Security

Responsible disclosure

This week's "new vulnerabilities" section is somewhat longer than usual; a rather large number of packages have been revealed to have vulnerabilities. This surge in updates is a result of the posting of 44 vulnerabilities found by students in a security class taught by Daniel J. Bernstein.

There is no doubt that Mr. Bernstein has done us a favor by having his students find these problems, and by disclosing them. With luck, he is also teaching his students to avoid the creation of such vulnerabilities. Not everybody is pleased with how the problems were disclosed, however. The usual, accepted technique is to alert the maintainer of the affected software first, and to give them a bit of time in which to prepare and distribute a patch. In this way, the full, public disclosure of the vulnerability can be accompanied by an update.

That was not the path followed by Mr. Bernstein; instead, he opted to dispense with the prior notification to the maintainer, and to simply disclose the vulnerabilities publicly from the outset. The result has been a major scramble on the parts of maintainers and distributors who have found themselves trying to deal with a large pile of problems which have already been broadcast to the world.

Mr. Bernstein is not known for being apologetic in general, and he certainly was not in this case. In fact, he regretted that it took the reports one day to make it to Bugtraq: "It certainly wasn't my intention to give the authors an extra day of self-delusion." In a different discussion he has made his opinion clear:

So, it seems, the real solution to security problems is to punish programmers who release insecure code. There could be something to be said for this point of view: programmers who have been burned in this way might well find themselves inspired to pay more attention the next time around. The unfortunate side effects of immediate disclosure, however, include the punishment of users and distributors, and the possible creation of rushed, inadequate fixes. Compassion for people - other than the original developer - who are affected by vulnerabilities might suggest that allowing the developer to prepare a fix prior to disclosure might be the better approach.

Comments (24 posted)

Security news

Critical phpBB vulnerability

The phpBB bulletin board package contains an input validation problem which can allow the hosting site to be compromised. This vulnerability is being actively exploited, and there is apparently a worm in circulation as well. Click below to read the CERT advisory this problem; upgrading to version 2.0.11 fixes the problem.

Full Story (comments: 6)

New vulnerabilities

abcm2ps: buffer overflow vulnerability

Package(s):	abcm2ps	CVE #(s):
Created:	December 20, 2004	Updated:	December 22, 2004
Description:	Limin Wang has located a buffer overflow inside the put_words() function in the abcm2ps code. A remote attacker could convince the victim to download a specially-crafted ABC file. Upon execution, this file would trigger the buffer overflow and lead to the execution of arbitrary code with the permissions of the user running abcm2ps.
Alerts:	Gentoo 200412-18:02 2004-12-19

Comments (none posted)

acroread: buffer overflow vulnerability

Package(s):	acroread	CVE #(s):	CAN-2004-1152
Created:	December 17, 2004	Updated:	December 23, 2004
Description:	acroread has a buffer overflow vulnerability that can be exploited for the remote execution of arbitrary code.
Alerts:	Red Hat RHSA-2004:674-01 2004-12-23 Gentoo 200412-12 2004-12-16

Comments (none posted)

cscope: insecure temporary file

Package(s):	cscope	CVE #(s):	CAN-2004-0996
Created:	December 17, 2004	Updated:	December 22, 2004
Description:	cscope has a vulnerability which can be used by local users to overwrite files via a symlink.
Alerts:	Gentoo 200412-11 2004-12-16 Debian DSA-610-1 2004-12-17

Comments (none posted)

cups: multiple vulnerabilities

Package(s):	cups	CVE #(s):	CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270
Created:	December 17, 2004	Updated:	February 9, 2005
Description:	cups has a denial of service vulnerability in the lppasswd utility and a remote code execution vulnerability in the hpgltops filter.
Alerts:	SuSE SUSE-SR:2005:003 2005-02-04 Mandrake MDKSA-2005:008 2005-01-17 Gentoo 200412-25:02 2004-12-28 Red Hat RHSA-2005:013-01 2005-01-12 Gentoo 200412-25 2004-12-28 Fedora FEDORA-2004-559 2004-12-17 Fedora FEDORA-2004-560 2004-12-17

Comments (none posted)

cvstrac: cross-site scripting vulnerability

Package(s):	cvstrac	CVE #(s):	CAN-2004-1146
Created:	December 17, 2004	Updated:	December 22, 2004
Description:	There is a cross-site scripting vulnerability in CVSTrac, the CVS repository web frontend.
Alerts:	OpenPKG OpenPKG-SA-2004.056 2004-12-17

