Debconf5: Structural Evolution
Debconf5, the sixth annual
Debian Conference, recently descended upon the Helsinki University of
Technology (HUT) in Espoo, Finland. LWN reporter Rebecca Sobol was
privileged to attend this year's event.
Hundreds of Debian developers, maintainers, translators, users and fans
joined together for an overflowing week's worth of talks, BOFs, hacking and
partying. Debian GNU/Linux is the
largest distribution project in many ways; lots of developers (around 200
Debian Developers plus scores of package maintainers, documentation authors
and translators), support for more architectures, lots of packages (nearly
15,000 binary packages are available), more derived distributions using it as a base, and
soon even a choice between Linux and Hurd kernels. The Debian community is
massive and scattered around the globe.
During the year these people keep in touch through a variety of mailing lists and IRC
channels, but the annual Debconf provides people with a chance to meet face
to face to talk about their favorite operating system. Each year Debconf
meets in a different part of the world to make it more accessible to some
portion of its global community. This year's conference in Finland
brought out over ninety Finns, followed by a full gross of people from
Germany, the United Kingdom, the United States, Sweden, Spain and Norway.
It was also accessible to a handful of people from the Russian Federation
and other parts of Eastern Europe. A few traveled greater distances to
come from South America, New Zealand and Fiji. All told, there were people
from over thirty countries at this year's event.
Debian is large, and it is all volunteer. A few people have found or created
jobs for themselves where they can be paid to work on Debian, at least part
of the time, but they are in the minority. The organization is guided by a
social contract and
maintains a strong commitment to
software freedom.
Bdale Garbee, long time Debian developer and former Debian Project Leader
gave a talk on Debian's
Structural Evolution, subtitled Musings on Debian, Today and
Tomorrow. He has serious concerns that Debian has grown too large for its
infrastructure. For example, each year Debian developers elect a Project
Leader. For nine weeks each year a few prominent Debian developers cease
working as a team to compete for a job that has grown too complex for a
single person. Only Debian developers are allowed to vote, leaving
hundreds, or more likely thousands of Debian volunteers and users with no
say whatsoever.
Some of Debian's infrastructure is ably provided by Software in the Public Interest (SPI).
However too few Debian developers are involved in SPI, which oversees many
other projects. Also it not in SPI's mandate to provide technical
guidance, that is the role of the Technical Committee. Bdale finds the
committee, as currently defined, is not particularly satisfying. The
committee could use a periodic review and refresh, which is currently not
happening.
The current DPL, Branden Robinson started Project SCUD as an attempt to
address some of these issues while working within the constraints of the
Debian constitution. However Bdale (a member of SCUD) finds that the
relationship between the DPL and the project is not clear. The team is
self-selected and does not include a representative sampling of Debian
project participants.
Perhaps it is time to replace the DPL and Technical Committee with an
elected leadership board. Candidates would be motivated to campaign on
their teamwork skills and more people would be willing to be involved in
Debian's leadership. Perhaps a way could be found to allow the greater
Debian community a voice in this process. Perhaps this would make Debian
even stronger.
Comments (10 posted)
Delays in security updates
There are a number of reasons that users choose Linux, but security is one of the most often-cited reasons. While Linux distributions certainly see their fair share of security issues, updates are usually issued in a timely fashion.
However, there are times when the process gets bogged down. Security updates for Debian, for example, were not going out in a timely fashion for some time. As reported in Branden Robinson's Debian Project Leader Report for July, security updates were interrupted for some time. This has also been reported in the mainstream press, though members of the Debian team take issue with the actual reporting.
Looking at the security advisories for 2005, one thing that is clear is that no security updates were issued through most of June. There are no updates from June 4 through June 29. Updates resumed on June 30, and there have been a steady stream of updates since then. We e-mailed Martin Schulze about the Debian security delays, and he confirmed the time period.
That is quite a delay for some of the updates. For example, the sudo vulnerability, for example, was addressed in Debian on July 1 for Woody and Sarge. The Fedora Core team released an update for this vulnerability for Fedora Core 3 and Fedora Core 4 on June 21, and Ubuntu released an update on June 21st for Hoary (5.04) and Warty (4.10). Updates for Gaim's recent vulnerabilities were issued on June 16 for FC3 and FC4, and June 10 and June 15 by the Ubuntu team, respectively -- but not for Debian until July 5.
