From: Wichert Akkerman <wichert@wiggy.net>
Reply-To: security@debian.org
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA-091-1] OpenSSH UseLogin vulnerability
Date: 05 Dec 2001 15:33:57 +0100
Package : ssh
Problem type : influencing login
Debian-specific: no
If the UseLogin feature is enabled in for ssh local users could
pass environment variables (including variables like LD_PRELOAD)
to the login process. This has been fixed by not copying the
environment of UseLogin is enabled.
Please note that the default configuration for Debian does not
have the UseLogin enabled.
This has been fixed in version 1:1.2.3-9.4.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
- ---------------------------------
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.diff.gz
MD5 checksum: a3600ed331f986cf4c9e8999bc5d69cb
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3-9.4.dsc
MD5 checksum: 30c2e9775b9bbb214afd95a731e0f482
http://security.debian.org/dists/stable/updates/main/source/openssh_1.2.3.orig.tar.gz
MD5 checksum: 6aad0cc9ceca55f138ed1ba4cf660349
Architecture independent archives:
http://security.debian.org/dists/stable/updates/main/binary-all/ssh-askpass-ptk_1.2.3-9.4_all.deb
MD5 checksum: eb61f2cbd0a985ad91460676c54e8234
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh-askpass-gnome_1.2.3-9.4_alpha.deb
MD5 checksum: a1ff36aea22f0c93c6800fb1a282c15a
http://security.debian.org/dists/stable/updates/main/binary-alpha/ssh_1.2.3-9.4_alpha.deb
MD5 checksum: 5cae8437e415dd274d9de6ad86bd293a
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/ssh-askpass-gnome_1.2.3-9.4_arm.deb
MD5 checksum: 5d5df2cda09d9edaf17c24d5cfe7c4a3
http://security.debian.org/dists/stable/updates/main/binary-arm/ssh_1.2.3-9.4_arm.deb
MD5 checksum: 88eaecbcf5f1e2a8fc4a1a5bffb7dad2
Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/ssh-askpass-gnome_1.2.3-9.4_i386.deb
MD5 checksum: 174cc64dbb0996cd09d58f2691817dbf
http://security.debian.org/dists/stable/updates/main/binary-i386/ssh_1.2.3-9.4_i386.deb
MD5 checksum: 1426d1c8d424b8af6e94a1eec87075aa
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh-askpass-gnome_1.2.3-9.4_m68k.deb
MD5 checksum: 78c897a689e04ffd20e1b0230b85f452
http://security.debian.org/dists/stable/updates/main/binary-m68k/ssh_1.2.3-9.4_m68k.deb
MD5 checksum: e0ca14452953a318dec512b739f8fec4
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh-askpass-gnome_1.2.3-9.4_powerpc.deb
MD5 checksum: 17bdb2cc2381defd4fb10bb963de9c19
http://security.debian.org/dists/stable/updates/main/binary-powerpc/ssh_1.2.3-9.4_powerpc.deb
MD5 checksum: 8f80b6a56f437589edbeb0ca2c3321e3
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh-askpass-gnome_1.2.3-9.4_sparc.deb
MD5 checksum: a65d2465bb5372a5153b2c5afd4929ec
http://security.debian.org/dists/stable/updates/main/binary-sparc/ssh_1.2.3-9.4_sparc.deb
MD5 checksum: 687aa2c7dd8295b1c6bb0cac5d6c6c06
These packages will be moved into the stable distribution on its next
revision.
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/ .
From: Wichert Akkerman <wichert@wiggy.net>
Reply-To: security@debian.org
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA-089-1] several problems in icecast-server
Date: 05 Dec 2001 12:32:52 +0100
Package : icecast-server
Problem type : remote root exploit (and others)
Debian-specific: no
The icecast-server (a streaming music server) package as distributed
in Debian GNU/Linux 2.2 has several security problems:
* if a client added a / after the filename of a file to be downloaded
the server would crash
* by escaping dots as %2E it was possible to circumvent security measures
and download arbitrary files
* there were several buffer overflows that could be exploited to
gain root access
These have been fixed in version 1.3.10-1, and we strongly recommend
that you upgrade your icecast-server package immediately.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
- ---------------------------------
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/icecast-server_1.3.10-1.dsc
MD5 checksum: 1bc6e9ad32ac36ee3aa696433e01238e
http://security.debian.org/dists/stable/updates/main/source/icecast-server_1.3.10-1.tar.gz
MD5 checksum: 7274a8795e854789f42713b9ce6adfff
Alpha architecture:
http://security.debian.org/dists/stable/updates/main/binary-alpha/icecast-server_1.3.10-1_alpha.deb
MD5 checksum: b35a6b302ee9a6acbd924f2fe3683880
ARM architecture:
http://security.debian.org/dists/stable/updates/main/binary-arm/icecast-server_1.3.10-1_arm.deb
MD5 checksum: 10da80b8b3aa0b0d94203f1b42a257b8
Intel IA-32 architecture:
http://security.debian.org/dists/stable/updates/main/binary-i386/icecast-server_1.3.10-1_i386.deb
MD5 checksum: eb3869696168f5fad229166490061d4b
Motorola 680x0 architecture:
http://security.debian.org/dists/stable/updates/main/binary-m68k/icecast-server_1.3.10-1_m68k.deb
MD5 checksum: 879e091a75a3d68fbaabfff30651ff9a
PowerPC architecture:
http://security.debian.org/dists/stable/updates/main/binary-powerpc/icecast-server_1.3.10-1_powerpc.deb
MD5 checksum: 20d406a0dba293b046cbd65405894849
Sun Sparc architecture:
http://security.debian.org/dists/stable/updates/main/binary-sparc/icecast-server_1.3.10-1_sparc.deb
MD5 checksum: e4e7e37ccbb6993c67bd936cfa7b848b
These packages will be moved into the stable distribution on its next
revision.
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
From: Wichert Akkerman <wichert@wiggy.net>
Reply-To: security@debian.org
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] [DSA-088-1] improper character escaping in fml
Date: 05 Dec 2001 12:30:38 +0100
Package : fml
Problem type : improper character escaping
Debian-specific: no
The fml (a mailing list package) as distributed in Debian GNU/Linux 2.2
suffers from a cross-site scripting problem. When generating index
pages for list archives the `<' and `>' characters were not properly
escaped for subjects.
This has been fixed in version 3.0+beta.20000106-5, and we recommend
that you upgrade your fml package to that version. Upgrading will
automatically regenerate the index pages.
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
Debian GNU/Linux 2.2 alias potato
-
Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
Source archives:
http://security.debian.org/dists/stable/updates/main/source/fml_3.0+beta.20000106-5.diff.gz
MD5 checksum: 67b5d072dd0da3846f95db595545ca97
http://security.debian.org/dists/stable/updates/main/source/fml_3.0+beta.20000106-5.dsc
MD5 checksum: 99a9d695a1b45eb7ee865709551da6f2
http://security.debian.org/dists/stable/updates/main/source/fml_3.0+beta.20000106.orig.tar.gz
MD5 checksum: 35ed0841980a7de7d1d31d9f715fb50b
Architecture independent archives:
http://security.debian.org/dists/stable/updates/main/binary-all/fml_3.0+beta.20000106-5_all.deb
MD5 checksum: 022401cdfa939b628a10b6d8109a6c72
These packages will be moved into the stable distribution on its next
revision.
For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