Comments (none posted)

ethereal: multiple vulnerabilities

Package(s):	ethereal	CVE #(s):	CAN-2004-1139 CAN-2004-1140 CAN-2004-1141 CAN-2004-1142
Created:	December 20, 2004	Updated:	January 13, 2005
Description:	There are multiple vulnerabilities in versions of Ethereal earlier than 0.10.8, including: Bug in DICOM dissection discovered by Bing could make Ethereal crash (CAN-2004-1139). An invalid RTP timestamp could make Ethereal hang and create a large temporary file (CAN-2004-1140). The HTTP dissector could access previously-freed memory (CAN-2004-1141). Brian Caswell discovered that an improperly formatted SMB could make Ethereal hang (CAN-2004-1142).
Alerts:	Conectiva CLA-2005:916 2005-01-13 Debian DSA-613-1 2004-12-21 Mandrake MDKSA-2004:152 2004-12-20 Gentoo 200412-15 2004-12-19

Comments (none posted)

groff: insecure temp file

Package(s):	groff	CVE #(s):	CAN-2004-1296
Created:	December 20, 2004	Updated:	January 17, 2005
Description:	Javier Fernández-Sanguino Peña discovered that the auxiliary scripts "eqn2graph" and "pic2graph" created temporary files in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:	Ubuntu USN-43-1 2004-12-20

Comments (1 posted)

htget: buffer overflow

Package(s):	htget	CVE #(s):	CAN-2004-0852
Created:	December 20, 2004	Updated:	December 22, 2004
Description:	"infamous41md" discovered a buffer overflow in htget, a file grabber that will get files from HTTP servers. It is possible to overflow a buffer and execute arbitrary code by accessing a malicious URL.
Alerts:	Debian DSA-611-1 2004-12-20

Comments (none posted)

kdelibs: konqueror window injection vulnerability

Package(s):	kdelibs	CVE #(s):	CAN-2004-1158
Created:	December 16, 2004	Updated:	December 22, 2004
Description:	Konqueror has a window injection vulnerability that allows remote attackers to spoof arbitrary web sites by injecting content from one window into another.
Alerts:	Mandrake MDKSA-2004:154 2004-12-22 Gentoo 200412-16 2004-12-19 Mandrake MDKSA-2004:150 2004-12-15 Fedora FEDORA-2004-551 2004-12-15 Fedora FEDORA-2004-550 2004-12-15 Fedora FEDORA-2004-549 2004-12-15 Fedora FEDORA-2004-548 2004-12-15

Comments (none posted)

kerberos5: execution of arbitrary code by authenticated user

Package(s):	kerberos5	CVE #(s):	CAN-2004-1189
Created:	December 21, 2004	Updated:	February 15, 2005
Description:	There is a buffer overflow in the password history handling code of libkadm5srv which could be exploited by an authenticated user to execute arbitrary code on a Key Distribution Center (KDC) server.
Alerts:	Red Hat RHSA-2005:045-01 2005-02-15 Red Hat RHSA-2005:012-01 2005-01-19 Conectiva CLA-2005:917 2005-01-13 Ubuntu USN-58-1 2005-01-10 Debian DSA-629-1 2005-01-07 Gentoo 200501-05 2005-01-05 Mandrake MDKSA-2004:156 2004-12-22 Fedora FEDORA-2004-564 2004-12-21 Fedora FEDORA-2004-563 2004-12-21 Trustix TSLSA-2004-0069 2004-12-21

Comments (none posted)

kernel: amd64 root privilege escalation from setuid binaries

Package(s):	linux-source-2.6.8.1	CVE #(s):	CAN-2004-1074
Created:	December 16, 2004	Updated:	December 22, 2004
Description:	The amd64 kernel may allow a root privilege escalation if setuid binaries are run.
Alerts:	Ubuntu USN-39-1 2004-12-16

Comments (none posted)

libtiff: buffer overflow

Package(s):	libtiff	CVE #(s):	CAN-2004-1308
Created:	December 22, 2004	Updated:	May 19, 2005
Description:	The libtiff image manipulation library contains several exploitable buffer overflows.
Alerts:	Fedora-Legacy FLSA:152815 2005-05-18 Red Hat RHSA-2005:035-01 2005-02-15 Conectiva CLA-2005:920 2005-01-20 Red Hat RHSA-2005:019-01 2005-01-13 SuSE SUSE-SA:2005:001 2005-01-10 Fedora FEDORA-2005-598 2005-01-07 Fedora FEDORA-2005-597 2005-01-07 Ubuntu USN-54-1 2005-01-06 Mandrake MDKSA-2005:002 2005-01-06 Mandrake MDKSA-2005:001 2005-01-06 Gentoo 200501-06 2005-01-05 Debian DSA-626-1 2005-01-06 Debian DSA-617-1 2004-12-24 Fedora FEDORA-2004-577 2004-12-22 Fedora FEDORA-2004-576 2004-12-22 Ubuntu USN-46-1 2004-12-22

Comments (none posted)

mpg123: playlist buffer overflow

Package(s):	mpg123	CVE #(s):	CAN-2004-1284
Created:	December 21, 2004	Updated:	December 22, 2004
Description:	Bartlomiej Sieka discovered that mpg123 contains an unsafe strcat() to an array in playlist.c. This code vulnerability may lead to a buffer overflow. A remote attacker could craft a malicious playlist which, when used, would result in the execution of arbitrary code with the rights of the user running mpg123. See this advisory for more information.
Alerts:	Gentoo 200412-22 2004-12-21