In an e-mail, Schulze said that he didn't know all of the details of the problems that delayed updates, but explained way the process is supposed to work:
When a new release happens the old release, formerly known as "stable", becomes "oldstable" and "testing" becomes "stable."
This change needs to be done on the ftp-master, on the security host and on the wanna-build database (the database behind the buildd network).
In addition to that, on all buildd hosts that are supposed to build packages for "oldstable" as well (not all buildds do), the old "stable" build chroot needs to be renamed to "oldstable" and "oldstable" needs to be enabled in the configuration.
Additionally, on all buildd hosts the "stable" build chroot needs to be updated to the current "stable," or the old "testing" chroot renamed. These are used by the security builds as well.
All this should be done synchronously, but wasn't. On July 7th I wrote in my logbook that the buildd network seems to be finally fixed. Actually it was fixed two days before that article. Before that, one part or another was missing or not fixed totally.
In the Project Leader Report, Robinson points out that there was a failure in infrastructure and communication:
I suspect, given what I know from conversation with some of the principals close to the infrastructure involved in getting our stable security updates out, that that's what we're dealing with. There have been technical failures and communication failures, with the former greatly exacerbated by the latter.
I have asked Andreas Barth to look into this situation and establish as clear a factual record as he can. Using this report, we should be able to attack the areas of weakness. One thing I'd like to see is better documentation of the internal workings of the security update process, perhaps in the Debian Developers' Reference. With a broader understanding of security workflow, I'm hopeful that people will be less likely to draw erroneous inferences about what the causes of problems are, and more likely to make offers of assistance that prove fruitful.
Robinson has also proposed making the security team DPL delegates, and points out that now would be a good time to add new members to the security team roster. Whether that has happened or not, however, remains up in the air. Schulze said that adding new members would be "discussed inside the security team." Robinson has not replied to e-mails asking about the security delays.
Schulze also said that the backlog of security updates that built up through June should be cleared out by now.
Around the same time, the Fedora Legacy project's security updates also seem to have been bottled up. The Fedora Legacy project has a gap for updates between June 5 and July 9, for all Red Hat and Fedora distributions supported by the Fedora Legacy project, Red Hat 7.3 and 9.0, and Fedora Core 1 and Fedora Core 2.
Some of the updates that were released in July by Fedora Legacy were rather tardy indeed. For example the GNU Mailman advisory (CAN-2005-0202), was fixed by other distributions back in February. The PHP advisory on July 10 from Fedora Legacy was addressed back in April by Gentoo, Mandriva and others. (Debian's fix for this bug came out in May.) This post on the Fedora Legacy mailing list from Jesse Keating acknowledges that the legacy project has longer lead times on security updates.
It would seem that Debian's infrastructure problems have been solved, at least for now. However, the gap in updates is somewhat alarming. As a rule, Debian has often been one of the first distributions to issue security updates and advisories, and has developed a well-deserved reputation for being quick to respond to security issues. We hope that the delay in updates while the project was transitioning from Woody to Sarge is a one-time issue, and that the transition from Sarge to Etch, whenever that happens, will happen more smoothly.
The importance of speedy security releases can't be emphasized enough. Aside from the obvious PR problems when a distribution is behind in updates, Linux users need to be able to depend on updates as soon as they can be made available so that they are not subject to exploits any longer than is absolutely necessary.
Comments (2 posted)
Page editor: Rebecca Sobol
Security
Security news
Debconf5: Securing the Testing Distribution
This part of our Debconf5 coverage was inspired by a talk titled
Securing the Testing Distribution given by Joey Hess.
Debian has several branches, including two currently supported stable
branches, Woody and Sarge and the unstable branch, also known as sid.
Though usually fairly stable, sid is in constant flux and provides a faster
paced target for those who like run the latest and greatest software.
The testing branch, on the other hand, provides a look at the next stable
version still in development, in this case etch. Testing was first used
when woody was in development. Once Woody was released as Debian 3.0
testing became synonymous with sarge. So now that Sarge has been released
as Debian 3.1, testing has become etch which will someday to be the next
stable version.
