Gentoo Linux Security Advisory GLSA 200411-02
Severity: High
Title: Cherokee: Format string vulnerability
Date: November 01, 2004
Bugs: #67667
ID: 200411-02
Synopsis
Cherokee contains a format string vulnerability that could lead
to denial of service or the execution of arbitary code.
Background
Cherokee is an extra-light web server.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 www-servers/cherokee | <= 0.4.17 | >= 0.4.17.1 |
Description
Florian Schilhabel from the Gentoo Linux Security Audit Team
found a format string vulnerability in the
cherokee_loggerncsawrite_string()
function.
Impact
Using a specially crafted URL when authenticating via auth_pam,
a malicious user may be able to crash the server or execute
arbitrary code on the target machine with permissions of the user
running Cherokee.
Workaround
There is no known workaround at this time.
Resolution
All Cherokee users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=www-servers/cherokee-0.4.17.1"
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200411-02.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200411-01
Severity: Normal
Title: ppp: Remote denial of service vulnerability
Date: November 01, 2004
Bugs: #69152
ID: 200411-01
Synopsis
pppd contains a vulnerability that may allow an attacker to
crash the server.
Background
ppp is a Unix implementation of the Point-to-Point Protocol.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 net-dialup/ppp | < 2.4.2-r7 | > 2.4.2-r7 |
Description
The pppd server improperly verifies header fields, making it
vulnerable to denial of service attacks.
Impact
An attacker can cause the pppd server to access memory that it
isn’t allowed to, causing the server to crash. No code execution is
possible with this vulnerability, because no data is getting
copied.
Workaround
There is no known workaround at this time.
Resolution
All ppp users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=3Dnet-dialup/ppp-2.4.2-r7"
References
[ 1 ] BugTraq Advisory
http://www.securityfocus.com/archive/1/379450
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200411-01.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200410-31
Severity: Low
Title: Archive::Zip: Virus detection evasion
Date: October 29, 2004
Bugs: #68616
ID: 200410-31
Synopsis
Email virus scanning software relying on Archive::Zip can be
fooled into thinking a ZIP attachment is empty while it contains a
virus, allowing detection evasion.
Background
Archive::Zip is a Perl module containing functions to handle ZIP
archives.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 dev-perl/Archive-Zip | < 1.14 | >= 1.14 |
Description
Archive::Zip can be used by email scanning software (like
amavisd-new) to uncompress attachments before virus scanning. By
modifying the uncompressed size of archived files in the global
header of the ZIP file, it is possible to fool Archive::Zip into
thinking some files inside the archive have zero length.
Impact
An attacker could send a carefully crafted ZIP archive
containing a virus file and evade detection on some email
virus-scanning software relying on Archive::Zip for
decompression.
Workaround
There is no known workaround at this time.
Resolution
All Archive::Zip users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-perl/Archive-Zip-1.14"
References
[ 1 ] iDEFENSE Security Advisory 10.18.04
http://www.idefense.com/application/poi/display?id=153
[ 2 ] rt.cpan.org/ bug
#8077
http://rt.cpan.org/NoAuth/Bug.html?id=8077
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200410-31.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.