Comments (none posted)

MPlayer: multiple overflows

Package(s):	mplayer	CVE #(s):
Created:	December 20, 2004	Updated:	January 5, 2005
Description:	iDEFENSE, Ariel Berkman and the MPlayer development team found multiple vulnerabilities in MPlayer, potentially resulting in remote executing of arbitrary code. See iDEFENSE reports: MPlayer Bitmap Parsing Remote Heap Overflow Vulnerability, MPlayer MMST Streaming Stack Overflow Vulnerability and MPlayer Remote RTSP Heap Overflow Vulnerability.
Alerts:	Conectiva CLA-2005:910 2005-01-05 Mandrake MDKSA-2004:157 2004-12-22 Gentoo 200412-21 2004-12-20

Comments (none posted)

nasm: Buffer overflow vulnerability

Package(s):	nasm	CVE #(s):	CAN-2004-1287
Created:	December 20, 2004	Updated:	May 4, 2005
Description:	Jonathan Rockway discovered that NASM-0.98.38 has an unprotected vsprintf() to an array in preproc.c. This code vulnerability may lead to a buffer overflow and potential execution of arbitrary code.
Alerts:	Red Hat RHSA-2005:381-01 2005-05-04 Fedora FEDORA-2005-322 2005-04-18 Mandrake MDKSA-2005:004 2005-01-06 Debian DSA-623-1 2004-01-04 Ubuntu USN-45-1 2004-12-22 Gentoo 200412-20 2004-12-20

Comments (4 posted)

perl information leak

Package(s):	perl	CVE #(s):	CAN-2004-0452
Created:	December 21, 2004	Updated:	January 11, 2005
Description:	A race condition and possible information leak has been discovered in Perl's File::Path::rmtree(). This function changes the permission of files and directories before removing them to avoid problems with wrong permissions. However, they were made readable and writable not only for the owner, but for the entire world, which opened a race condition and a possible information leak (if the actual removal of a file/directory failed for some reason).
Alerts:	OpenPKG OpenPKG-SA-2005.001 2005-01-11 Debian DSA-620-1 2004-12-30 Ubuntu USN-44-1 2004-12-21

Comments (none posted)

php: multiple vulnerabilities

Package(s):	php	CVE #(s):	CAN-2004-1018 CAN-2004-1019 CAN-2004-1020 CAN-2004-1063 CAN-2004-1064 CAN-2004-1065
Created:	December 16, 2004	Updated:	March 24, 2005
Description:	PHP has an out of bounds memory write access vulnerability and an integer overflow/underflow problem. See the PHP 4.3.10 Release Announcement for details.
Alerts:	Ubuntu USN-99-2 2005-03-24 Ubuntu USN-99-1 2005-03-18 Fedora-Legacy FLSA:2344 2005-03-07 Red Hat RHSA-2005:032-01 2005-02-15 Red Hat RHSA-2005:031-01 2005-01-19 SuSE SUSE-SA:2005:002 2005-01-17 Conectiva CLA-2005:915 2005-01-13 Fedora FEDORA-2004-567 2004-12-21 Fedora FEDORA-2004-568 2004-12-21 Red Hat RHSA-2004:687-01 2004-12-21 Trustix TSLSA-2004-0066 2004-12-17 Gentoo 200412-14 2004-12-19 Mandrake MDKSA-2004:151 2004-12-17 Ubuntu USN-40-1 2004-12-16 OpenPKG OpenPKG-SA-2004.053 2004-12-16

Comments (1 posted)

phpMyAdmin: multiple vulnerabilities

Package(s):	phpMyAdmin	CVE #(s):	CAN-2004-1147 CAN-2004-1148
Created:	December 20, 2004	Updated:	December 22, 2004
Description:	Nicolas Gregoire (exaprobe.com) has discovered two vulnerabilities that exist only on a webserver where PHP safe_mode is off. These vulnerabilities could lead to command execution or file disclosure. See PHPMyAdmin advisory: PMASA-2004-4 for details.
Alerts:	Gentoo 200412-19 2004-12-19

Comments (none posted)

samba: integer overflow vulnerability

Package(s):	samba	CVE #(s):	CAN-2004-1154
Created:	December 16, 2004	Updated:	July 19, 2005
Description:	Samba has an integer overflow vulnerability that may allow an authenticated remote user to execute arbitrary code on the Samba server.
Alerts:	Fedora-Legacy FLSA:152874 2005-07-15 Debian DSA-701-2 2005-04-21 Debian DSA-701-1 2005-03-31 Conectiva CLA-2005:913 2005-01-06 Red Hat RHSA-2005:020-01 2005-01-05 Mandrake MDKSA-2004:158 2004-12-27 SuSE SUSE-SA:2004:045 2004-12-22 Red Hat RHSA-2004:681-01 2004-12-21 Fedora FEDORA-2004-562 2004-12-20 Fedora FEDORA-2004-561 2004-12-20 Gentoo 200412-13 2004-12-17 Ubuntu USN-41-1 2004-12-17 OpenPKG OpenPKG-SA-2004.054 2004-12-17 Red Hat RHSA-2004:670-01 2004-12-16

