Security

Address space randomization in 2.6

Arjan van de Ven has posted a series of patches which add some address space randomization to the 2.6 kernel. With these patches applied, each process's stack will begin at a random location, and the beginning of the memory area used for mmap() (which is where shared libraries go, among other things) will be randomized as well. These patches represent an improvement in the kernel's security infrastructure, but the reception on the public lists has been surprisingly hostile.

Many buffer overflow exploits, especially those used in large-scale attacks, contain hardcoded addresses. An exploit which overflows a stack variable will place some executable code on the stack; it then overwrites the return pointer so that the broken function "returns" into the exploit code. If you look at a given distribution's shipped version of a vulnerable program, an exploit will always be able to place its payload at the same address on the stack, so it can contain that address directly. If, instead, the exploit author does not know ahead of time where the payload will end up, actually getting the computer to execute that code will be much harder.

That is why the stack randomization patch helps. When the stack location is deterministic, a relatively simple exploit can be made to work on all systems running the vulnerable distribution. If the stack moves, instead, hardcoded addresses no longer work.

Moving the mmap() area has similar benefits. One popular type of exploit prepares the stack and then "returns" into a shared library somewhere. That return can, for example, cause the application to behave as if it had intentionally called system() or a similar library function. Moving the libraries around makes these attacks harder.

One of the biggest complaints that has been raised is that the amount of randomization is insufficient. The patches, as posted, vary the stack base within a 64KB area and the mmap() base within a 1MB range. Alignment requirements prevent just any address from being used with the result that only a relatively small number of possible base addresses exists. So a determined attacker could repeatedly run a hardcoded exploit with some assurance that, within a reasonable amount of time, the stack would land at the right place and the exploit would work. Placing a long series of no-op instructions at the beginning of the payload can also make an exploit more robust when faced with randomization.

Arjan responds that the amount of randomization is not the issue at the moment. He is trying to get the infrastructure into the kernel and tested in a minimally disruptive way; the degree of randomization can be tweaked upward later on. That amount may never get as high as some people would like, at least on 32-bit systems, because it cuts back on the available virtual address space. But it is likely to go up once the developers are convinced that things are working.

In any case, a larger randomness makes the problem harder, but does not change its fundamental nature. With the ability to keep trying, an attacker will eventually get around any degree of randomization possible on 32-bit systems (64-bit systems are a different story). Thus, says Ingo Molnar:

Randomization is not a magic bullet which solves a wide range of security problems. It does make an attack harder, however, and that can only be a good thing.

Comments (13 posted)

New vulnerabilities

bind: validator function denial of service

Package(s):	bind	CVE #(s):	CAN-2005-0034
Created:	January 27, 2005	Updated:	February 1, 2005
Description:	A vulnerability was discovered in BIND version 9.3.0, an incorrect assumption in the validator function can be exploited by a remote attacker to cause named to exit prematurely.
Alerts:	Mandrake MDKSA-2005:023 2005-01-26

Comments (none posted)

ClamAV: multiple issues

Package(s):	clamav	CVE #(s):	CAN-2005-0133
Created:	January 31, 2005	Updated:	March 3, 2005
Description:	ClamAV fails to properly scan ZIP files with special headers and base64 encoded images in URLs.
Alerts:	Gentoo 200501-46 2005-01-31 Mandrake MDKSA-2005:025 2005-01-31 Conectiva CLA-2005:928 2005-03-03

Comments (none posted)

cpio - file permissions error

Package(s):	cpio	CVE #(s):	CAN-1999-1572
Created:	February 2, 2005	Updated:	July 19, 2005
Description:	Some versions of cpio contain an ancient vulnerability where files created by that utility have overly generous access permissions.
Alerts:	Debian DSA-664-1 2005-02-02 Ubuntu USN-75-1 2005-02-04 Mandrake MDKSA-2005:032 2005-02-10 Mandrake MDKSA-2005:032-1 2005-02-11 Red Hat RHSA-2005:073-01 2005-02-15 Red Hat RHSA-2005:080-01 2005-02-18 Fedora-Legacy FLSA:152891 2005-07-15

Comments (none posted)

f2c: insecure temp files

Package(s):	f2c	CVE #(s):	CAN-2005-0017 CAN-2005-0018
Created:	January 27, 2005	Updated:	April 20, 2005
Description:	The f2c fortran to C translator has a vulnerability due to insecure opening of temporary files. A local attacker can use this to launch a symlink attack.
Alerts:	Debian DSA-661-1 2005-01-27 Gentoo 200501-43 2005-01-30 Debian DSA-661-2 2005-04-20

Comments (none posted)

FireHOL: insecure temporary file creation

Package(s):	FireHOL	CVE #(s):
Created:	February 1, 2005	Updated:	February 1, 2005
Description:	FireHOL insecurely creates temporary files with predictable names. A local attacker could create malicious symbolic links to arbitrary system files. When FireHOL is executed, this could lead to these files being overwritten with the rights of the user launching FireHOL, usually the root user.
Alerts:	Gentoo 200502-01 2005-02-01

Comments (none posted)

Gallery: cross-site scripting vulnerability

Package(s):	gallery	CVE #(s):
Created:	January 31, 2005	Updated:	February 10, 2005
Description:	Rafel Ivgi has discovered a cross-site scripting vulnerability where the 'username' parameter is not properly sanitized in 'login.php'. See this Gallery announcement for the release of 1.4.4-pl5 for more information.
Alerts:	Gentoo 200501-45 2005-01-30 Gentoo 200501-45:03 2005-01-30

