Debian Security Advisory DSA 530-1 security@debian.org
http://www.debian.org/security/
Matt Zimmerman
July 17th, 2004 http://www.debian.org/security/faq
Package : l2tpd
Vulnerability : buffer overflow
Problem-Type : remote
Debian-specific: no
CVE Ids : CAN-2004-0649
Thomas Walpuski reported a buffer overflow in l2tpd, an
implementation of the layer 2 tunneling protocol, whereby a remote
attacker could potentially cause arbitrary code to be executed by
transmitting a specially crafted packet. The exploitability of this
vulnerability has not been verified.
For the current stable distribution (woody), this problem has
been fixed in version 0.67-1.2.
For the unstable distribution (sid), this problem has been fixed
in version 0.70-pre20031121-2.
We recommend that you update your l2tpd package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2.dsc
Size/MD5 checksum: 556 7dea8c1dda28eeea5d17f2e3eef27ef6
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2.diff.gz
Size/MD5 checksum: 2756 fd3fcde3269326d01187ee6e860c0219
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67.orig.tar.gz
Size/MD5 checksum: 121685 d40065070e34c44389e4c749b61916c6
Alpha architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.1_alpha.deb
Size/MD5 checksum: 99940 a3caa77d343536f68753ea64aa336a45
ARM architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_arm.deb
Size/MD5 checksum: 90958 5030f6fcd05f33875542e4c1da3e553f
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_i386.deb
Size/MD5 checksum: 87946 456410152e2a33ceb07acff26b0dea61
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_ia64.deb
Size/MD5 checksum: 110936 12debc780c212f23ae5b8c313e2e51f1
HP Precision architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_hppa.deb
Size/MD5 checksum: 95130 35687ebaea9442cef6e93b838071da97
Motorola 680×0 architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_m68k.deb
Size/MD5 checksum: 84972 fd4e1e3016d651eeecc3e3af6df67511
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_mips.deb
Size/MD5 checksum: 94778 c757bcea1d651ba7a5e995edaad2fe9e
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_mipsel.deb
Size/MD5 checksum: 95122 2ca8db2f234ac416791c09b9b3b1de68
PowerPC architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_powerpc.deb
Size/MD5 checksum: 89470 3ef1b4d68491e25efe134331d90fd01c
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_s390.deb
Size/MD5 checksum: 88580 52bd54f9df953734be455a3b595db411
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/l/l2tpd/l2tpd_0.67-1.2_sparc.deb
Size/MD5 checksum: 91992 34513399dd07a1aed7f4b96904f5a2db
These files will probably be moved into the stable distribution
on its next revision.
–
Debian Security Advisory DSA 529-1 security@debian.org
http://www.debian.org/security/
Matt Zimmerman
July 17th, 2004 http://www.debian.org/security/faq
Package : netkit-telnet-ssl
Vulnerability : format string
Problem-Type : remote
Debian-specific: no
CVE Ids : CAN-2004-0640
b0f discovered a format string vulnerability in
netkit-telnet-ssl which could potentially allow a remote attacker
to cause the execution of arbitrary code with the privileges of the
telnet daemon (the ‘telnetd’ user by default).
For the current stable distribution (woody), this problem has
been fixed in version 0.17.17+0.1-2woody1.
For the unstable distribution (sid), this problem has been fixed
in version 0.17.24+0.1-2.
We recommend that you update your netkit-telnet-ssl package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
These files will probably be moved into the stable distribution
on its next revision.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>