The supported stable version(s) (support for Woody will end before we will
see an etch release) have a security team providing security updates. Often
security fixes are backported to the stable packages. Packages in sid are
usually upgraded to a new version of the package in which the problem has
been fixed. Up to now there has been no mechanism to provide security
updates for testing.
Some of the security issues in stable will have already been fixed in
testing's newer packages, but for the most part security fixes have lagged
behind stable and unstable. Packages fixed in unstable can automatically
migrate to testing, if certain criteria are met, but that comes with a
built-in delay. Unrelated release critical bugs in unstable packages could
block the security updates from reaching testing. Ironically, those very
users most interested in the shape of the next stable version are also
those likely to be put off by the lack of security updates.
Those days have come to end. Now there is a security team for
testing, with five to six team members and twice that on the mailing
list. Some team members are Debian Developers (DDs), but that's not
required. The team now proactively looks for holes, checking Debian
testing packages against CVE
entrys, bugs in the Bug Tracking System (BTS), and watching other
security lists.
DDs and package maintainers were asked to document all security issues,
including the CVE number in open bug reports. Change log entries and
closed bugs should include a CVE number and indicate when security issues
are fixed. Tracking and fixing security bugs in etch will make it far more
appealing to potential testers, and may even help Debian achieve a more
predictable release cycle.
Comments (2 posted)
New vulnerabilities
affix: two remote vulnerabilities
| Package(s): | affix |
CVE #(s): | CAN-2005-2250
CAN-2005-2277
|
| Created: | July 19, 2005 |
Updated: | September 2, 2005 |
| Description: |
A buffer overflow in the Bluetooth FTP client (BTFTP) in Nokia Affix 2.1.2
and 3.2.0 allows remote attackers to execute arbitrary code via a long
filename in an OBEX file share. Also remote attackers may execute
arbitrary commands via shell metacharacters in the filename argument of a
PUT command. |
| Alerts: |
|
Comments (none posted)
bugzilla: information disclosure
| Package(s): | bugzilla |
CVE #(s): | CAN-2005-2173
CAN-2005-2174
|
| Created: | July 14, 2005 |
Updated: | July 19, 2005 |
| Description: |
Bugzilla has a vulnerability that may allow a remote attacker to modify
flags of arbitrary bugs, triggering a return email to the attacker
as well as a race condition. |
| Alerts: |
|
Comments (none posted)
ekg: multiple vulnerabilities
| Package(s): | ekg |
CVE #(s): | CAN-2005-1850
CAN-2005-1851
CAN-2005-1916
|
| Created: | July 18, 2005 |
Updated: | August 8, 2005 |
| Description: |
Several vulnerabilities have been discovered in the ekg
contributed scripts. These include an
insecure temporary file creation problem, a
potential shell command injection problem, and an
arbitrary command execution problem. |
| Alerts: |
|
Comments (none posted)
heartbeat: insecure temporary files
| Package(s): | heartbeat |
CVE #(s): | CAN-2005-2231
|
| Created: | July 19, 2005 |
Updated: | August 15, 2005 |
| Description: |
Eric Romang discovered several insecure temporary file creations in
the High Availability Linux Project Heartbeat 1.2.3. |
| Alerts: |
|
Comments (none posted)
kdelibs: kate backup file permission leak
| Package(s): | kdelibs kate kwrite |
CVE #(s): | CAN-2005-1920
|
| Created: | July 19, 2005 |
Updated: | November 27, 2006 |
| Description: |
Kate / Kwrite, as shipped with KDE 3.2.x up to including 3.4.0, creates a file backup before saving a modified file. These backup files are created with default permissions, even if the original file had more strict permissions set. See this advisory for more information. |
| Alerts: |
|
Comments (none posted)
mediawiki: JavaScript code injection
| Package(s): | mediawiki |
CVE #(s): | |
| Created: | July 20, 2005 |
Updated: | July 20, 2005 |
| Description: |
MediaWiki has a vulnerability caused by failing to correctly escape a
parameter in the page move template. Remote attackers can use this
to inject and execute JavaScript code with the permission of the user's
browser session.