Comments (none posted)

ncpfs: multiple vulnerabilities

Package(s):	ncpfs	CVE #(s):	CAN-2005-0013 CAN-2005-0014
Created:	January 31, 2005	Updated:	May 15, 2006
Description:	Erik Sjolund discovered two vulnerabilities in the programs bundled with ncpfs: there is a potentially exploitable buffer overflow in ncplogin (CAN-2005-0014), and due to a flaw in nwclient.c, utilities using the NetWare client functions insecurely access files with elevated privileges (CAN-2005-0013).
Alerts:	Gentoo 200501-44 2005-01-30 Mandrake MDKSA-2005:028 2005-02-01 Red Hat RHSA-2005:371-01 2005-05-17 Fedora FEDORA-2005-435 2005-08-16 Fedora-Legacy FLSA:152904 2006-05-12

Comments (none posted)

ngIRCd: buffer overflow

Package(s):	ngIRCd	CVE #(s):
Created:	January 28, 2005	Updated:	February 1, 2005
Description:	Florian Westphal discovered a buffer overflow caused by an integer underflow in the Lists_MakeMask() function of lists.c. See the ngIRCd 0.8.2 release announcement for more information.
Alerts:	Gentoo 200501-40 2005-01-28

Comments (none posted)

openswan: stack based buffer overflow

Package(s):	openswan	CVE #(s):	CAN-2005-0162
Created:	January 28, 2005	Updated:	February 1, 2005
Description:	A stack-based buffer overflow in the get_internal_addresses function in the pluto application for Openswan 1.x before 1.0.9, and Openswan 2.x before 2.3.0, when compiled XAUTH and PAM enabled, allows remote authenticated attackers to execute arbitrary code.
Alerts:	Fedora FEDORA-2005-082 2005-01-28

Comments (none posted)

perl: setuid vulnerabilities

Package(s):	perl	CVE #(s):	CAN-2005-0155 CAN-2005-0156
Created:	February 2, 2005	Updated:	August 11, 2006
Description:	There are two vulnerabilities with perl when it is used in a setuid mode. The PERLIO_DEBUG environment variable can be used to overwrite arbitrary files; there is also an associated buffer overflow which can be exploited to gain root access.
Alerts:	Ubuntu USN-72-1 2005-02-02 Red Hat RHSA-2005:105-01 2005-02-07 Mandrake MDKSA-2005:031 2005-02-08 SuSE SUSE-SR:2005:004 2005-02-11 Gentoo 200502-13 2005-02-11 Red Hat RHSA-2005:103-01 2005-02-15 Fedora FEDORA-2005-353 2005-05-02 Red Hat RHSA-2006:0605-01 2006-08-10

Comments (none posted)

postgresql: privilege escalation via LOAD

Package(s):	postgresql	CVE #(s):	CAN-2005-0227
Created:	February 1, 2005	Updated:	February 7, 2005
Description:	John Heasman has discovered a local privilege escalation in the PostgreSQL server. Any user could use the LOAD extension to load any shared library into the PostgreSQL server; the library's initialization function was then executed with the permissions of the server.
Alerts:	Ubuntu USN-71-1 2005-02-01 Gentoo 200502-08 2005-02-07 Fedora FEDORA-2005-124 2005-02-07 Fedora FEDORA-2005-125 2005-02-07

Comments (none posted)

SquirrelMail: multiple vulnerabilities

Package(s):	squirrelmail	CVE #(s):	CAN-2005-0075 CAN-2005-0103 CAN-2005-0104
Created:	January 28, 2005	Updated:	July 19, 2005
Description:	SquirrelMail 1.4.4 has been released, fixing a number of security issues that have been resolved since 1.4.3a.
Alerts:	Gentoo 200501-39 2005-01-28 Debian DSA-662-1 2005-02-01 Red Hat RHSA-2005:135-01 2005-02-10 Red Hat RHSA-2005:099-01 2005-02-15 Debian DSA-662-2 2005-03-14 Fedora FEDORA-2005-259 2005-03-28 Fedora FEDORA-2005-260 2005-03-28 Fedora-Legacy FLSA:152900 2005-07-16

Comments (none posted)

uw-imap: authentication bypass

Package(s):	uw-imap imap	CVE #(s):	CAN-2005-0198
Created:	February 2, 2005	Updated:	March 1, 2005
Description:	The uw-imap package, prior to version 2004b, contains a vulnerability which can enable a remote attacker to bypass the authentication mechanism. This bug only affects CRAM-MD5 authentication, which is not enabled on all distributions.
Alerts:	Gentoo 200502-02 2005-02-02 Mandrake MDKSA-2005:026 2005-02-01 Red Hat RHSA-2005:128-01 2005-02-23 SuSE SUSE-SA:2005:012 2005-03-01

Comments (1 posted)

