- -------------------------------------------------------------------------- Debian Security Advisory DSA 150-1 security@debian.org http://www.debian.org/security/ Martin Schulze August 13th, 2002 - -------------------------------------------------------------------------- Package : interchange Vulnerability : illegal file exposition Problem-Type : remote Debian-specific: no A problem has been discovered in Interchange, an e-commerce and general HTTP database display system, which can lead to an attacker being able to read any file to which the user of the Interchange daemon has sufficient permissions, when Interchange runs in "INET mode" (internet domain socket). This is not the default setting in Debian packages, but configurable with Debconf and via configuration file. We also believe that this bug cannot exploited on a regular Debian system. This problem has been fixed by the package maintainer in version 4.8.3.20020306-1.woody.1 for the current stable distribution (woody) and in version 4.8.6-1 for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't ship the Interchange system. We recommend that you upgrade your interchange packages. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1.dsc Size/MD5 checksum: 883 ffa49ff2144a7bd4320eb9c2198d24b3 http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1.diff.gz Size/MD5 checksum: 528 60c7cb2c1798ae2f61365e130d1772d3 http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306.orig.tar.gz Size/MD5 checksum: 1858749 660c7e65732a052a81d2ae6e4c6ed2b5 Architecture independent components: http://security.debian.org/pool/updates/main/i/interchange/interchange-cat-foundation_4.8.3.20020306-1.woody.1_all.deb Size/MD5 checksum: 635062 6ebceb949aad1dc23e364dd297125c8f http://security.debian.org/pool/updates/main/i/interchange/interchange-ui_4.8.3.20020306-1.woody.1_all.deb Size/MD5 checksum: 432068 3f9574521ced0bc39c40793c74841947 Alpha architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_alpha.deb Size/MD5 checksum: 856324 a903c5f415978bda83ebc64e533d6513 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_alpha.deb Size/MD5 checksum: 13812 21dcdb083b2d93e8b72cb06e3b9b3d77 ARM architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_arm.deb Size/MD5 checksum: 854980 80a5246531dc085d5ef629dd1337271c http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_arm.deb Size/MD5 checksum: 13198 63fe3b689099793c61b2bbb870c101e3 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_i386.deb Size/MD5 checksum: 852744 7a40058ecc9119c740826b3dbc9660d0 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_i386.deb Size/MD5 checksum: 13156 234c7d614aa28de64d5d33dcb49e654d Intel IA-64 architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_ia64.deb Size/MD5 checksum: 858420 6f16f350d5d162b2bbac98bb4e7dc857 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_ia64.deb Size/MD5 checksum: 15670 fcfacf2758ac97a9ee6390bf20b9f64b HP Precision architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_hppa.deb Size/MD5 checksum: 856104 4d7932a5d476acf49eda3ca2ecc4bf89 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_hppa.deb Size/MD5 checksum: 13920 a4593d918b5c9c87434544ed7d0af579 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_m68k.deb Size/MD5 checksum: 855146 de6a211e1b615dded617c9ff9877b897 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_m68k.deb Size/MD5 checksum: 13168 fda641d6355b9141fc2afde7b87c95c0 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_mips.deb Size/MD5 checksum: 855866 75c9d826ef0c1352b3a035d22d0867cf http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_mips.deb Size/MD5 checksum: 13236 4abca0332cc562ee5a624c8eb15cfa5f Little endian MIPS architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_mipsel.deb Size/MD5 checksum: 855776 3d9df00fd5fb6bee01222e9e263edc66 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_mipsel.deb Size/MD5 checksum: 13238 59556c80240d01d47bfba36b20e5c34b PowerPC architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_powerpc.deb Size/MD5 checksum: 855224 2b0bb6d175fbe6194ef1b05c14069fcc http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_powerpc.deb Size/MD5 checksum: 13140 ff191322a2afd7b6bae946137f1835a8 IBM S/390 architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_s390.deb Size/MD5 checksum: 855636 3e35f8611357c023520871f38782fc94 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_s390.deb Size/MD5 checksum: 13440 22c5fdd8fe658f59db6ac859c6e8ff55 Sun Sparc architecture: http://security.debian.org/pool/updates/main/i/interchange/interchange_4.8.3.20020306-1.woody.1_sparc.deb Size/MD5 checksum: 858130 7dafc5291988bf31737058939f381ab3 http://security.debian.org/pool/updates/main/i/interchange/libapache-mod-interchange_4.8.3.20020306-1.woody.1_sparc.deb Size/MD5 checksum: 13274 6342b55b347c6bbd330f9facd1fd8122 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- - -------------------------------------------------------------------------- Debian Security Advisory DSA 151-1 security@debian.org http://www.debian.org/security/ Martin Schulze August 13th, 2002 - -------------------------------------------------------------------------- Package : xinetd Vulnerability : pipe exposure Problem-Type : local Debian-specific: no Solar Designer found a vulnerability in xinetd, a replacement for the BSD derived inetd. File descriptors for the signal pipe introduced in version 2.3.4 are leaked into services started from xinetd. The descriptors could be used to talk to xinetd resulting in crashing it entirely. This is usually called a denial of service. This problem has been fixed by the package maintainer in version 2.3.4-1.2 for the current stable distribution (woody) and in version 2.3.7-1 for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain the signal pipe. We recommend that you upgrade your xinetd packages. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2.dsc Size/MD5 checksum: 596 6e437a7317228d6baaf1013cc060dcd9 http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2.diff.gz Size/MD5 checksum: 34109 ea09f66719c48976345d104c94d8d7a0 http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4.orig.tar.gz Size/MD5 checksum: 270723 8f7ac612910aaf811c4554f4ab40fd65 Alpha architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_alpha.deb Size/MD5 checksum: 144548 4a380b4e80f789be31e41b3cc1ca6c25 ARM architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_arm.deb Size/MD5 checksum: 119372 e9f22ebf109fbbb45e2488090b024a78 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_i386.deb Size/MD5 checksum: 114380 82e2f7248fcec69f1a4390d4e22c799d Intel IA-64 architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_ia64.deb Size/MD5 checksum: 170536 a0545b8a5b0989e04f1178592aeec414 HP Precision architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_hppa.deb Size/MD5 checksum: 134914 b2f95d5464fe03115f8b6c88f2587939 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_m68k.deb Size/MD5 checksum: 109000 1c59983898111932ed5554708742fd73 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_mips.deb Size/MD5 checksum: 133488 711b97de8092f465b89a8c3b332c0198 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_mipsel.deb Size/MD5 checksum: 134214 21ef9ae6317261fade057163cafc7d01 PowerPC architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_powerpc.deb Size/MD5 checksum: 124404 87b9958221e1bf9048a4d3650cd89e21 IBM S/390 architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_s390.deb Size/MD5 checksum: 120268 1248fb8bbb886916c25e2ac5d2523bd4 Sun Sparc architecture: http://security.debian.org/pool/updates/main/x/xinetd/xinetd_2.3.4-1.2_sparc.deb Size/MD5 checksum: 124144 055c71fccc937b6784d114cb7860a171 These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- - -------------------------------------------------------------------------- Debian Security Advisory DSA 152-1 security@debian.org http://www.debian.org/security/ Martin Schulze August 13th, 2002 - -------------------------------------------------------------------------- Package : l2tpd Vulnerability : missing random seed Problem-Type : remote Debian-specific: no Current versions of l2tpd, a layer 2 tunneling client/server program, forgot to initialize the random generator which made it vulnerable since all generated random number were 100% guessable. When dealing with the size of the value in an attribute value pair, too many bytes were able to be copied, which could lead into the vendor field being overwritten. These problems have been fixed in version 0.67-1.1 for the current stable distribution (woody) and in version 0.68-1 for the unstable distribution (sid). The old stable distribution (potato) is not affected, since it doesn't contain the l2tpd package. We recommend that you upgrade your l2tpd packages. wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1.dsc Size/MD5 checksum: 556 ffe4fded4647ac003ffdd4978661ca15 http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1.diff.gz Size/MD5 checksum: 2339 b647394faed6dba02687e7709299836a http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67.orig.tar.gz Size/MD5 checksum: 121685 d40065070e34c44389e4c749b61916c6 Alpha architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_alpha.deb Size/MD5 checksum: 99940 a3caa77d343536f68753ea64aa336a45 ARM architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_arm.deb Size/MD5 checksum: 90756 603a9b88e98001c1602d464571dce765 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_i386.deb Size/MD5 checksum: 88130 bbd745997296fd61edc9777de121c9a5 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_ia64.deb Size/MD5 checksum: 110726 dc180c2040f8f29f868e5039e09b0879 HP Precision architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_hppa.deb Size/MD5 checksum: 94918 9629d5a679cf336036d485a32fa0b6db Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_m68k.deb Size/MD5 checksum: 84818 c61280d6f968b9052dfc9f9e5c34cbd5 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_mips.deb Size/MD5 checksum: 94608 62cfeab1e06185f58b79c7c8f3b93cce Little endian MIPS architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_mipsel.deb Size/MD5 checksum: 94944 6d164b24e067355b26b7234434ff21cb PowerPC architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_powerpc.deb Size/MD5 checksum: 89318 a736a5fc05493393e1b0ade0097f60a0 IBM S/390 architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_s390.deb Size/MD5 checksum: 87736 6e1d259729d21a92537c38d315f0286f Sun Sparc architecture: http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_sparc.deb Size/MD5 checksum: 91790 faade7c56590eae84e8b0ef14014a29b These files will probably be moved into the stable distribution on its next revision. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>;