Comments (none posted)

xine-lib: arbitrary code execution

Package(s):	xine-lib	CVE #(s):	CAN-2004-1187 CAN-2004-1188 CAN-2004-1300
Created:	December 21, 2004	Updated:	January 25, 2005
Description:	Several buffer overflows have been discovered in xine-lib, the video/audio codec library for Xine frontends (xine-ui, totem-xine, kaffeine, and others). If an attacker tricked a user into loading a malicious RTSP stream or a stream with specially crafted AIFF audio or PNM image data, they could exploit this to execute arbitrary code with the privileges of the user opening the audio/video file. See this advisory for more information.
Alerts:	Mandrake MDKSA-2005:011 2005-01-19 Conectiva CLA-2005:919 2005-01-19 Gentoo 200501-07 2005-01-06 Ubuntu USN-42-1 2004-12-20

Comments (none posted)

xzgv integer overflows

Package(s):	xzgv	CVE #(s):	CAN-2004-0994
Created:	December 21, 2004	Updated:	January 12, 2005
Description:	Luke "infamous41md" discovered multiple vulnerabilities in xzgv, a picture viewer for X11 with a thumbnail-based selector. Remote exploitation of an integer overflow vulnerability could allow the execution of arbitrary code.
Alerts:	Gentoo 200501-09 2005-01-06 Debian DSA-614-1 2004-12-21

Comments (none posted)

Zwiki: XSS vulnerability

Package(s):	zwiki	CVE #(s):
Created:	December 21, 2004	Updated:	December 22, 2004
Description:	Due to improper input validation, Zwiki can be exploited to perform cross-site scripting attacks. By enticing a user to read a specially-crafted wiki entry, an attacker can execute arbitrary script code running in the context of the victim's browser.
Alerts:	Gentoo 200412-23 2004-12-21

Comments (none posted)

Updated vulnerabilities

a2ps: input validation error

Package(s):	a2ps	CVE #(s):	CAN-2004-1170 CAN-2004-1377
Created:	November 26, 2004	Updated:	December 19, 2005
Description:	The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:	Fedora-Legacy FLSA:152870 2005-12-17 Mandriva MDKSA-2005:097 2005-06-07 OpenPKG OpenPKG-SA-2005.003 2005-01-17 Gentoo 200501-02 2005-01-04 Debian DSA-612-1 2004-12-20 Mandrake MDKSA-2004:140 2004-11-25

Comments (none posted)

aspell: bounds checking problem

Package(s):	aspell	CVE #(s):	CAN-2004-0548
Created:	June 17, 2004	Updated:	December 20, 2004
Description:	Aspell's word-list-compress utility fails to properly check bounds when dealing with words that are more than 256 bytes long. This can lead to arbitrary code execution by an attacker.
Alerts:	Mandrake MDKSA-2004:153 2004-12-20 OpenPKG OpenPKG-SA-2004.042 2004-09-15 Gentoo 200406-14 2004-06-17

Comments (none posted)

cdrecord: failure to drop privilege

Package(s):	cdrecord	CVE #(s):	CAN-2004-0806
Created:	September 8, 2004	Updated:	February 21, 2005
Description:	The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program.
Alerts:	Fedora-Legacy FLSA:2058 2005-02-20 Gentoo 200409-18 2004-09-14 Fedora FEDORA-2004-298 2004-09-09 Fedora FEDORA-2004-297 2004-09-09 Mandrake MDKSA-2004:091 2004-09-07

Comments (none posted)

cyrus-sasl: remote buffer overflow

Package(s):	cyrus-sasl	CVE #(s):	CAN-2004-0884
Created:	October 7, 2004	Updated:	March 16, 2005
Description:	cyrus-sasl has a vulnerability involving a buffer overflow in the digestmda5.c file. A remote attacker may be able to compromise the system. Also, a local user may be able to exploit a vulnerability by using the SASL_PATH environment variable.
Alerts:	Mandrake MDKSA-2005:054 2005-03-15 SuSE SUSE-SA:2005:013 2005-03-03 Fedora-Legacy FLSA:2137 2005-02-17 OpenPKG OpenPKG-SA-2005.004 2005-01-28 Conectiva CLA-2004:889 2004-11-11 Debian DSA-568-1 2004-10-16 Debian DSA-563-3 2004-10-14 Debian DSA-563-2 2004-10-12 Debian DSA-563-1 2004-10-12 Trustix TSLSA-2004-0053 2004-10-08 Mandrake MDKSA-2004:106 2004-10-07 Red Hat RHSA-2004:546-02 2004-10-07 Gentoo 200410-05 2004-10-07