Updated vulnerabilities

OpenSSL: denial of service vulnerabilities

Package(s):	OpenSSL	CVE #(s):	CAN-2004-0081 CAN-2003-0851
Created:	March 17, 2004	Updated:	November 2, 2005
Description:	Versions 0.9.7a-c of the OpenSSL library suffer from two denial of service vulnerabilities; see the version 0.9.7d release announcement for details.
Alerts:	EnGarde ESA-20040317-003 2004-03-17 Red Hat RHSA-2004:119-01 2004-03-17 Red Hat RHSA-2004:120-01 2004-03-17 SuSE SuSE-SA:2004:007 2004-03-17 Mandrake MDKSA-2004:023 2004-03-17 Netwosix NW-2004-0005 2004-03-17 Debian DSA-465-1 2004-03-17 Gentoo 200403-03 2004-03-17 OpenPKG OpenPKG-SA-2004.007 2004-03-18 Red Hat RHSA-2004:121-01 2004-03-17 Slackware SSA:2004-077-01 2004-03-17 Trustix TSLSA-2004-0012 2004-03-17 Whitebox WBSA-2004:120-01 2004-03-22 Fedora FEDORA-2004-095 2004-03-19 Red Hat RHSA-2004:084-01 2004-03-23 Whitebox WBSA-2004:084-01 2004-03-23 Conectiva CLA-2004:834 2004-03-31 Fedora-Legacy FLSA:1395 2004-05-08 Fedora FEDORA-2005-1042 2005-10-31 Red Hat RHSA-2005:829-00 2005-11-02 Red Hat RHSA-2005:830-00 2005-11-02

Comments (1 posted)

ProZilla: Multiple vulnerabilities

Package(s):	ProZilla	CVE #(s):	CAN-2004-1120
Created:	November 23, 2004	Updated:	February 1, 2005
Description:	ProZilla contains several exploitable buffer overflows in the code handling the network protocols. A remote attacker could setup a malicious server and entice a user to retrieve files from that server using ProZilla. This could lead to the execution of arbitrary code with the rights of the user running ProZilla.
Alerts:	Gentoo 200411-31 2004-11-23 Debian DSA-663-1 2005-02-01

Comments (none posted)

TikiWiki: arbitrary command execution

Package(s):	TikiWiki	CVE #(s):
Created:	January 10, 2005	Updated:	January 31, 2005
Description:	TikiWiki lacks a check on uploaded images in the Wiki edit page. A malicious user could run arbitrary commands on the server by uploading and calling a PHP script.
Alerts:	Gentoo 200501-12 2005-01-10 Gentoo 200501-41 2005-01-30

Comments (none posted)

a2ps: input validation error

Package(s):	a2ps	CVE #(s):	CAN-2004-1170 CAN-2004-1377
Created:	November 26, 2004	Updated:	December 19, 2005
Description:	The GNU a2ps utility fails to properly sanitize filenames, which can be abused by a malicious user to execute arbitrary commands with the privileges of the user running the vulnerable application. More information at Security Focus.
Alerts:	Mandrake MDKSA-2004:140 2004-11-25 Debian DSA-612-1 2004-12-20 Gentoo 200501-02 2005-01-04 OpenPKG OpenPKG-SA-2005.003 2005-01-17 Mandriva MDKSA-2005:097 2005-06-07 Fedora-Legacy FLSA:152870 2005-12-17

Comments (none posted)

AWStats: remote code execution

Package(s):	awstats	CVE #(s):	CAN-2005-0116 CAN-2005-0362 CAN-2005-0363
Created:	January 25, 2005	Updated:	February 15, 2005
Description:	When 'awstats.pl' is run as a CGI script, it fails to validate specific inputs which are used in a Perl open() function call. A remote attacker could supply AWStats malicious input, potentially allowing the execution of arbitrary code with the rights of the web server.
Alerts:	Gentoo 200501-36 2005-01-25 Gentoo 200501-36:03 2005-01-25 Debian DSA-682-1 2005-02-15

Comments (1 posted)

cdrecord: failure to drop privilege

Package(s):	cdrecord	CVE #(s):	CAN-2004-0806
Created:	September 8, 2004	Updated:	February 21, 2005
Description:	The cdrecord utility, which is installed setuid on some distributions, fails to drop privilege before running a user-specified program.
Alerts:	Mandrake MDKSA-2004:091 2004-09-07 Fedora FEDORA-2004-297 2004-09-09 Fedora FEDORA-2004-298 2004-09-09 Gentoo 200409-18 2004-09-14 Fedora-Legacy FLSA:2058 2005-02-20

Comments (none posted)

chbg: buffer overflow

Package(s):	chbg	CVE #(s):	CAN-2004-1264
Created:	January 18, 2005	Updated:	February 2, 2005
Description:	Danny Lungstrom discovered a vulnerability in chbg, a tool to change background pictures. A maliciously crafted configuration/scenario file could overflow a buffer and lead to the execution of arbitrary code on the victim's machine.
Alerts:	Debian DSA-644-1 2005-01-18 Mandrake MDKSA-2005:027 2005-02-01

Comments (none posted)

cups: multiple vulnerabilities

Package(s):	cups	CVE #(s):	CAN-2004-1267 CAN-2004-1268 CAN-2004-1269 CAN-2004-1270
Created:	December 17, 2004	Updated:	February 9, 2005
Description:	cups has a denial of service vulnerability in the lppasswd utility and a remote code execution vulnerability in the hpgltops filter.
Alerts:	Fedora FEDORA-2004-560 2004-12-17 Fedora FEDORA-2004-559 2004-12-17 Gentoo 200412-25 2004-12-28 Red Hat RHSA-2005:013-01 2005-01-12 Gentoo 200412-25:02 2004-12-28 Mandrake MDKSA-2005:008 2005-01-17 SuSE SUSE-SR:2005:003 2005-02-04