|
| Alerts: |
|
Comments (none posted)
mozilla-firefox: multiple vulnerabilities
| Package(s): | mozilla-firefox |
CVE #(s): | |
| Created: | July 14, 2005 |
Updated: | July 22, 2005 |
| Description: |
A dozen security vulnerabilities that have been fixed in Firefox 1.0.5
and Mozilla 1.7.9 have been back-ported to older versions. |
| Alerts: |
|
Comments (none posted)
mysql: low-impact security fix
| Package(s): | mysql |
CVE #(s): | CAN-2005-1636
|
| Created: | July 20, 2005 |
Updated: | February 22, 2006 |
| Description: |
An update to MySQL version 4.1.12 fixes a low-impact security
problem (bz#158689). |
| Alerts: |
|
Comments (1 posted)
pam_ldap: plain text authentication leak
| Package(s): | pam_ldap |
CVE #(s): | CAN-2005-2069
|
| Created: | July 14, 2005 |
Updated: | October 17, 2005 |
| Description: |
pam_ldap
and nss_ldap ignore the "ssl start_tls" ldap.conf setting, allowing an
attacker to sniff unencrypted passwords and other information. |
| Alerts: |
|
Comments (none posted)
phppgadmin: directory traversal vulnerability
| Package(s): | phppgadmin |
CVE #(s): | CAN-2005-2256
|
| Created: | July 18, 2005 |
Updated: | July 19, 2005 |
| Description: |
A missing input sanitization vulnerability has been discovered in
the phppgadmin PHP scripts, sensitive information may be
disclosed. |
| Alerts: |
|
Comments (none posted)
thunderbird mozilla firefox: multiple vulnerabilities
| Package(s): | thunderbird firefox mozilla |
CVE #(s): | CAN-2005-0989
CAN-2005-1159
CAN-2005-1160
CAN-2005-1532
CAN-2005-2261
CAN-2005-2265
CAN-2005-2266
CAN-2005-2269
CAN-2005-2270
|
| Created: | July 20, 2005 |
Updated: | September 1, 2005 |
| Description: |
Multiple vulnerabilities have been found in the Mozilla Thunderbird email
client, as well as the Mozilla Suite and Firefox and Mozilla based other
browsers. Bugs include an anonymous function handling bug, a JavaScript
validation problem, privileged UI code handling DOM nodes, a JavaScript
privilege escalation, a problem with Javascript in XBL controls, improper
handling of child frames, a DOM name code execution vulnerability, and
a base object clone problem.
|
| Alerts: |
|
Comments (none posted)
Updated vulnerabilities
CUPS: multiple vulnerabilities
| Package(s): | CUPS |
CVE #(s): | CAN-2004-2154
|
| Created: | July 14, 2005 |
Updated: | September 20, 2005 |
| Description: |
The CUPS printing system has a problem with queue name
case-sensitivity matching that can cause a security policy override. An
unauthorized user can use this to gain print to a protected queue. |
| Alerts: |
|
Comments (none posted)
cvs: multiple vulnerabilities
| Package(s): | cvs |
CVE #(s): | CAN-2004-1342
CAN-2004-1343
|
| Created: | July 19, 2005 |
Updated: | July 19, 2005 |
| Description: |
The cvs pserver access method in connection with the Debian repouid
can allow an attacker to bypass the password authentication and gain
unauthorized access to the repository.