Comments (none posted)

dhcp: format string vulnerability

Package(s):	dhcp	CVE #(s):	CAN-2004-1006
Created:	November 4, 2004	Updated:	July 13, 2005
Description:	Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:	Fedora-Legacy FLSA:152835 2005-07-10 Red Hat RHSA-2005:212-01 2005-04-12 Debian DSA-584-1 2004-11-04

Comments (none posted)

Filename disclosure vulnerability in fam

Package(s):	fam	CVE #(s):	CAN-2002-0875
Created:	August 19, 2002	Updated:	January 5, 2005
Description:	"fam" (file alteration monitor) watches files and directories for changes and lets interested applications know when something happens. This package has a flaw in its group handling that blocks some legitimate operations while, at the same time, exposing the names of files that should otherwise be invisible.
Alerts:	Red Hat RHSA-2005:005-01 2005-01-05 Debian DSA-154-1 2002-08-15

Comments (none posted)

flim: insecure file creation

Package(s):	flim	CVE #(s):	CAN-2004-0422
Created:	May 5, 2004	Updated:	December 16, 2004
Description:	The emacs "flim" mode creates temporary files in an insecure fashion, possibly allowing a local attacker to overwrite files.
Alerts:	Fedora FEDORA-2004-546 2004-12-15 Red Hat RHSA-2004:344-01 2004-08-18 Debian DSA-500-1 2004-05-01

Comments (none posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):	foomatic	CVE #(s):	CAN-2004-0801
Created:	September 20, 2004	Updated:	May 31, 2006
Description:	There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:	SuSE SUSE-SA:2006:026 2006-05-30 Fedora-Legacy FLSA:2076 2004-11-05 Conectiva CLA-2004:880 2004-10-27 Fedora FEDORA-2004-303 2004-09-21 Gentoo 200409-24 2004-09-20

Comments (none posted)

FreeRADIUS: denial of service

Package(s):	freeradius	CVE #(s):	CAN-2004-0938 CAN-2004-0960 CAN-2004-0961
Created:	September 22, 2004	Updated:	February 2, 2005
Description:	FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code.
Alerts:	Fedora-Legacy FLSA:2187 2005-02-01 Red Hat RHSA-2004:609-01 2004-11-12 Gentoo 200409-29 2004-09-22

Comments (none posted)

gaim: buffer overflow in MSN protocol

Package(s):	gaim	CVE #(s):	CAN-2004-0891
Created:	October 25, 2004	Updated:	February 11, 2005
Description:	A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.
Alerts:	Fedora-Legacy FLSA:2188 2005-02-10 Red Hat RHSA-2004:604-01 2004-10-20 Mandrake MDKSA-2004:117 2004-11-01 Ubuntu USN-8-1 2004-10-27 Gentoo 200410-23 2004-10-24 Slackware SSA:2004-296-01 2004-10-25

Comments (none posted)

Gallery: cross-site scripting vulnerability

Package(s):	Gallery	CVE #(s):	CAN-2004-1106
Created:	November 8, 2004	Updated:	January 17, 2005
Description:	Jim Paris has discovered a cross-site scripting vulnerability in Gallery. By sending a carefully crafted URL, an attacker can inject and execute script code in the victim's browser window, and potentially compromise the users gallery.
Alerts:	Debian DSA-642-1 2005-01-17 Gentoo 200411-10:01 2004-11-06

Comments (none posted)

gtk2, gdk-pixbuf: buffer overflows

Package(s):	gdk-pixbuf gtk2	CVE #(s):	CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788
Created:	September 15, 2004	Updated:	February 25, 2005
Description:	The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Alerts:	Fedora-Legacy FLSA:2005 2005-02-23 Conectiva CLA-2004:875 2004-10-18 Slackware SSA:2004-266-02 2004-09-22 Gentoo 200409-28 2004-09-21 Mandrake MDKSA-2004:095-1 2004-09-17 SuSE SUSE-SA:2004:033 2004-09-17 Debian DSA-549-1 2004-09-17 Red Hat RHSA-2004:447-02 2004-09-15 Debian DSA-546-1 2004-09-16 Red Hat RHSA-2004:466-01 2004-09-15 Red Hat RHSA-2004:447-01 2004-09-15 Mandrake MDKSA-2004:095 2004-09-15 Fedora FEDORA-2004-289 2004-09-15 Fedora FEDORA-2004-288 2004-09-15 Fedora FEDORA-2004-287 2004-09-15 Fedora FEDORA-2004-286 2004-09-15