Comments (none posted)

cyrus-sasl: remote buffer overflow

Package(s):	cyrus-sasl	CVE #(s):	CAN-2004-0884
Created:	October 7, 2004	Updated:	March 16, 2005
Description:	cyrus-sasl has a vulnerability involving a buffer overflow in the digestmda5.c file. A remote attacker may be able to compromise the system. Also, a local user may be able to exploit a vulnerability by using the SASL_PATH environment variable.
Alerts:	Gentoo 200410-05 2004-10-07 Red Hat RHSA-2004:546-02 2004-10-07 Mandrake MDKSA-2004:106 2004-10-07 Trustix TSLSA-2004-0053 2004-10-08 Debian DSA-563-1 2004-10-12 Debian DSA-563-2 2004-10-12 Debian DSA-563-3 2004-10-14 Debian DSA-568-1 2004-10-16 Conectiva CLA-2004:889 2004-11-11 OpenPKG OpenPKG-SA-2005.004 2005-01-28 Fedora-Legacy FLSA:2137 2005-02-17 SuSE SUSE-SA:2005:013 2005-03-03 Mandrake MDKSA-2005:054 2005-03-15

Comments (none posted)

dhcp: format string vulnerability

Package(s):	dhcp	CVE #(s):	CAN-2004-1006
Created:	November 4, 2004	Updated:	July 13, 2005
Description:	Dhcp has a format string vulnerability in the log functions of dhcp 2.x that may be exploited via a malicious DNS server.
Alerts:	Debian DSA-584-1 2004-11-04 Red Hat RHSA-2005:212-01 2005-04-12 Fedora-Legacy FLSA:152835 2005-07-10

Comments (none posted)

enscript: arbitrary code execution

Package(s):	enscript	CVE #(s):	CAN-2004-1184 CAN-2004-1185 CAN-2004-1186
Created:	January 21, 2005	Updated:	May 27, 2006
Description:	Erik Sjölund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. Unsanitized input can cause the execution of arbitrary commands via EPSF pipe support. Due to missing sanitizing of filenames it is possible that a specially crafted filename can cause arbitrary commands to be executed. Multiple buffer overflows can cause the program to crash.
Alerts:	Debian DSA-654-1 2005-01-21 Ubuntu USN-68-1 2005-01-24 Fedora FEDORA-2005-015 2005-01-26 Fedora FEDORA-2005-016 2005-01-26 Fedora FEDORA-2005-091 2005-01-28 Fedora FEDORA-2005-092 2005-01-28 Fedora FEDORA-2005-096 2005-01-31 Red Hat RHSA-2005:039-01 2005-02-01 Gentoo 200502-03 2005-02-02 Mandrake MDKSA-2005:033 2005-02-10 Red Hat RHSA-2005:040-01 2005-02-15 Fedora-Legacy FLSA:152892 2005-12-17 rPath rPSA-2006-0083-1 2006-05-26

Comments (none posted)

ethereal: multiple vulnerabilites

Package(s):	ethereal	CVE #(s):	CAN-2005-0006 CAN-2005-0007 CAN-2005-0008 CAN-2005-0009 CAN-2005-0010 CAN-2005-0084
Created:	January 21, 2005	Updated:	February 15, 2005
Description:	Ethereal has released 0.10.9 to fix several vulnerabilities.
Alerts:	Gentoo 200501-27 2005-01-20 Debian DSA-653-1 2005-01-21 Mandrake MDKSA-2005:013 2005-01-24 Fedora FEDORA-2005-068 2005-01-25 Fedora FEDORA-2005-069 2005-01-25 Red Hat RHSA-2005:011-01 2005-02-02 Red Hat RHSA-2005:037-01 2005-02-15

Comments (none posted)

evolution: arbitrary code execution

Package(s):	evolution	CVE #(s):	CAN-2005-0102
Created:	January 24, 2005	Updated:	May 19, 2005
Description:	Max Vozeler discovered an integer overflow in camel-lock-helper. A user-supplied length value was not validated, so that a value of -1 caused a buffer allocation of 0 bytes; this buffer was then filled by an arbitrary amount of user-supplied data. A local attacker or a malicious POP3 server could exploit this to execute arbitrary code with root privileges (because camel-lock-helper is installed as setuid root).
Alerts:	Ubuntu USN-69-1 2005-01-24 Gentoo 200501-35 2005-01-24 Mandrake MDKSA-2005:024 2005-01-27 Debian DSA-673-1 2005-02-10 Conectiva CLA-2005:925 2005-02-16 Red Hat RHSA-2005:238-01 2005-05-19

Comments (1 posted)

exim: buffer overflows

Package(s):	exim	CVE #(s):	CAN-2005-0021 CAN-2005-0022
Created:	January 7, 2005	Updated:	February 15, 2005
Description:	A buffer overflow in the host_aton() function in Exim 4.4x may allow execution of arbitrary commands with elevated privileges by a local user. This has been patched in Exim 4.43. Additionally, there is a another buffer overflow in Exim's auth_spa_server() which also be fixed in Exim 4.43.
Alerts:	Fedora FEDORA-2005-001 2005-01-06 Fedora FEDORA-2005-001 2005-01-06 Ubuntu USN-56-1 2005-01-07 Debian DSA-635-1 2005-01-12 Debian DSA-637-1 2005-01-13 Gentoo 200501-23 2005-01-12 Red Hat RHSA-2005:025-01 2005-02-15

Comments (1 posted)

