10-13.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
19c1348e2378d8e266543e9f411e7bec
2006.0/x86_64/proftpd-1.2.10-13.2.20060mdk.x86_64.rpm
0c61b1862cea2be964ec7117d3c1fa9e
2006.0/x86_64/proftpd-anonymous-1.2.10-13.2.20060mdk.x86_64.rpm
0baf0a1757155c41e5a9748f3b5a2977
2006.0/SRPMS/proftpd-1.2.10-13.2.20060mdk.src.rpm
Mandriva Linux 2007.0:
d1b46e09401cff86b5eb3cff5bb5d92d
2007.0/i586/proftpd-1.3.0-4.2mdv2007.0.i586.rpm
50dfa344357ea77649c760086d99efc5
2007.0/i586/proftpd-anonymous-1.3.0-4.2mdv2007.0.i586.rpm
ac4ffe2be045a45877c8ef5fca8aff82
2007.0/i586/proftpd-mod_autohost-1.3.0-4.2mdv2007.0.i586.rpm
a220594eecdf47d08047592dfc6ed989
2007.0/i586/proftpd-mod_case-1.3.0-4.2mdv2007.0.i586.rpm
ac8757c2cfda84be9340518730b2b0a9
2007.0/i586/proftpd-mod_clamav-1.3.0-4.2mdv2007.0.i586.rpm
a4e8f9e4399c3455586c0ad5ece2a9ba
2007.0/i586/proftpd-mod_ctrls_admin-1.3.0-4.2mdv2007.0.i586.rpm
6f3d1d596e634cbc725728606a220d74
2007.0/i586/proftpd-mod_facl-1.3.0-4.2mdv2007.0.i586.rpm
093f77c4bf48659600d2255a55d8c66a
2007.0/i586/proftpd-mod_gss-1.3.0-4.2mdv2007.0.i586.rpm
527188db7f7c0b6db43308823c7a245a
2007.0/i586/proftpd-mod_ifsession-1.3.0-4.2mdv2007.0.i586.rpm
3ad7759d27a44aafc84ef531c3ce0d83
2007.0/i586/proftpd-mod_ldap-1.3.0-4.2mdv2007.0.i586.rpm
70db19b073046a2baffe846c2287e00c
2007.0/i586/proftpd-mod_load-1.3.0-4.2mdv2007.0.i586.rpm
70416dbf2150fa2e29c9003cd9db627d
2007.0/i586/proftpd-mod_quotatab-1.3.0-4.2mdv2007.0.i586.rpm
62d8b7d49b89addb5a86962cf0efe210
2007.0/i586/proftpd-mod_quotatab_file-1.3.0-4.2mdv2007.0.i586.rpm
13431e876946f486a83e28d458e58e50
2007.0/i586/proftpd-mod_quotatab_ldap-1.3.0-4.2mdv2007.0.i586.rpm
4b95fe99c77ff967238ebf7c938c7d44
2007.0/i586/proftpd-mod_quotatab_sql-1.3.0-4.2mdv2007.0.i586.rpm
116be0e7b33ed3862408440e61a7827e
2007.0/i586/proftpd-mod_radius-1.3.0-4.2mdv2007.0.i586.rpm
00597f2284411df840d1d76c21d232a7
2007.0/i586/proftpd-mod_ratio-1.3.0-4.2mdv2007.0.i586.rpm
c57184424270ab38993930258ae4ef3a
2007.0/i586/proftpd-mod_rewrite-1.3.0-4.2mdv2007.0.i586.rpm
dcdabe501922432bfaa13e4520caee54
2007.0/i586/proftpd-mod_shaper-1.3.0-4.2mdv2007.0.i586.rpm
08f8675c360532db8679809c2df0a8bb
2007.0/i586/proftpd-mod_site_misc-1.3.0-4.2mdv2007.0.i586.rpm
5e7503e52019351d1eaef57e1e63ef9e
2007.0/i586/proftpd-mod_sql-1.3.0-4.2mdv2007.0.i586.rpm
6ba4cc9d229111078df98081f0821600
2007.0/i586/proftpd-mod_sql_mysql-1.3.0-4.2mdv2007.0.i586.rpm
ec5429aaf01a432eeb4cc6ccfcf9183f
2007.0/i586/proftpd-mod_sql_postgres-1.3.0-4.2mdv2007.0.i586.rpm
dde8bc68edac5463601886b53756c402
2007.0/i586/proftpd-mod_time-1.3.0-4.2mdv2007.0.i586.rpm
133560087f64cfa06b765cfda2b24780
2007.0/i586/proftpd-mod_tls-1.3.0-4.2mdv2007.0.i586.rpm
eef642bb96557634370d24e040a3e3fd
2007.0/i586/proftpd-mod_wrap-1.3.0-4.2mdv2007.0.i586.rpm
14f19ba95138a85a53c17173e006552f
2007.0/i586/proftpd-mod_wrap_file-1.3.0-4.2mdv2007.0.i586.rpm
7a4ef558e014459382192aeac06a0bf6