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):	gettext	CVE #(s):	CAN-2004-0966
Created:	October 11, 2004	Updated:	March 1, 2006
Description:	gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:	Mandriva MDKSA-2006:051 2006-02-28 Fedora-Legacy FLSA:136323 2006-01-09 Gentoo 200410-10:02 2004-10-10 OpenPKG OpenPKG-SA-2004.055 2004-12-23 Ubuntu USN-5-1 2004-10-27 Gentoo 200410-10 2004-10-10

Comments (1 posted)

ghostscript: symlink vulnerabilities

Package(s):	ghostscript	CVE #(s):	CAN-2004-0967
Created:	October 20, 2004	Updated:	September 28, 2005
Description:	The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:	Red Hat RHSA-2005:081-01 2005-09-28 Ubuntu USN-3-1 2004-10-27 Gentoo 200410-18 2004-10-20

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):	glibc	CVE #(s):	CAN-2004-1453
Created:	August 17, 2004	Updated:	May 26, 2005
Description:	Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:	Red Hat RHSA-2005:256-01 2005-05-18 Gentoo 200408-16 2004-08-16

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):	glibc	CVE #(s):	CAN-2004-0968
Created:	October 21, 2004	Updated:	November 14, 2005
Description:	The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:	Fedora-Legacy FLSA:152848 2005-11-13 Red Hat RHSA-2005:261-01 2005-04-28 Debian DSA-636-1 2005-01-12 Mandrake MDKSA-2004:159 2004-12-29 Red Hat RHSA-2004:586-01 2004-12-20 Fedora FEDORA-2004-356 2004-11-11 Ubuntu USN-4-1 2004-10-27 Gentoo 200410-19 2004-10-21

Comments (none posted)

gnome-vfs: backend script vulnerabilities

Package(s):	gnome-vfs	CVE #(s):	CAN-2004-0494
Created:	August 4, 2004	Updated:	February 21, 2005
Description:	Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:	Fedora-Legacy FLSA:1944 2005-02-20 Whitebox WBSA-2004:373-01 2004-08-19 Red Hat RHSA-2004:373-01 2004-08-04

Comments (none posted)

groff: insecure temporary directory

Package(s):	groff	CVE #(s):	CAN-2004-0969
Created:	November 1, 2004	Updated:	February 9, 2006
Description:	Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:	Mandriva MDKSA-2006:038 2006-02-08 Gentoo 200411-15 2004-11-08 Ubuntu USN-13-1 2004-11-01

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Debian DSA-710-1 2005-04-18 Mandrake MDKSA-2003:093 2003-09-18 Conectiva CLA-2003:737 2003-09-12 Red Hat RHSA-2003:264-01 2003-09-09 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:126-01 2003-04-14

Comments (none posted)

imlib: buffer overflows in image decoding

Package(s):	imlib	CVE #(s):	CAN-2004-1026
Created:	December 6, 2004	Updated:	January 13, 2005
Description:	Pavel Kankovsky discovered that several overflows found in the libXpm library also applied to imlib. He also fixed a number of other potential flaws. A remote attacker could entice a user to view a carefully-crafted image file, which would potentially lead to execution of arbitrary code with the rights of the user viewing the image. This affects any program that makes use of the imlib library.
Alerts:	Mandrake MDKSA-2005:007 2005-01-12 Gentoo 200501-19 2005-01-11 Ubuntu USN-55-1 2005-01-06 Debian DSA-628-1 2005-01-06 Ubuntu USN-53-1 2004-12-29 Debian DSA-618-1 2004-12-24 Red Hat RHSA-2004:651-01 2004-12-10 Gentoo 200412-03 2004-12-06

Comments (none posted)

imlib2: buffer overflows

Package(s):	imlib2	CVE #(s):	CAN-2004-0802 CAN-2004-0817
Created:	September 8, 2004	Updated:	October 26, 2005
Description:	The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:	Debian DSA-548-2 2005-10-26 Conectiva CLA-2004:870 2004-09-28 Debian DSA-552-1 2004-09-22 Debian DSA-548-1 2004-09-16 Red Hat RHSA-2004:465-01 2004-09-15 Gentoo 200409-12 2004-09-08 Fedora FEDORA-2004-301 2004-09-09 Fedora FEDORA-2004-300 2004-09-09 Mandrake MDKSA-2004:089 2004-09-07

Comments (none posted)

iptables: missing initialization

Package(s):	iptables	CVE #(s):	CAN-2004-0986
Created:	November 1, 2004	Updated:	February 11, 2005
Description:	Faheem Mitha noticed that the iptables command, an administration tool for IPv4 packet filtering and NAT, did not always load the required modules on its own as it was supposed to. This could lead to firewall rules not being loaded on system startup. This caused a failure in connection with rules provided by lokkit at least.
Alerts:	Fedora-Legacy FLSA:2252 2005-02-10 Ubuntu USN-81-1 2005-02-11 Mandrake MDKSA-2004:125 2004-11-04 Debian DSA-580-1 2004-11-01