Foomatic: Arbitrary command execution in foomatic-rip

Package(s):	foomatic	CVE #(s):	CAN-2004-0801
Created:	September 20, 2004	Updated:	May 31, 2006
Description:	There is a vulnerability in the foomatic-filters package. This vulnerability is due to insufficient checking of command-line parameters and environment variables in the foomatic-rip filter. This vulnerability may allow both local and remote attackers to execute arbitrary commands on the print server with the permissions of the spooler.
Alerts:	Gentoo 200409-24 2004-09-20 Fedora FEDORA-2004-303 2004-09-21 Conectiva CLA-2004:880 2004-10-27 Fedora-Legacy FLSA:2076 2004-11-05 SuSE SUSE-SA:2006:026 2006-05-30

Comments (none posted)

FreeRADIUS: denial of service

Package(s):	freeradius	CVE #(s):	CAN-2004-0938 CAN-2004-0960 CAN-2004-0961
Created:	September 22, 2004	Updated:	February 2, 2005
Description:	FreeRADIUS (through version 1.0.1) suffers from several denial of service vulnerabilities in its packet reception code.
Alerts:	Gentoo 200409-29 2004-09-22 Red Hat RHSA-2004:609-01 2004-11-12 Fedora-Legacy FLSA:2187 2005-02-01

Comments (none posted)

gaim: buffer overflow in MSN protocol

Package(s):	gaim	CVE #(s):	CAN-2004-0891
Created:	October 25, 2004	Updated:	February 11, 2005
Description:	A buffer overflow in the MSN protocol handler for gaim 0.79 to 1.0.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an "unexpected sequence of MSNSLP messages" that results in an unbounded copy operation that writes to the wrong buffer.
Alerts:	Slackware SSA:2004-296-01 2004-10-25 Gentoo 200410-23 2004-10-24 Ubuntu USN-8-1 2004-10-27 Mandrake MDKSA-2004:117 2004-11-01 Red Hat RHSA-2004:604-01 2004-10-20 Fedora-Legacy FLSA:2188 2005-02-10

Comments (none posted)

gtk2, gdk-pixbuf: buffer overflows

Package(s):	gdk-pixbuf gtk2	CVE #(s):	CAN-2004-0753 CAN-2004-0782 CAN-2004-0783 CAN-2004-0788
Created:	September 15, 2004	Updated:	February 25, 2005
Description:	The gdk-pixbuf and gtk2 libraries contain vulnerabilities in their handling of BMP and XPM files which can lead to denial of service and, potentially, code execution attacks.
Alerts:	Fedora FEDORA-2004-286 2004-09-15 Fedora FEDORA-2004-287 2004-09-15 Fedora FEDORA-2004-288 2004-09-15 Fedora FEDORA-2004-289 2004-09-15 Mandrake MDKSA-2004:095 2004-09-15 Red Hat RHSA-2004:447-01 2004-09-15 Red Hat RHSA-2004:466-01 2004-09-15 Debian DSA-546-1 2004-09-16 Red Hat RHSA-2004:447-02 2004-09-15 Debian DSA-549-1 2004-09-17 SuSE SUSE-SA:2004:033 2004-09-17 Mandrake MDKSA-2004:095-1 2004-09-17 Gentoo 200409-28 2004-09-21 Slackware SSA:2004-266-02 2004-09-22 Conectiva CLA-2004:875 2004-10-18 Fedora-Legacy FLSA:2005 2005-02-23

Comments (none posted)

gettext: Insecure temporary file handling

Package(s):	gettext	CVE #(s):	CAN-2004-0966
Created:	October 11, 2004	Updated:	March 1, 2006
Description:	gettext insecurely creates temporary files in world-writeable directories with predictable names. A local attacker could create symbolic links in the temporary files directory, pointing to a valid file somewhere on the filesystem. When gettext is called, this would result in file access with the rights of the user running the utility, which could be the root user.
Alerts:	Gentoo 200410-10 2004-10-10 Ubuntu USN-5-1 2004-10-27 OpenPKG OpenPKG-SA-2004.055 2004-12-23 Gentoo 200410-10:02 2004-10-10 Fedora-Legacy FLSA:136323 2006-01-09 Mandriva MDKSA-2006:051 2006-02-28

Comments (1 posted)

ghostscript: symlink vulnerabilities

Package(s):	ghostscript	CVE #(s):	CAN-2004-0967
Created:	October 20, 2004	Updated:	September 28, 2005
Description:	The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks.
Alerts:	Gentoo 200410-18 2004-10-20 Ubuntu USN-3-1 2004-10-27 Red Hat RHSA-2005:081-01 2005-09-28

Comments (none posted)

glibc: Information leak with LD_DEBUG

Package(s):	glibc	CVE #(s):	CAN-2004-1453
Created:	August 17, 2004	Updated:	May 26, 2005
Description:	Silvio Cesare discovered a potential information leak in glibc. It allows LD_DEBUG on SUID binaries where it should not be allowed. This has various security implications, which may be used to gain confidential information. An attacker can gain the list of symbols a SUID application uses and their locations and can then use a trojaned library taking precedence over those symbols to gain information or perform further exploitation.
Alerts:	Gentoo 200408-16 2004-08-16 Red Hat RHSA-2005:256-01 2005-05-18

