---

Home Security

Security Digest: January 28, 2005

By

Fedora Core

Fedora Update Notification
FEDORA-2005-092
2005-01-28

Product : Fedora Core 3
Name : enscript
Version : 1.6.1
Release : 28.0.3
Summary : A plain ASCII to PostScript converter.

Description :
GNU enscript is a free replacement for Adobe’s Enscript program.
Enscript converts ASCII files to PostScript(TM) and spools
generated PostScript output to the specified printer or saves it to
a file. Enscript can be extended to handle different output media
and includes many options for customizing printouts.

Update Information:

This update fixes a regression introduced by the last
update.

  • Fri Jan 28 2005 Tim Waugh <twaugh@redhat.com>
    1.6.1-28.0.3

    • Fixed patch for CAN-2004-1184 (bug #144684).

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

0e32c89779133c6111e49d71b93c3d0e
SRPMS/enscript-1.6.1-28.0.3.src.rpm
ecace2a416113dcb0f7d176d28136d85
x86_64/enscript-1.6.1-28.0.3.x86_64.rpm
13af9cb9e347ba7d054a761c32b52930
x86_64/debug/enscript-debuginfo-1.6.1-28.0.3.x86_64.rpm
48f7746ef2d28e17bba91d9c2d986ec2
i386/enscript-1.6.1-28.0.3.i386.rpm
22c91a5ef8937d87b703493c7cffe2ec
i386/debug/enscript-debuginfo-1.6.1-28.0.3.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

Fedora Update Notification
FEDORA-2005-082
2005-01-28

Product : Fedora Core 3
Name : openswan
Version : 2.1.5
Release : 2.FC3.1
Summary : Openswan IPsec userland tools

Description :
Openswan is a free implementation of IPSEC & IKE for Linux.

IPsec is Internet Protocol Security and uses strong cryptography
to provide both authentication and encryption services. These
services allow you to build secure tunnels through untrusted
networks. Everything passing through the untrusted net is encrypted
by the ipsec gateway machine and decrypted by the gateway at the
other end of the tunnel. The resulting tunnel is a virtual private
network or VPN.

This package contains the daemons and userland tools for setting
up Openswan on a kernel with the 2.6 native IPsec code.

Update Information:
This erratum fixes the remote exploitation of a stack based buffer
overflow vulnerability in Xelerance Corp.’s Openswan, which could
allow attackers to execute arbitrary code.

The vulnerability specifically exists due to a lack of bounds
checking in the pluto application when Openswan is compiled with
XAUTH and PAM support.

The Common Vulnerabilities and Exposures project has assigned
the name CAN-2005-0162 to this problem.

  • Tue Dec 27 2005 Harald Hoyer <harald@redhat.com> –
    2.1.5-2.FC3.1

    • fixed possible xauth/PAM buffer overflow. (bug 146287)

This update can be downloaded from:


http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/

08083949eee57eb9b8417729fc160e57
SRPMS/openswan-2.1.5-2.FC3.1.src.rpm
6df7139465807a325eacbe065a35ef67
x86_64/openswan-2.1.5-2.FC3.1.x86_64.rpm
eab7fef76f737dd0ef5c4527656958c0
x86_64/debug/openswan-debuginfo-2.1.5-2.FC3.1.x86_64.rpm
9ee8446d2ba7f7dbca2c5213b30e9393
i386/openswan-2.1.5-2.FC3.1.i386.rpm
ef5fec6a769017a1e726c95129286b9c
i386/debug/openswan-debuginfo-2.1.5-2.FC3.1.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

Fedora Update Notification
FEDORA-2005-091
2005-01-28

Product : Fedora Core 2
Name : enscript
Version : 1.6.1
Release : 25.3
Summary : A plain ASCII to PostScript converter.

Description :
GNU enscript is a free replacement for Adobe’s Enscript program.
Enscript converts ASCII files to PostScript(TM) and spools
generated PostScript output to the specified printer or saves it to
a file. Enscript can be extended to handle different output media
and includes many options for customizing printouts.

Update Information:

This update fixes a regression introduced by the last
update.

  • Fri Jan 28 2005 Tim Waugh <twaugh@redhat.com> 1.6.1-25.3
    • Fixed patch for CAN-2004-1184 (bug #144684).