Comments (none posted)

kernel: IGMP and scm_send vulnerabilities

Package(s):	kernel	CVE #(s):	CAN-2004-1016 CAN-2004-1137
Created:	December 14, 2004	Updated:	January 4, 2005
Description:	Paul Starzetz has discovered a new pair of kernel vulnerabilities. The IGMP code suffers from input validation and integer overflow vulnerabilities which could be remotely exploitable, and the socket function __scm_send() has a local denial of service vulnerability.
Alerts:	Fedora FEDORA-2004-582 2005-01-03 Fedora FEDORA-2004-581 2005-01-03 Ubuntu USN-47-1 2004-12-23 SuSE SUSE-SA:2004:044 2004-12-21 Trustix TSLSA-2004-0068 2004-01-19 Ubuntu USN-38-1 2004-12-14

Comments (none posted)

kernel-utils: setuid vulnerability

Package(s):	kernel-utils	CVE #(s):	CAN-2003-0019
Created:	February 7, 2003	Updated:	January 21, 2005
Description:	The kernel-utils package contains several utilities that can be used to control the kernel or machine hardware. In Red Hat Linux 8.0 this package contains user mode linux (UML) utilities. The uml_net utility in kernel-utils packages with Red Hat Linux 8.0 was incorrectly shipped setuid root. This could allow local users to control certain network interfaces, add and remove arp entries and routes, and put interfaces in and out of promiscuous mode. All users of the kernel-utils package should update to these packages that contain a version of uml_net that is not setuid root. Alternatively, as a work-around to this vulnerability issue the following command as root: chmod -s /usr/bin/uml_net
Alerts:	Red Hat RHSA-2003:056-08 2003-02-07

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):	libgd2	CVE #(s):	CAN-2004-0990 CAN-2004-0941
Created:	October 29, 2004	Updated:	June 28, 2006
Description:	Several buffer overflows have been discovered in libgd's PNG handling functions. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges. Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:	Mandriva MDKSA-2006:114 2006-06-27 Red Hat RHSA-2006:0194-01 2006-02-01 Fedora-Legacy FLSA:152838 2005-07-15 Red Hat RHSA-2004:638-01 2004-12-17 Ubuntu USN-33-1 2004-11-29 Debian DSA-602-1 2004-11-29 Debian DSA-601-1 2004-11-29 Mandrake MDKSA-2004:132 2004-11-15 Ubuntu USN-25-1 2004-11-15 Fedora FEDORA-2004-412 2004-11-11 Fedora FEDORA-2004-411 2004-11-11 Ubuntu USN-21-1 2004-11-09 Debian DSA-591-1 2004-11-09 Debian DSA-589-1 2004-11-09 Gentoo 200411-08 2004-11-03 OpenPKG OpenPKG-SA-2004.049 2004-10-30 Ubuntu USN-11-1 2004-10-28

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):	libpng	CVE #(s):	CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:	August 4, 2004	Updated:	February 10, 2005
Description:	There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:	Fedora-Legacy FLSA:1943 2005-02-08 Red Hat RHSA-2004:421-01 2004-08-04 Gentoo 200408-22 2004-08-23 Whitebox WBSA-2004:402-01 2004-08-19 Mandrake MDKSA-2004:082 2004-08-12 Slackware SSA:2004-223-01 2004-08-09 Slackware SSA:2004-223-02 2004-08-07 Slackware SSA:2004-222-01b 2004-08-10 Slackware SSA:2004-222-01 2004-08-07 Conectiva CLA-2004:856 2004-08-06 Trustix TSLSA-2004-0040 2004-08-05 Gentoo 200408-03 2004-08-05 Debian DSA-536-1 2004-08-04 Mandrake MDKSA-2004:079 2004-08-04 SuSE SUSE-SA:2004:023 2004-08-04 Red Hat RHSA-2004:402-01 2004-08-04 OpenPKG OpenPKG-SA-2004.035 2004-08-04

Comments (1 posted)

libxml2: multiple buffer overflows

Package(s):	libxml2	CVE #(s):	CAN-2004-0989
Created:	October 28, 2004	Updated:	February 28, 2005
Description:	libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:	Ubuntu USN-89-1 2005-02-28 Red Hat RHSA-2004:650-01 2004-12-16 Conectiva CLA-2004:890 2004-11-18 Red Hat RHSA-2004:615-01 2004-11-12 Mandrake MDKSA-2004:127 2004-11-04 Debian DSA-582-1 2004-11-02 Gentoo 200411-05 2004-11-02 Trustix TSLSA-2004-0055 2004-10-29 OpenPKG OpenPKG-SA-2004.050 2004-10-31 Ubuntu USN-10-1 2004-10-28 Fedora FEDORA-2004-353 2004-10-28