Comments (1 posted)

glibc: tempfile vulnerability in catchsegv script

Package(s):	glibc	CVE #(s):	CAN-2004-0968
Created:	October 21, 2004	Updated:	November 14, 2005
Description:	The catchsegv script in the glibc package has a symlink vulnerability that may allow a local user to overwrite arbitrary files with the permissions of the user that is running the script.
Alerts:	Gentoo 200410-19 2004-10-21 Ubuntu USN-4-1 2004-10-27 Fedora FEDORA-2004-356 2004-11-11 Red Hat RHSA-2004:586-01 2004-12-20 Mandrake MDKSA-2004:159 2004-12-29 Debian DSA-636-1 2005-01-12 Red Hat RHSA-2005:261-01 2005-04-28 Fedora-Legacy FLSA:152848 2005-11-13

Comments (none posted)

gnome-vfs: backend script vulnerabilities

Package(s):	gnome-vfs	CVE #(s):	CAN-2004-0494
Created:	August 4, 2004	Updated:	February 21, 2005
Description:	Several scripts packaged with gnome-vfs, using its "extfs" capability, have security flaws. These scripts tend not to be used on many systems, but their presence can still be a threat.
Alerts:	Red Hat RHSA-2004:373-01 2004-08-04 Whitebox WBSA-2004:373-01 2004-08-19 Fedora-Legacy FLSA:1944 2005-02-20

Comments (none posted)

groff: insecure temporary directory

Package(s):	groff	CVE #(s):	CAN-2004-0969
Created:	November 1, 2004	Updated:	February 9, 2006
Description:	Recently, Trustix Secure Linux discovered a vulnerability in the groff package. The utility "groffer" created a temporary directory in an insecure way, which allowed exploitation of a race condition to create or overwrite files with the privileges of the user invoking the program.
Alerts:	Ubuntu USN-13-1 2004-11-01 Gentoo 200411-15 2004-11-08 Mandriva MDKSA-2006:038 2006-02-08

Comments (none posted)

gtkhtml: malformed messages cause crash

Package(s):	gtkhtml	CVE #(s):	CAN-2003-0133 CAN-2003-0541
Created:	April 14, 2003	Updated:	April 18, 2005
Description:	GtkHTML is the HTML rendering widget used by the Evolution mail reader. GtkHTML supplied with versions of Evolution prior to 1.2.4 contain a bug when handling HTML messages. Alan Cox discovered that certain malformed messages could cause the Evolution mail component to crash.
Alerts:	Red Hat RHSA-2003:126-01 2003-04-14 Mandrake MDKSA-2003:046 2003-04-15 Red Hat RHSA-2003:264-01 2003-09-09 Conectiva CLA-2003:737 2003-09-12 Mandrake MDKSA-2003:093 2003-09-18 Debian DSA-710-1 2005-04-18

Comments (none posted)

imagemagick: .psd image file decode vulnerability

Package(s):	imagemagick	CVE #(s):	CAN-2005-0005
Created:	January 18, 2005	Updated:	March 23, 2005
Description:	According to this iDEFENSE advisory, ImageMagick is vulnerable to a heap overflow when decoding .psd image files. This could be remotely exploited allowing an attacker to execute arbitrary code.
Alerts:	Ubuntu USN-62-1 2005-01-18 Debian DSA-646-1 2005-01-19 Gentoo 200501-26 2005-01-20 Gentoo 200501-37 2005-01-26 Red Hat RHSA-2005:071-01 2005-02-15 Red Hat RHSA-2005:070-01 2005-03-23

Comments (1 posted)

imlib2: buffer overflows

Package(s):	imlib2	CVE #(s):	CAN-2004-0802 CAN-2004-0817
Created:	September 8, 2004	Updated:	October 26, 2005
Description:	The imlib2 library contains buffer overflows in the BMP handling code.
Alerts:	Mandrake MDKSA-2004:089 2004-09-07 Fedora FEDORA-2004-300 2004-09-09 Fedora FEDORA-2004-301 2004-09-09 Gentoo 200409-12 2004-09-08 Red Hat RHSA-2004:465-01 2004-09-15 Debian DSA-548-1 2004-09-16 Debian DSA-552-1 2004-09-22 Conectiva CLA-2004:870 2004-09-28 Debian DSA-548-2 2005-10-26

Comments (none posted)

iptables: missing initialization

Package(s):	iptables	CVE #(s):	CAN-2004-0986
Created:	November 1, 2004	Updated:	February 11, 2005
Description:	Faheem Mitha noticed that the iptables command, an administration tool for IPv4 packet filtering and NAT, did not always load the required modules on its own as it was supposed to. This could lead to firewall rules not being loaded on system startup. This caused a failure in connection with rules provided by lokkit at least.
Alerts:	Debian DSA-580-1 2004-11-01 Mandrake MDKSA-2004:125 2004-11-04 Ubuntu USN-81-1 2005-02-11 Fedora-Legacy FLSA:2252 2005-02-10

Comments (none posted)

kdebase: screen saver crash

Package(s):	kdebase	CVE #(s):	CAN-2005-0078
Created:	January 26, 2005	Updated:	January 26, 2005
Description:	From the Debian advisory: "Raphaël Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session."
Alerts:	Debian DSA-660-1 2005-01-26