This update can be downloaded from:

http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/

52f2c477cb8d0762183ecfdd9542fc1e
SRPMS/enscript-1.6.1-25.3.src.rpm
de9c1162981608275229e507ea11e48f
x86_64/enscript-1.6.1-25.3.x86_64.rpm
3a9b03d4cbdc0d601b50b1977fd9e083
x86_64/debug/enscript-debuginfo-1.6.1-25.3.x86_64.rpm
42b8a9bf8bcd2893dd7b0156c964feaf
i386/enscript-1.6.1-25.3.i386.rpm
89bd4a90cab7c7aa5a3f2c9e725180ef
i386/debug/enscript-debuginfo-1.6.1-25.3.i386.rpm

This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.

Gentoo Linux

Gentoo Linux Security Advisory GLSA 200501-40

http://security.gentoo.org/

Severity: High
Title: ngIRCd: Buffer overflow
Date: January 28, 2005
Bugs: #79705
ID: 200501-40

Synopsis

ngIRCd is vulnerable to a buffer overflow that can be used to
crash the daemon and possibly execute arbitrary code.

Background

ngIRCd is a free open source daemon for Internet Relay Chat
(IRC).

Affected packages

     Package         /  Vulnerable  /                       Unaffected

  1  net-irc/ngircd       < 0.8.2                             >= 0.8.2

Description

Florian Westphal discovered a buffer overflow caused by an
integer underflow in the Lists_MakeMask() function of lists.c.

Impact

A remote attacker can exploit this buffer overflow to crash the
ngIRCd daemon and possibly execute arbitrary code with the rights
of the ngIRCd daemon process.

Workaround

There is no known workaround at this time.

Resolution

All ngIRCd users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-irc/ngIRCd-0.8.2"

References

[ 1 ] ngIRCd Release Annoucement


http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200501-40.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Gentoo Linux Security Advisory GLSA 200501-39

http://security.gentoo.org/

Severity: High
Title: SquirrelMail: Multiple vulnerabilities
Date: January 28, 2005
Bugs: #78116
ID: 200501-39

Synopsis

SquirrelMail fails to properly sanitize user input, which could
lead to arbitrary code execution and compromise webmail
accounts.

Background

SquirrelMail is a webmail package written in PHP. It supports
IMAP and SMTP and can optionally be installed with SQL support.

Affected packages

     Package                   /   Vulnerable   /           Unaffected

  1  mail-client/squirrelmail     <= 1.4.3a-r2                >= 1.4.4

Description

SquirrelMail fails to properly sanitize certain strings when
decoding specially-crafted strings, which can lead to PHP file
inclusion and XSS.

  • Insufficient checking of incoming URLs in prefs.php
    (CAN-2005-0075) and in webmail.php (CAN-2005-0103).
  • Insufficient escaping of integers in webmail.php
    (CAN-2005-0104).

Impact

By sending a specially-crafted URL, an attacker can execute
arbitrary code from the local system with the permissions of the
web server. Furthermore by enticing a user to load a
specially-crafted URL, it is possible to display arbitrary remote
web pages in Squirrelmail’s frameset and execute arbitrary scripts
running in the context of the victim’s browser. This could lead to
a compromise of the user’s webmail account, cookie theft, etc.

Workaround

The arbitrary code execution is only possible with
“register_globals” set to “On”. Gentoo ships PHP with
“register_globals” set to “Off” by default. There are no known
workarounds for the other issues at this time.

Resolution

All SquirrelMail users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.4"

Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.

References

[ 1 ] SquirrelMail Advisory

http://sourceforge.net/mailarchive/message.php?msg_id=10628451

[ 2 ] CAN-2005-0075

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0075

[ 3 ] CAN-2005-0103

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0103

[ 4 ] CAN-2005-0104

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0104

Availability

This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200501-39.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or
alternatively, you may file a bug at http://bugs.gentoo.org.

License

Copyright 2005 Gentoo Foundation, Inc; referenced text belongs
to its owner(s).

The contents of this document are licensed under the Creative
Commons – Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0

Get the Free Newsletter!

Subscribe to Developer Insider for top news, trends, & analysis

Must Read

LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.

Our Brands

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.