Gentoo Linux Advisories: Cherokee, ppp, Archive::Zip

---

Gentoo Linux Security Advisory GLSA 200411-02

---

http://security.gentoo.org/

---

Severity: High
Title: Cherokee: Format string vulnerability
Date: November 01, 2004
Bugs: #67667
ID: 200411-02

---

Synopsis

Cherokee contains a format string vulnerability that could lead
to denial of service or the execution of arbitary code.

Background

Cherokee is an extra-light web server.

Affected packages

Description

Florian Schilhabel from the Gentoo Linux Security Audit Team
found a format string vulnerability in the
cherokee_loggerncsawrite_string()
function.

Impact

Using a specially crafted URL when authenticating via auth_pam,
a malicious user may be able to crash the server or execute
arbitrary code on the target machine with permissions of the user
running Cherokee.

Workaround

There is no known workaround at this time.

Resolution

All Cherokee users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-servers/cherokee-0.4.17.1"

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200411-02.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

---

Gentoo Linux Security Advisory GLSA 200411-01

---

http://security.gentoo.org/

---

Severity: Normal
Title: ppp: Remote denial of service vulnerability
Date: November 01, 2004
Bugs: #69152
ID: 200411-01

---

Synopsis

pppd contains a vulnerability that may allow an attacker to
crash the server.

Background

ppp is a Unix implementation of the Point-to-Point Protocol.

Affected packages

Description

The pppd server improperly verifies header fields, making it
vulnerable to denial of service attacks.

Impact

An attacker can cause the pppd server to access memory that it
isn’t allowed to, causing the server to crash. No code execution is
possible with this vulnerability, because no data is getting
copied.

Workaround

There is no known workaround at this time.

Resolution

All ppp users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=3Dnet-dialup/ppp-2.4.2-r7"

References

[ 1 ] BugTraq Advisory

http://www.securityfocus.com/archive/1/379450

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200411-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0

---

Gentoo Linux Security Advisory GLSA 200410-31

---

http://security.gentoo.org/

---

Severity: Low
Title: Archive::Zip: Virus detection evasion
Date: October 29, 2004
Bugs: #68616
ID: 200410-31

---

Synopsis

Email virus scanning software relying on Archive::Zip can be
fooled into thinking a ZIP attachment is empty while it contains a
virus, allowing detection evasion.

Background

Archive::Zip is a Perl module containing functions to handle ZIP
archives.

Affected packages

Description

Archive::Zip can be used by email scanning software (like
amavisd-new) to uncompress attachments before virus scanning. By
modifying the uncompressed size of archived files in the global
header of the ZIP file, it is possible to fool Archive::Zip into
thinking some files inside the archive have zero length.

Impact

An attacker could send a carefully crafted ZIP archive
containing a virus file and evade detection on some email
virus-scanning software relying on Archive::Zip for
decompression.

Workaround

There is no known workaround at this time.

Resolution

All Archive::Zip users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=dev-perl/Archive-Zip-1.14"

References

[ 1 ] iDEFENSE Security Advisory 10.18.04

http://www.idefense.com/application/poi/display?id=153

[ 2 ] rt.cpan.org/ bug
#8077

http://rt.cpan.org/NoAuth/Bug.html?id=8077

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200410-31.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2004 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/1.0