Comments (none posted)

kdelibs: unsanitzied input

Package(s):	kdelibs	CVE #(s):	CAN-2004-1165
Created:	January 10, 2005	Updated:	July 19, 2005
Description:	Thiago Macieira discovered a vulnerability in the kioslave library, which is part of kdelibs, which allows a remote attacker to execute arbitrary FTP commands via an ftp:// URL that contains an URL-encoded newline before the FTP command.
Alerts:	Debian DSA-631-1 2005-01-10 Gentoo 200501-18 2005-01-11 Fedora FEDORA-2005-063 2005-01-25 Fedora FEDORA-2005-064 2005-01-25 Red Hat RHSA-2005:009-01 2005-02-10 Red Hat RHSA-2005:065-01 2005-02-15 Mandrake MDKSA-2005:045 2005-02-17 Fedora-Legacy FLSA:152769 2005-07-15

Comments (none posted)

kerberos5: execution of arbitrary code by authenticated user

Package(s):	kerberos5	CVE #(s):	CAN-2004-1189
Created:	December 21, 2004	Updated:	February 15, 2005
Description:	There is a buffer overflow in the password history handling code of libkadm5srv which could be exploited by an authenticated user to execute arbitrary code on a Key Distribution Center (KDC) server.
Alerts:	Trustix TSLSA-2004-0069 2004-12-21 Fedora FEDORA-2004-563 2004-12-21 Fedora FEDORA-2004-564 2004-12-21 Mandrake MDKSA-2004:156 2004-12-22 Gentoo 200501-05 2005-01-05 Debian DSA-629-1 2005-01-07 Ubuntu USN-58-1 2005-01-10 Conectiva CLA-2005:917 2005-01-13 Red Hat RHSA-2005:012-01 2005-01-19 Red Hat RHSA-2005:045-01 2005-02-15

Comments (none posted)

kernel: i386 SMP page fault handler privilege escalation

Package(s):	kernel	CVE #(s):	CAN-2005-0001
Created:	January 14, 2005	Updated:	February 25, 2005
Description:	Paul Starzetz found an exploitable hole in the x86 SMP page fault handler which could lead to privilege escalation. See the advisory for details.
Alerts:	Fedora FEDORA-2005-026 2005-01-13 Fedora FEDORA-2005-025 2005-01-13 Ubuntu USN-60-0 2005-01-14 SuSE SUSE-SA:2005:003 2005-01-21 Red Hat RHSA-2005:016-01 2005-01-21 Red Hat RHSA-2005:017-01 2005-01-21 Mandrake MDKSA-2005:022 2005-01-25 SuSE SUSE-SA:2005:005 2005-02-04 SuSE SUSE-SA:2005:010 2005-02-25 Fedora-Legacy FLSA:2336 2005-02-24

Comments (none posted)

Konversation: multiple vulnerabilities

Package(s):	konversation	CVE #(s):	CAN-2005-0129 CAN-2005-0130 CAN-2005-0131
Created:	January 24, 2005	Updated:	January 26, 2005
Description:	Multiple vulnerabilities have been discovered in all Konversation versions up to and including 0.15.
Alerts:	Gentoo 200501-34 2005-01-24

Comments (none posted)

libdbi-perl: insecure temporary file

Package(s):	libdbi-perl	CVE #(s):	CAN-2005-0077
Created:	January 25, 2005	Updated:	March 2, 2006
Description:	Javier Fernández-Sanguino Peña from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a temporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library.
Alerts:	Debian DSA-658-1 2005-01-25 Ubuntu USN-70-1 2005-01-25 Gentoo 200501-38 2005-01-26 Red Hat RHSA-2005:069-01 2005-02-01 Mandrake MDKSA-2005:030 2005-02-08 Red Hat RHSA-2005:072-01 2005-02-15 Gentoo 200501-38:03 2005-01-26 Fedora-Legacy FLSA:178989 2006-03-01

Comments (none posted)

libgd2: buffer overflows in PNG handling

Package(s):	libgd2	CVE #(s):	CAN-2004-0990 CAN-2004-0941
Created:	October 29, 2004	Updated:	June 28, 2006
Description:	Several buffer overflows have been discovered in libgd's PNG handling functions. If an attacker tricked a user into loading a malicious PNG image, they could leverage this into executing arbitrary code in the context of the user opening image. Most importantly, this library is commonly used in PHP. One possible target would be a PHP driven photo website that lets users upload images. Therefore this vulnerability might lead to privilege escalation to a web server's privileges. Multiple buffer overflows in the gd graphics library (libgd) 2.0.21 and earlier may allow remote attackers to execute arbitrary code via malformed image files that trigger the overflows due to improper calls to the gdMalloc function.
Alerts:	Ubuntu USN-11-1 2004-10-28 OpenPKG OpenPKG-SA-2004.049 2004-10-30 Gentoo 200411-08 2004-11-03 Debian DSA-589-1 2004-11-09 Debian DSA-591-1 2004-11-09 Ubuntu USN-21-1 2004-11-09 Fedora FEDORA-2004-411 2004-11-11 Fedora FEDORA-2004-412 2004-11-11 Ubuntu USN-25-1 2004-11-15 Mandrake MDKSA-2004:132 2004-11-15 Debian DSA-601-1 2004-11-29 Debian DSA-602-1 2004-11-29 Ubuntu USN-33-1 2004-11-29 Red Hat RHSA-2004:638-01 2004-12-17 Fedora-Legacy FLSA:152838 2005-07-15 Red Hat RHSA-2006:0194-01 2006-02-01 Mandriva MDKSA-2006:114 2006-06-27