Also, a problem with the cvs-repouids file can allow
a remote user to crash the cvs server and cause a denial of service. |
| Alerts: |
|
Comments (none posted)
a2ps: input validation error
| Package(s): | a2ps |
CVE #(s): | CAN-2004-1170
CAN-2004-1377
|
| Created: | November 26, 2004 |
Updated: | December 19, 2005 |
| Description: |
The GNU a2ps utility fails to properly sanitize filenames, which can be
abused by a malicious user to execute arbitrary commands with the
privileges of the user running the vulnerable application. More
information at Security
Focus. |
| Alerts: |
|
Comments (none posted)
acroread: arbitrary code execution
| Package(s): | acroread |
CVE #(s): | CAN-2005-1625
CAN-2005-1841
|
| Created: | July 8, 2005 |
Updated: | July 14, 2005 |
| Description: |
Adobe Acrobat Reader (acroread) has a
buffer overflow vulnerability. If a user is tricked into opening
a specially crafted PDF file, arbitrary code can be executed. |
| Alerts: |
|
Comments (none posted)
bzip2: race condition and infinite loop
| Package(s): | bzip2 |
CVE #(s): | CAN-2005-0953
CAN-2005-1260
|
| Created: | May 17, 2005 |
Updated: | January 10, 2007 |
| Description: |
A race condition in bzip2 1.0.2 and earlier allows local users to modify
permissions of arbitrary files via a hard link attack on a file while it is
being decompressed, whose permissions are changed by bzip2 after the
decompression is complete. Also specially crafted bzip2 archives may cause
an infinite loop in the decompressor. |
| Alerts: |
|
Comments (2 posted)
cacti: SQL injection and PHP file inclusion
| Package(s): | cacti |
CVE #(s): | |
| Created: | June 22, 2005 |
Updated: | July 21, 2005 |
| Description: |
Cacti (prior to version 0.8.6e) suffers from vulnerabilities which can lead to SQL injection and (on some systems) execution of arbitrary PHP files. |
| Alerts: |
|
Comments (none posted)
centericq: temporary file vulnerability
| Package(s): | centericq |
CVE #(s): | CAN-2005-1914
|
| Created: | July 13, 2005 |
Updated: | July 13, 2005 |
| Description: |
The centericq messaging client suffers from a classic temporary file vulnerability which could, conceivably, be exploited by a local user to overwrite files. |
| Alerts: |
|
Comments (none posted)
cpio - file permissions error
| Package(s): | cpio |
CVE #(s): | CAN-1999-1572
|
| Created: | February 2, 2005 |
Updated: | July 19, 2005 |
| Description: |
Some versions of cpio contain an ancient vulnerability where files created by that utility have overly generous access permissions. |
| Alerts: |
|
Comments (none posted)
cpio: directory traversal
| Package(s): | cpio |
CVE #(s): | CAN-2005-1111
|
| Created: | June 20, 2005 |
Updated: | December 26, 2005 |
| Description: |
There is a vulnerability in
cpio (2.6 and previous) that allows a malicious cpio file to
extract to an arbitrary directory of the attackers choice. cpio will
extract to the path specified in the cpio file, this path can be absolute. |
| Alerts: |
|
Comments (1 posted)
cURL: buffer overflow
| Package(s): | curl |
CVE #(s): | CAN-2005-0490
|
| Created: | February 28, 2005 |
Updated: | July 19, 2005 |
| Description: |
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and
possibly other versions, allow remote malicious web servers to execute
arbitrary code via base64 encoded replies that exceed the intended buffer
lengths when decoded. |
| Alerts: |
|
Comments (none posted)
cvs: multiple vulnerabilities
| Package(s): | cvs |
CVE #(s): | CAN-2005-0753
|
| Created: | April 18, 2005 |
Updated: | July 13, 2005 |
| Description: |
CVS (in version prior to 1.11.20) has one or more buffer overflow vulnerabilities, memory leaks, and a NULL pointer dereferencing error.
These can be used to launch a remote denial of service or to remotely
execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
cyrus-imapd: buffer overflows
| Package(s): | cyrus-imapd |
CVE #(s): | CAN-2005-0546
|
| Created: | February 23, 2005 |
Updated: | April 9, 2006 |
| Description: |
Cyrus-imapd, prior to version 2.2.12, contains several buffer overflows which could be exploited by an (authenticated) attacker to run code on the server system. |
| Alerts: |
|
Comments (none posted)
dbus: information disclosure
| Package(s): | dbus |
CVE #(s): | CAN-2005-0201
|
| Created: | June 8, 2005 |
Updated: | August 30, 2005 |
| Description: |
From the Red Hat alert: "Dan Reed discovered that a user can send and listen to messages on another
user's per-user session bus if they know the address of the socket." At current usage levels, this vulnerability is not particularly threatening. |
| Alerts: |
|
Comments (none posted)
dhcp: format string vulnerability
| Package(s): | dhcp |
CVE #(s): | CAN-2004-1006
|
| Created: | November 4, 2004 |
Updated: | July 13, 2005 |
| Description: |
Dhcp has a format string vulnerability in the log functions of dhcp 2.x
that may be exploited via a malicious DNS server. |
| Alerts: |
|
Comments (none posted)
dhcpcd: denial of service
| Package(s): | dhcpcd |
CVE #(s): | CAN-2005-1848
|
| Created: | July 13, 2005 |
Updated: | September 13, 2005 |
| Description: |
The dhcpcd DHCP client can be tricked into reading past the end of a buffer, causing it to crash.
