Gentoo Linux Security Advisory GLSA 200406-02
Severity: High
Title: tripwire: Format string vulnerability
Date: June 04, 2004
Bugs: #52945
ID: 200406-02
- Synopsis
- Background
- Affected packages
- Description
- Impact
- Workaround
- Resolution
- References
- Availability
- Concerns?
- License
- Synopsis
- Background
- Affected packages
- Description
- Impact
- Workaround
- Resolution
- References
- Availability
- Concerns?
- License
- Synopsis
- Background
- Affected packages
- Description
- Impact
- Workaround
- Resolution
- References
- Availability
- Concerns?
- License
Synopsis
A vulnerability allowing arbitrary code execution under certain
circumstances has been found.
Background
tripwire is an open source file integrity checker.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 app-admin/tripwire | <= 2.3.1.2 | >= 2.3.1.2-r1 |
Description
The code that generates email reports contains a format string
vulnerability in pipedmailmessage.cpp.
Impact
With a carefully crafted filename on a local filesystem an
attacker could cause execution of arbitrary code with permissions
of the user running tripwire, which could be the root user.
Workaround
There is no known workaround at this time.
Resolution
All tripwire users should upgrade to the latest stable
version:
# emerge sync
# emerge -pv ">=app-admin/tripwire-2.3.1.2-r1"
# emerge ">=app-admin/tripwire-2.3.1.2-r1"
References
[ 1 ] Bugtraq Announcement
http://www.securityfocus.com/archive/1/365036/2004-05-31/2004-06-06/0
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-02.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200406-01
Severity: High
Title: Ethereal: Multiple security problems
Date: June 04, 2004
Bugs: #51022
ID: 200406-01
Synopsis
Multiple vulnerabilities including one buffer overflow exist in
Ethereal, which may allow an attacker to run arbitrary code or
crash the program.
Background
Ethereal is a feature rich network protocol analyzer.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 net-analyzer/ethereal | <= 0.10.3 | >= 0.10.4 |
Description
There are multiple vulnerabilities in versions of Ethereal
earlier than 0.10.4, including:
- A buffer overflow in the MMSE dissector.
- Under specific conditions a SIP packet could make Ethereal
crash. - The AIM dissector could throw an assertion, causing Ethereal to
crash. - The SPNEGO dissector could dereference a null pointer, causing
a crash.
Impact
An attacker could use these vulnerabilities to crash Ethereal or
even execute arbitrary code with the permissions of the user
running Ethereal, which could be the root user.
Workaround
For a temporary workaround you can disable all affected protocol
dissectors by selecting Analyze->Enabled Protocols… and
deselecting them from the list. However, it is strongly recommended
to upgrade to the latest stable release.
Resolution
All Ethereal users should upgrade to the latest stable
version:
# emerge sync
# emerge -pv ">=net-analyzer/ethereal-0.10.4"
# emerge ">=net-analyzer/ethereal-0.10.4"
References
[ 1 ] Ethereal enpa-sa-00014
http://www.ethereal.com/appnotes/enpa-sa-00014.html
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-01.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0
Gentoo Linux Security Advisory GLSA 200406-03
Severity: Normal
Title: sitecopy: Multiple vulnerabilities in included libneon
Date: June 05, 2004
Bugs: #51585
ID: 200406-03
Synopsis
sitecopy includes a vulnerable version of the neon library.
Background
sitecopy easily maintains remote websites. It makes it simple to
keep a remote site synchronized with the local site with one
command.
Affected packages
| Package | Vulnerable | Unaffected |
| 1 net-misc/sitecopy | <= 0.13.4-r1 |
Description
Multiple format string vulnerabilities and a heap overflow
vulnerability were discovered in the code of the neon library (GLSA
200405-01 and 200405-13). Current versions of the sitecopy package
include their own version of this library.
Impact
When connected to a malicious WebDAV server, these
vulnerabilities could allow execution of arbitrary code with the
rights of the user running sitecopy.
Workaround
There is no known workaround at this time.
Resolution
Currently, there is no released version of sitecopy that
contains a fix for this issue. The original author of the program
has indicated he is unsure when a fixed version may be released.
Therefore, the sitecopy package has been hard-masked and current
users are advised to unmerge the package until a new version is
available.
# emerge -pv unmerge net-misc/sitecopy
# emerge unmerge net-misc/sitecopy
References
[ 1 ] GLSA 200405-01
http://www.gentoo.org/security/en/glsa/glsa-200405-01.xml
[ 2 ] GLSA 200405-13
http://www.gentoo.org/security/en/glsa/glsa-200405-13.xml
Availability
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200406-03.xml
Concerns?
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.
License
Copyright 2004 Gentoo Technologies, Inc; referenced text belongs
to its owner(s).
The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/1.0