SUSE Linux Advisory: hylafax

SUSE Security Announcement

Content of this advisory:

1. security vulnerability resolved: Format bug condition in hfaxd.
   problem description, discussion, solution and upgrade
   information
2. pending vulnerabilities, solutions, workarounds:
   • ethereal
   • KDE
   • sane
   • ircd
   • mc
   • apache1/2
3. standard appendix (further information)

1) problem description, brief discussion, solution, upgrade
information

Hylafax is an Open Source fax server which allows sharing of fax
equipment among computers by offering its service to clients by a
protocol similar to FTP.
The SuSE Security Team found a format bug condition during a code
review of the hfaxd server. It allows remote attackers to execute
arbitrary code as root. However, the bug can not be triggered in
hylafax’ default configuration.

The “capi4hylafax” packages also need to be updated as a
dependency where they are available.

After the update has been successfully applied the hfaxd server
has to be restarted by issuing the following command as root:

/etc/rc.d/hylafax restart

Please download the update package for your distribution and
verify its integrity by the methods listed in section 3) of this
announcement. Then, install the package using the command “rpm -Fhv
file.rpm” to apply the update.
Our maintenance customers are being notified individually. The
packages are being offered to install from the maintenance web.

Intel i386 Platform:

SuSE-9.0:

ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/hylafax-4.1.7-67.i586.rpm
598081f0d8518014c122466549d3aee2

ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/capi4hylafax-4.1.7-67.i586.rpm
b440a0ac3debb15af86c55ce9648a0c9
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/hylafax-4.1.7-67.i586.patch.rpm
b133d6a01100c51769edfe73842f21e5

ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/capi4hylafax-4.1.7-67.i586.patch.rpm
48b02652d3efd052a99fe45346a40533
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/hylafax-4.1.7-67.src.rpm
44b246480b629ee9659ff2360999f4be

SuSE-8.2:

ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/hylafax-4.1.5-190.i586.rpm
a17a36e3d9779aaddc074e634c1d16c2

ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/capi4hylafax-4.1.5-190.i586.rpm
f016a370c9428aaca1a4393e3fb1fa6c
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/hylafax-4.1.5-190.i586.patch.rpm
f9be5873c7f8abaae23494f98463b451

ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/capi4hylafax-4.1.5-190.i586.patch.rpm
715001c063280b3ff8c3ec9c918776b9
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/hylafax-4.1.5-190.src.rpm
cdf6cf2e9ad8e9f96a0a76ba03921c5a

SuSE-8.1:

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/hylafax-4.1.3-145.i586.rpm
85ffa634af490894d049c2c350bd5637

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/capi4hylafax-4.1.3-145.i586.rpm
c3766b389e79820e88375127ce47246f
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/hylafax-4.1.3-145.i586.patch.rpm
f6afb37c81542e75da229db6cd1f9571

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/capi4hylafax-4.1.3-145.i586.patch.rpm
e3f1e42ab4a12d056ad440e4607214c9
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/hylafax-4.1.3-145.src.rpm
6babcf169ecf60cbfc83a3f8575cdf3e

SuSE-8.0:

ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/hylafax-4.1-303.i386.rpm
e4492b144902043a38bfd71dbb683b23
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/n4/hylafax-4.1-303.i386.patch.rpm
02f80c2b8b28d176bbba8a6dccda4dce
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/hylafax-4.1-303.src.rpm
c79d4be78cca347d5ecded4c6029f2b2

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/i386/update/7.3/n3/hylafax-4.1-303.i386.rpm
b42d4ff0c43cec7e09fe4c1bbf5c8226
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/hylafax-4.1-303.src.rpm
8bdce70f21a0362882947a1d4de760ae

Sparc Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n3/hylafax-4.1-122.sparc.rpm
fa187f99f0a25df1815445dbbb6a0abe
source rpm(s):

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/hylafax-4.1-122.src.rpm
227353e1b80121f3ccfabc7fb888a485

PPC Power PC Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n3/hylafax-4.1-206.ppc.rpm
4388fa7fe1aa5173e3d33bdf1c477349
source rpm(s):

ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/hylafax-4.1-206.src.rpm
a95fd798a47396a077d7690a3e62986b

2) Pending vulnerabilities in SUSE Distributions and
Workarounds:

• ethereal A new official version of ethereal, a network traffic
  analyzer, was released to fix various security-related problems. An
  update package is currently being tested and will be released as
  soon as possible.
• KDE New KDE packages are currently being tested. These packages
  fixes several vulnerabilities: + remote root compromise
  (CAN-2003-0690) + weak cookies (CAN-2003-0692) + SSL
  man-in-the-middle attack + information leak through HTML-referrer
  (CAN-2003-0459) The packages will be release as soon as testing is
  finished.
• sane The scanner service sane of SuSE Linux 7.3-8.1 is
  vulnerable to a remote denial-of-service attack. This attack can
  even be triggered if the attackers host is not listed in the
  saned.conf file. The packages are currently tested and will be
  release as soon as possible.
• ircd The Internet Relay Chat daemon is vulnerable to a remote
  denial-of service attack. The attack can be triggered by irc
  clients directly connected to the daemon. The packages are
  currently tested and will be release as soon as possible.
• mc By using a special combination of links in archive-files it
  is possible to execute arbitrary commands while mc tries to open it
  in its VFS. The packages are currently tested and will be release
  as soon as possible.
• apache1/2 The widely used HTTP server apache has several
  security vulnerabilities:
  • locally exploitable buffer overflow in the regular expression
    code. The attacker must be able to modify .htaccess or httpd.conf.
    (affects: mod_alias and mod_rewrite)
  • under some circumstances mod_cgid will output its data to the
    wrong client (affects: apache2)

3) standard appendix: authenticity verification, additional
information

• Package authenticity verification:

  SUSE update packages are available on many mirror ftp servers
  all over the world. While this service is being considered valuable
  and important to the free and open source software community, many
  users wish to be sure about the origin of the package and its
  content before installing the package. There are two verification
  methods that can be used independently from each other to prove the
  authenticity of a downloaded file or rpm package:

  1. md5sums as provided in the (cryptographically signed)
     announcement.
  2. using the internal gpg signatures of the rpm package.
  3. execute the command md5sum <name-of-the-file.rpm> after
     you downloaded the file from a SUSE ftp server or its mirrors.
     Then, compare the resulting md5sum with the one that is listed in
     the announcement. Since the announcement containing the checksums
     is cryptographically signed (usually using the key security@suse.de), the checksums show
     proof of the authenticity of the package. We disrecommend to
     subscribe to security lists which cause the email message
     containing the announcement to be modified so that the signature
     does not match after transport through the mailing list software.
     Downsides: You must be able to verify the authenticity of the
     announcement in the first place. If RPM packages are being rebuilt
     and a new version of a package is published on the ftp server, all
     md5 sums for the files are useless.
  4. rpm package signatures provide an easy way to verify the
     authenticity of an rpm package. Use the command rpm -v –checksig
     <file.rpm> to verify the signature of the package, where
     <file.rpm> is the filename of the rpm package that you have
     downloaded. Of course, package authenticity verification can only
     target an un-installed rpm package file. Prerequisites:
     1. gpg is installed
     2. The package is signed using a certain key. The public part of
        this key must be installed by the gpg program in the directory
        ~/.gnupg/ under the user’s home directory who performs the
        signature verification (usually root). You can import the key that
        is used by SUSE in rpm packages for SUSE Linux by saving this
        announcement to a file (“announcement.txt”) and running the command
        (do “su -” to be root): gpg –batch; gpg < announcement.txt |
        gpg –import SUSE Linux distributions version 7.1 and thereafter
        install the key “build@suse.de”
        upon installation or upgrade, provided that the package gpg is
        installed. The file containing the public key is placed at the
        top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de
        .
  5. SUSE runs two security mailing lists to which any interested
     party may subscribe:

     suse-security@suse.com

• general/linux/SUSE security discussion. All SUSE security
  announcements are sent to this list. To subscribe, send an email
  to

<suse-security-subscribe@suse.com>.

suse-security-announce@suse.com

• SUSE’s announce-only mailing list. Only SUSE’s security
  announcements are sent to this list. To subscribe, send an email to
  <suse-security-announce-subscribe@suse.com>.

For general information or the frequently asked questions (faq)
send mail to:

<suse-security-info@suse.com>
or
<suse-security-faq@suse.com>
respectively.

SUSE’s security contact is <security@suse.com> or
<security@suse.de>. The
<security@suse.de>
public key is listed below.

The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, it is desired that the clear-text signature shows
proof of the authenticity of the text.
SUSE Linux AG makes no warranties of any kind whatsoever with
respect to the information contained in this security advisory.