|
| Alerts: |
|
Comments (none posted)
Dnsmasq: poisoning and DoS
| Package(s): | dnsmasq |
CVE #(s): | |
| Created: | April 4, 2005 |
Updated: | July 21, 2005 |
| Description: |
Dnsmasq does not properly detect that DNS replies received do not
correspond to any DNS query that was sent. Rob Holland of the Gentoo Linux
Security Audit team also discovered two off-by-one buffer overflows that
could crash DHCP lease files parsing. |
| Alerts: |
|
Comments (none posted)
emacs21: format string vulnerability in "movemail"
| Package(s): | emacs21 |
CVE #(s): | CAN-2005-0100
|
| Created: | February 7, 2005 |
Updated: | May 15, 2006 |
| Description: |
Max Vozeler discovered a format string vulnerability in the "movemail"
utility of Emacs. By sending specially crafted packets, a malicious
POP3 server could cause a buffer overflow, which could be exploited to
execute arbitrary code with the privileges of the user and the "mail"
group. |
| Alerts: |
|
Comments (none posted)
enscript: arbitrary code execution
| Package(s): | enscript |
CVE #(s): | CAN-2004-1184
CAN-2004-1185
CAN-2004-1186
|
| Created: | January 21, 2005 |
Updated: | May 27, 2006 |
| Description: |
Erik Sjölund has discovered several security relevant problems in enscript,
a program to convert ASCII text into Postscript and other formats.
Unsanitized input can cause the execution of arbitrary commands via EPSF
pipe support. Due to missing sanitizing of filenames it is possible that a
specially crafted filename can cause arbitrary commands to be executed.
Multiple buffer overflows can cause the program to crash. |
| Alerts: |
|
Comments (none posted)
ettercap: format string vulnerability
| Package(s): | ettercap |
CVE #(s): | CAN-2005-1796
|
| Created: | June 13, 2005 |
Updated: | July 13, 2005 |
| Description: |
The Ettercap suite of networking tools has a
format string vulnerability that can be exploited by a
remote attacker for the execution of arbitrary code. |
| Alerts: |
|
Comments (none posted)
evolution: message crash vulnerability
| Package(s): | evolution |
CVE #(s): | CAN-2005-0806
|
| Created: | March 17, 2005 |
Updated: | August 11, 2005 |
| Description: |
The Evolution mail client can be crashed when reading
certain types of messages. |
| Alerts: |
|
Comments (none posted)
Foomatic: Arbitrary command execution in foomatic-rip
| Package(s): | foomatic |
CVE #(s): | CAN-2004-0801
|
| Created: | September 20, 2004 |
Updated: | May 31, 2006 |
| Description: |
There is a vulnerability in the foomatic-filters package. This
vulnerability is due to insufficient checking of command-line parameters
and environment variables in the foomatic-rip filter. This vulnerability
may allow both local and remote attackers to execute arbitrary commands on
the print server with the permissions of the spooler. |
| Alerts: |
|
Comments (none posted)
FUSE: information disclosure
| Package(s): | fuse |
CVE #(s): | CAN-2005-1858
|
| Created: | July 13, 2005 |
Updated: | July 13, 2005 |
| Description: |
The filesystems in user space (FUSE) subsystem (not yet part of the mainline kernel) has an information disclosure vulnerability exploitable by local users. |
| Alerts: |
|
Comments (none posted)
gdb: multiple vulnerabilities
| Package(s): | gdb |
CVE #(s): | CAN-2005-1704
CAN-2005-1705
|
| Created: | May 20, 2005 |
Updated: | August 11, 2006 |
| Description: |
Tavis Ormandy of the Gentoo Linux Security Audit Team discovered an integer
overflow in the BFD library, resulting in a heap overflow. A review also
showed that by default, gdb insecurely sources initialization files from
the working directory. Successful exploitation would result in the
execution of arbitrary code on loading a specially crafted object file or
the execution of arbitrary commands. |
| Alerts: |
|
Comments (5 posted)
gtk-pixbuf, gtk2: denial of service
| Package(s): | gdk-pixbuf gtk2 |
CVE #(s): | CAN-2005-0891
|
| Created: | March 30, 2005 |
Updated: | December 19, 2005 |
| Description: |
The BMP image processing code in gdk-pixbuf and gtk2 contains a denial of service vulnerability exploitable via a specially crafted image file.