Comments (none posted)

libpam-radius-auth

Package(s):	libpam-radius-auth	CVE #(s):	CAN-2005-0108
Created:	January 26, 2005	Updated:	January 26, 2005
Description:	The PAM RADIUS authentication module suffers from an integer overflow vulnerability.
Alerts:	Debian DSA-659-1 2005-01-26

Comments (none posted)

libpng: multiple vulnerabilities

Package(s):	libpng	CVE #(s):	CAN-2002-1363 CAN-2004-0597 CAN-2004-0598 CAN-2004-0599
Created:	August 4, 2004	Updated:	February 10, 2005
Description:	There is yet another set of holes in libpng, versions 1.2.5 and prior, which can be exploited by a malicious image file; see this advisory from Chris Evans or this CERT advisory for details.
Alerts:	OpenPKG OpenPKG-SA-2004.035 2004-08-04 Red Hat RHSA-2004:402-01 2004-08-04 SuSE SUSE-SA:2004:023 2004-08-04 Mandrake MDKSA-2004:079 2004-08-04 Debian DSA-536-1 2004-08-04 Gentoo 200408-03 2004-08-05 Trustix TSLSA-2004-0040 2004-08-05 Conectiva CLA-2004:856 2004-08-06 Slackware SSA:2004-222-01 2004-08-07 Slackware SSA:2004-222-01b 2004-08-10 Slackware SSA:2004-223-02 2004-08-07 Slackware SSA:2004-223-01 2004-08-09 Mandrake MDKSA-2004:082 2004-08-12 Whitebox WBSA-2004:402-01 2004-08-19 Gentoo 200408-22 2004-08-23 Red Hat RHSA-2004:421-01 2004-08-04 Fedora-Legacy FLSA:1943 2005-02-08

Comments (1 posted)

libtiff: buffer overflow

Package(s):	libtiff	CVE #(s):	CAN-2004-1308
Created:	December 22, 2004	Updated:	May 19, 2005
Description:	The libtiff image manipulation library contains several exploitable buffer overflows.
Alerts:	Ubuntu USN-46-1 2004-12-22 Fedora FEDORA-2004-576 2004-12-22 Fedora FEDORA-2004-577 2004-12-22 Debian DSA-617-1 2004-12-24 Debian DSA-626-1 2005-01-06 Gentoo 200501-06 2005-01-05 Mandrake MDKSA-2005:001 2005-01-06 Mandrake MDKSA-2005:002 2005-01-06 Ubuntu USN-54-1 2005-01-06 Fedora FEDORA-2005-597 2005-01-07 Fedora FEDORA-2005-598 2005-01-07 SuSE SUSE-SA:2005:001 2005-01-10 Red Hat RHSA-2005:019-01 2005-01-13 Conectiva CLA-2005:920 2005-01-20 Red Hat RHSA-2005:035-01 2005-02-15 Fedora-Legacy FLSA:152815 2005-05-18

Comments (none posted)

libxml2: multiple buffer overflows

Package(s):	libxml2	CVE #(s):	CAN-2004-0989
Created:	October 28, 2004	Updated:	February 28, 2005
Description:	libxml2 prior to version 2.6.14 has multiple buffer overflow vulnerabilities, if a local user passes a specially crafted FTP URL, arbitrary code may be executed.
Alerts:	Fedora FEDORA-2004-353 2004-10-28 Ubuntu USN-10-1 2004-10-28 OpenPKG OpenPKG-SA-2004.050 2004-10-31 Trustix TSLSA-2004-0055 2004-10-29 Gentoo 200411-05 2004-11-02 Debian DSA-582-1 2004-11-02 Mandrake MDKSA-2004:127 2004-11-04 Red Hat RHSA-2004:615-01 2004-11-12 Conectiva CLA-2004:890 2004-11-18 Red Hat RHSA-2004:650-01 2004-12-16 Ubuntu USN-89-1 2005-02-28

Comments (none posted)

libxpm4: stack and integer overflows

Package(s):	libxpm4	CVE #(s):	CAN-2004-0687 CAN-2004-0688
Created:	September 16, 2004	Updated:	February 14, 2005
Description:	There are several stack and integer overflow bugs in the libXpm code of XFree86 that may be used for a denial of service.
Alerts:	Mandrake MDKSA-2004:098 2004-09-15 Mandrake MDKSA-2004:099 2004-09-15 SuSE SUSE-SA:2004:034 2004-09-17 Gentoo 200409-34 2004-09-27 Red Hat RHSA-2004:478-01 2004-10-04 Red Hat RHSA-2004:479-01 2004-10-06 Debian DSA-560-1 2004-10-07 Gentoo 200410-09 2004-10-09 Debian DSA-561-1 2004-10-11 Mandrake MDKSA-2004:124 2004-11-04 Ubuntu USN-27-1 2004-11-17 Red Hat RHSA-2004:537-01 2004-12-02 Red Hat RHSA-2005:004-01 2005-01-12 Conectiva CLA-2005:924 2005-02-14

Comments (none posted)

lvm10: creates insecure temporary directory

Package(s):	lvm10	CVE #(s):	CAN-2004-0972
Created:	November 1, 2004	Updated:	July 25, 2005
Description:	Trustix Secure Linux discovered a vulnerability in a supplemental script of the lvm10 package. The program "lvmcreate_initrd" created a temporary directory in an insecure way, which could allow a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the program.
Alerts:	Ubuntu USN-15-1 2004-11-01 Debian DSA-583-1 2004-11-03 Gentoo