Comments (none posted)

libxpm4: stack and integer overflows

Package(s):	libxpm4	CVE #(s):	CAN-2004-0687 CAN-2004-0688
Created:	September 16, 2004	Updated:	February 14, 2005
Description:	There are several stack and integer overflow bugs in the libXpm code of XFree86 that may be used for a denial of service.
Alerts:	Conectiva CLA-2005:924 2005-02-14 Red Hat RHSA-2005:004-01 2005-01-12 Red Hat RHSA-2004:537-01 2004-12-02 Ubuntu USN-27-1 2004-11-17 Mandrake MDKSA-2004:124 2004-11-04 Debian DSA-561-1 2004-10-11 Gentoo 200410-09 2004-10-09 Debian DSA-560-1 2004-10-07 Red Hat RHSA-2004:479-01 2004-10-06 Red Hat RHSA-2004:478-01 2004-10-04 Gentoo 200409-34 2004-09-27 SuSE SUSE-SA:2004:034 2004-09-17 Mandrake MDKSA-2004:099 2004-09-15 Mandrake MDKSA-2004:098 2004-09-15

Comments (none posted)

logcheck: symlink vulnerability

Package(s):	logcheck	CVE #(s):	CAN-2004-0404
Created:	April 21, 2004	Updated:	December 22, 2004
Description:	The logcheck utility handles temporary files in an unsafe way, possibly allowing local attackers to overwrite files.
Alerts:	Mandrake MDKSA-2004:155 2004-12-22 Debian DSA-488-1 2004-04-16

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):	lvm10	CVE #(s):	CAN-2004-0972
Created:	November 1, 2004	Updated:	July 25, 2005
Description:	Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:	Fedora-Legacy FLSA:152842 2005-07-24 Mandrake MDKSA-2004:144 2004-12-06 Gentoo 200411-22 2004-11-11 Debian DSA-583-1 2004-11-03 Ubuntu USN-15-1 2004-11-01

Comments (none posted)

Midnight Commander: extfs vfs vulnerability

Package(s):	mc	CVE #(s):	CAN-2004-0494
Created:	September 2, 2004	Updated:	January 5, 2005
Description:	Midnight Commander has a vfs vulnerability with shell quoting in extfs perl scripts.
Alerts:	Red Hat RHSA-2004:464-02 2005-01-05 Red Hat RHSA-2004:464-01 2004-09-15 Fedora FEDORA-2004-273 2004-09-01 Fedora FEDORA-2004-272 2004-09-01

Comments (none posted)

mikmod: buffer overflow

Package(s):	mikmod	CVE #(s):	CAN-2003-0427
Created:	June 16, 2003	Updated:	June 16, 2005
Description:	Ingo Saitz discovered a bug in mikmod whereby a long filename inside an archive file can overflow a buffer when the archive is being read by mikmod.
Alerts:	Fedora FEDORA-2005-405 2005-06-16 Red Hat RHSA-2005:506-01 2005-06-13 Fedora FEDORA-2005-404 2005-06-09 Gentoo 200307-01 2003-07-02 Debian DSA-320-1 2003-06-13

Comments (none posted)

mozilla products: arbitrary code execution and other vulnerabilities

Package(s):	mozilla firefox thunderbird	CVE #(s):	CAN-2004-0902 CAN-2004-0903 CAN-2004-0904 CAN-2004-0905 CAN-2004-0908
Created:	September 20, 2004	Updated:	January 13, 2005
Description:	Several vulnerabilities exist in the Mozilla web browser and derived products, the most serious of which could allow a remote attacker to execute arbitrary code on an affected system. See the CERT advisory for details.
Alerts:	Gentoo 200501-03 2005-01-05 Fedora-Legacy FLSA:2089 2004-10-27 Conectiva CLA-2004:877 2004-10-22 Mandrake MDKSA-2004:107 2004-10-19 SuSE SUSE-SA:2004:036 2004-10-06 Red Hat RHSA-2004:486-01 2004-09-30 Slackware SSA:2004-266-03 2004-09-22 Gentoo 200409-26 2004-09-20

Comments (none posted)

mpg123: buffer overflow bug

Package(s):	mpg123	CVE #(s):	CAN-2004-0805
Created:	September 16, 2004	Updated:	January 11, 2005
Description:	The mpg123 audio playing utility has a buffer overflow bug that may allow arbitrary execution of code.
Alerts:	Gentoo 200501-14 2005-01-10 Debian DSA-564-1 2004-10-13 Mandrake MDKSA-2004:100 2004-09-22 Gentoo 200409-20 2004-09-16

Comments (none posted)

mpg321: format string vulnerability

Package(s):	mpg321	CVE #(s):	CAN-2003-0969
Created:	January 6, 2004	Updated:	March 28, 2005
Description:	A vulnerability was discovered in mpg321, a command-line mp3 player, whereby user-supplied strings were passed to printf(3) unsafely. This vulnerability could be exploited by a remote attacker to overwrite memory, and possibly execute arbitrary code. In order for this vulnerability to be exploited, mpg321 would need to play a malicious mp3 file (including via HTTP streaming).
Alerts:	Gentoo