|
| Alerts: |
|
Comments (none posted)
gettext: Insecure temporary file handling
| Package(s): | gettext |
CVE #(s): | CAN-2004-0966
|
| Created: | October 11, 2004 |
Updated: | March 1, 2006 |
| Description: |
gettext insecurely creates temporary files in world-writeable directories
with predictable names. A local attacker could create symbolic links in
the temporary files directory, pointing to a valid file somewhere on the
filesystem. When gettext is called, this would result in file access with
the rights of the user running the utility, which could be the root user. |
| Alerts: |
|
Comments (1 posted)
gftp: missing input sanitizing
| Package(s): | gftp |
CVE #(s): | CAN-2005-0372
CAN-2004-1376
|
| Created: | February 17, 2005 |
Updated: | July 13, 2005 |
| Description: |
gftp has a directory traversal vulnerability.
A remote server could use specially crafted filenames to overwrite
local files.
|
| Alerts: |
|
Comments (none posted)
ghostscript: symlink vulnerabilities
| Package(s): | ghostscript |
CVE #(s): | CAN-2004-0967
|
| Created: | October 20, 2004 |
Updated: | September 28, 2005 |
| Description: |
The ghostscript package (prior to version 7.07.1-r7) contains several scripts which are vulnerable to symlink attacks. |
| Alerts: |
|
Comments (none posted)
glibc: tempfile vulnerability in catchsegv script
| Package(s): | glibc |
CVE #(s): | CAN-2004-0968
|
| Created: | October 21, 2004 |
Updated: | November 14, 2005 |
| Description: |
The catchsegv script in the glibc package has a symlink vulnerability
that may allow a local user to overwrite arbitrary
files with the permissions of the user that is running the script. |
| Alerts: |
|
Comments (none posted)
gnupg: information leak
| Package(s): | gnupg |
CVE #(s): | CAN-2005-0366
|
| Created: | March 16, 2005 |
Updated: | August 19, 2005 |
| Description: |
GnuPG (and other PGP-like systems) suffers from an information leak which could, in some situations, be used by an attacker to obtain plain text from an encrypted message. See this message for a detailed explanation of the problem. "We know of no real-world application that is affected by this type of attack. It is an attack that requires the active participation of someone who holds the actual key required to decrypt a message. Thus, it is not something you are likely to see." |
| Alerts: |
|
Comments (none posted)
grip: buffer overflow
| Package(s): | grip |
CVE #(s): | CAN-2005-0706
|
| Created: | March 10, 2005 |
Updated: | September 16, 2005 |
| Description: |
Grip, a CD ripper, has a buffer overflow vulnerability that can
occur when the CDDB server returns more than 16 matches. |
| Alerts: |
|
Comments (none posted)
groff: insecure temporary directory
| Package(s): | groff |
CVE #(s): | CAN-2004-0969
|
| Created: | November 1, 2004 |
Updated: | February 9, 2006 |
| Description: |
Recently, Trustix Secure Linux discovered a vulnerability in the groff
package. The utility "groffer" created a temporary directory in an
insecure way, which allowed exploitation of a race condition to create
or overwrite files with the privileges of the user invoking the
program. |
| Alerts: |
|
Comments (none posted)
gxine: format string vulnerability
| Package(s): | gxine |
CVE #(s): | CAN-2005-1692
|
| Created: | May 26, 2005 |
Updated: | July 23, 2005 |
| Description: |
The gxine media player has a format string vulnerability in the
hostname decoding function. A specially crafted file can be used
to cause a user to execute arbitrary code. |
| Alerts: |
|
Comments (none posted)
gzip: race condition and directory traversal
| Package(s): | gzip |
CVE #(s): | CAN-2005-0988
CAN-2005-1228
|
| Created: | May 4, 2005 |
Updated: | July 13, 2005 |
| Description: |
gzip suffers from a race condition which could allow a fast-fingered attacker to change the permissions on files owned by others. There is also a directory traversal vulnerability associated with the -N option.
