SUSE Linux Advisory: sane

SuSE-8.0:

ftp://ftp.suse.com/pub/suse/i386/update/8.0/gra2/sane-1.0.7-217.i386.rpm
9438d81c7bd8b41dee948696f138c771
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/gra2/sane-1.0.7-217.i386.patch.rpm
f461a294ab7d3638bf4b3e83f3910143
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/sane-1.0.7-217.src.rpm
ea888fa0c4e6aaf41e23caaf4f68a1d2

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/i386/update/7.3/gra1/sane-1.0.5-295.i386.rpm
53d25817ed9c53cf6078d3794862a13e
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/sane-1.0.5-295.src.rpm
593a886a54482c841baa0fe9d43690c6

Sparc Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/gra1/sane-1.0.5-114.sparc.rpm
bdb7ce58c8d363a03dadc719c2421d84
source rpm(s):

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/sane-1.0.5-114.src.rpm
4d0f4994f1fc730edfcefa2d33fe456d

PPC Power PC Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/ppc/update/7.3/gra1/sane-1.0.5-179.ppc.rpm
83643306b81f0e89d4a5c96001a65ea5
source rpm(s):

ftp://ftp.suse.com/pub/suse/ppc/update/7.3/zq1/sane-1.0.5-179.src.rpm
fa277cfb3ec68aedb24de2ff2d13673f

2) Pending vulnerabilities in SUSE Distributions and
Workarounds:

• ethereal A new official version of ethereal, a network traffic
  analyzer, was released to fix various security-related problems. An
  update package is currently being tested and will be released as
  soon as possible.
• KDE New KDE packages are currently being tested. These packages
  fixes several vulnerabilities: + remote root compromise
  (CAN-2003-0690) + weak cookies (CAN-2003-0692) + SSL
  man-in-the-middle attack + information leak through HTML-referrer
  (CAN-2003-0459) The packages will be release as soon as testing is
  finished.
• KDE wrong file permissions Due to a missing synchronisation
  during SuSE Linux 8.2 beta-testing phase some configuration files
  of KDE on SuSE Linux 8.2 are worldwriteable. Please check the files
  in /etc/opt/kde3/share/config and add an appropritae line to
  /etc/permissions.local, like:

  /etc/opt/kde3/share/config/kmailrc root.root 0644
  /etc/opt/kde3/share/config/kioslaverc root.root 0644
  /etc/opt/kde3/share/config/kdeglobals root.root 0644 Set the new
  permission with ‘chkstat -set /etc/permissions.local’ as root.

• ircd The Internet Relay Chat daemon is vulnerable to a remote
  denial-ofservice attack. The attack can be triggered by irc clients
  directly connected to the daemon. Update packages are available on
  our FTP servers.
• mc By using a special combination of links in archive-files it
  is possible to execute arbitrary commands while mc tries to open it
  in its VFS. The packages are currently tested and will be release
  as soon as possible.
• apache1/2 The widely used HTTP server apache has several
  security vulnerabilities:
  • locally exploitable buffer overflow in the regular expression
    code. The attacker must be able to modify .htaccess or httpd.conf.
    (affects: mod_alias and mod_rewrite)
  • under some circumstances mod_cgid will output its data to the
    wrong client (affects: apache2)
• proftpd A remote denial-of-service attack in the FTP server
  proftpd was fixed. The denial-of-service can be triggered by a
  one-byte buffer overflow with a fixed character. Therefore the bug
  can not be abused by an attacker to execute arbitrary code. If the
  binary is compiled with version 3.x of gcc this bug may not even
  lead to denial-of-service condition due to stack alignment. Update
  packages are available on our FTP servers.
• gdm2 Two remote denial-of-service attacks were fixed in GDM.
  Update packages are available on our FTP servers.
• epic/epic4 The well known IRC client epic can probably be
  exploited remotely by a malicious server. Update packages are
  available on our FTP servers.

3) standard appendix: authenticity verification, additional
information

• Package authenticity verification:

  SUSE update packages are available on many mirror ftp servers
  all over the world. While this service is being considered valuable
  and important to the free and open source software community, many
  users wish to be sure about the origin of the package and its
  content before installing the package. There are two verification
  methods that can be used independently from each other to prove the
  authenticity of a downloaded file or rpm package:

  1. md5sums as provided in the (cryptographically signed)
     announcement.
  2. using the internal gpg signatures of the rpm package.
  3. execute the command md5sum <name-of-the-file.rpm> after
     you downloaded the file from a SUSE ftp server or its mirrors.
     Then, compare the resulting md5sum with the one that is listed in
     the announcement. Since the announcement containing the checksums
     is cryptographically signed (usually using the key security@suse.de), the checksums show
     proof of the authenticity of the package. We disrecommend to
     subscribe to security lists which cause the email message
     containing the announcement to be modified so that the signature
     does not match after transport through the mailing list software.
     Downsides: You must be able to verify the authenticity of the
     announcement in the first place. If RPM packages are being rebuilt
     and a new version of a package is published on the ftp server, all
     md5 sums for the files are useless.
  4. rpm package signatures provide an easy way to verify the
     authenticity of an rpm package. Use the command rpm -v –checksig
     <file.rpm> to verify the signature of the package, where
     <file.rpm> is the filename of the rpm package that you have
     downloaded. Of course, package authenticity verification can only
     target an un-installed rpm package file. Prerequisites:
     1. gpg is installed
     2. The package is signed using a certain key. The public part of
        this key must be installed by the gpg program in the directory
        ~/.gnupg/ under the user’s home directory who performs the
        signature verification (usually root). You can import the key that
        is used by SUSE in rpm packages for SUSE Linux by saving this
        announcement to a file (“announcement.txt”) and running the command
        (do “su -” to be root): gpg –batch; gpg < announcement.txt |
        gpg –import SUSE Linux distributions version 7.1 and thereafter
        install the key “build@suse.de”
        upon installation or upgrade, provided that the package gpg is
        installed. The file containing the public key is placed at the
        top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de
        .
• SUSE runs two security mailing lists to which any interested
  party may subscribe:

  suse-security@suse.com

• general/linux/SUSE security discussion. All SUSE security
  announcements are sent to this list. To subscribe, send an email to

  <suse-security-subscribe@suse.com>.

  suse-security-announce@suse.com

• SUSE’s announce-only mailing list. Only SUSE’s security
  announcements are sent to this list. To subscribe, send an email to

  <suse-security-announce-subscribe@suse.com>.

For general information or the frequently asked questions (faq)
send mail to:

<suse-security-info@suse.com>
or
<suse-security-faq@suse.com>
respectively.

SUSE’s security contact is <security@suse.com> or
<security@suse.de>. The
<security@suse.de>
public key is listed below.

The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, it is desired that the clear-text signature shows
proof of the authenticity of the text.
SUSE Linux AG makes no warranties of any kind whatsoever with
respect to the information contained in this security advisory.

Bye,

Thomas
—
Thomas Biege <thomas@suse.de>, SUSE LINUX AG,
Security Support & Auditing