|
| Alerts: |
|
Comments (none posted)
Heimdal: buffer overflow vulnerabilities
| Package(s): | heimdal |
CVE #(s): | CAN-2005-2040
|
| Created: | June 29, 2005 |
Updated: | July 18, 2005 |
| Description: |
It has been reported that the "getterminaltype" function of Heimdal's
(before 0.6.5) telnetd server is vulnerable to buffer overflows. An
attacker could exploit this vulnerability to execute arbitrary code with
the permission of the telnetd server program. |
| Alerts: |
|
Comments (none posted)
ht: arbitrary code execution
| Package(s): | ht |
CVE #(s): | CAN-2005-1545
CAN-2005-1546
|
| Created: | July 8, 2005 |
Updated: | July 13, 2005 |
| Description: |
The utility ht, an executable file viewer, editor and
analyzer, has buffer and integer overflows that can be
exploited for the purpose of executing arbitrary code. |
| Alerts: |
|
Comments (none posted)
htdig: cross site scripting
| Package(s): | htdig |
CVE #(s): | CAN-2005-0085
|
| Created: | February 14, 2005 |
Updated: | January 10, 2006 |
| Description: |
Michael Krax discovered that ht://Dig fails to validate the 'config'
parameter before displaying an error message containing the parameter.
This flaw could allow an attacker to conduct cross-site scripting
attacks. |
| Alerts: |
|
Comments (none posted)
ImageMagick: xwd coder denial of service
| Package(s): | ImageMagick |
CVE #(s): | CAN-2005-1739
|
| Created: | May 26, 2005 |
Updated: | July 19, 2005 |
| Description: |
The xwd coder in ImageMagick has a vulnerability that
can be accessed by working on a maliciously created image.
A denial of service can result. |
| Alerts: |
|
Comments (none posted)
imap: buffer overflow in c-client
| Package(s): | imap |
CVE #(s): | CAN-2003-0297
|
| Created: | February 18, 2005 |
Updated: | April 9, 2006 |
| Description: |
A buffer overflow flaw was found in the c-client IMAP client. An attacker
could create a malicious IMAP server that if connected to by a victim could
execute arbitrary code on the client machine. |
| Alerts: |
|
Comments (none posted)
imlib2: buffer overflows
| Package(s): | imlib2 |
CVE #(s): | CAN-2004-0802
CAN-2004-0817
|
| Created: | September 8, 2004 |
Updated: | October 26, 2005 |
| Description: |
The imlib2 library contains buffer overflows in the BMP handling code. |
| Alerts: |
|
Comments (none posted)
infozip: privilege escalation, directory-traversal
| Package(s): | infozip |
CVE #(s): | CAN-2003-0282
CAN-2004-1010
CAN-2005-0602
|
| Created: | May 2, 2005 |
Updated: | August 1, 2005 |
| Description: |
InfoZip reports that Zip 2.3 and
(presumably) all previous versions have a buffer-overrun vulnerability
relating to deep directory paths that could potentially lead to local
privilege escalation (e.g., in the case of automated, Zip-based backups).
All versions of UnZip through 5.50 have a number of directory-traversal
vulnerabilities. |
| Alerts: |
|
Comments (1 posted)
junkbuster: heap corruption and settings modification
| Package(s): | junkbuster |
CVE #(s): | CVE-2005-1108
CVE-2005-1109
|
| Created: | April 13, 2005 |
Updated: | November 5, 2005 |
| Description: |
JunkBuster through version 2.02-r2 contains two vulnerabilities: a heap corruption bug and a possible privacy violation. |
| Alerts: |
|
Comments (1 posted)
kdelibs: unsanitzied input
| Package(s): | kdelibs |
CVE #(s): | CAN-2004-1165
|
| Created: | January 10, 2005 |
Updated: | July 19, 2005 |
| Description: |
Thiago Macieira discovered a vulnerability in the kioslave library,
which is part of kdelibs, which allows a remote attacker to execute
arbitrary FTP commands via an ftp:// URL that contains an URL-encoded
newline before the FTP command. |
| Alerts: |
|
