LWN.net Weekly Edition for February 1, 2007

The Fiduciary License Agreement

On Thursday, February 1, the Free Software Foundation Europe (FSFE) is releasing a new license and with it an offer to help FOSS projects deal with copyright issues. The license is called the Fiduciary License Agreement (FLA), and it's a new type of copyright assignment agreement, designed to be effective internationally, whereby a project with many authors can designate FSFE or a single organization or individual as the copyright holder, while maintaining complete autonomy as far as project management otherwise.

Projects may apply to be accepted by FSFE's Fiduciary Project, whereby copyrights and the responsibility to protect and enforce them are turned over to FSFE. Bacula.org and OpenSwarm are examples of projects already accepted into the program. You can see that version of the FLA here.

Alternatively, projects can use the newly released license, choosing another entity - such as a foundation it sets up itself - or designating one individual to hold the copyrights. FSFE's Freedom Task Force is willing to help projects with that too as far as sharing insights and their experience.

What need does the FLA license fill? I see several. First, it's international, not US-centric.

Second, maybe you don't have a lawyer on call. Maybe you are among those who just don't want to think about legal things and or realize you are not equipped financially or legally to handle that task yourself. Then you may wish to apply for the FSFE's Fiduciary Project. You retain rights to the management of the project. But they have the headache of license compliance enforcement.

Third, it's of interest to projects that have more than one author and are concerned about the future (what happens if one of the authors dies, leaves the project, etc.?) but for any number of reasons the authors don't want to assign copyright to the Free Software Foundation or don't want to be a GNU project under that umbrella. In countries where such terms are allowed, it's designed to "be temporally unlimited" so once the agreement is signed, future contributions, such as patches, are covered.

An important purpose of the license is to ensure project survival. Shane Coughan, coordinator of the Freedom Task Force confirms that one goal is to make sure people think about and plan for the possibility that a project might have to withstand a legal attack, but as to which of the two ways to use the license a project should choose, he says that FSFE is neutral:

Do you have to choose the GPL or LGPL to make use of the license? Coughan:

There is a list of Free Software licenses here.

Some issues you may wish to consider: The FLA is a one-time copyright assignment (or in countries where that isn't possible, like in Germany, Austria, Slovenia and Hungary, an exclusive license grant) worldwide. The grant reads that the beneficiary assigns the following rights:

a) the right to reproduce in original or modified form;

b) the right to redistribute in original or modified form;

c) the right of making available on data networks, in particular via the Internet, as well as by providing downloads, in original or modified form;

d) the right to authorize third parties to make derivative works or to work on and commit changes or perform this conduct themselves.

There are countries where you can't assign copyright in a future work, France, for example. In such a country, I'm told a project would need to work out a strategy to deal with that restriction. As just one example, authors might assign each patch as it is contributed.

The authors' "moral or personal rights remain unaffected" by the agreement. Also, "modifications that are not derived from the subject matter and that have to be regarded as independent and original software" are excluded from the agreement. In some countries, an employer is deemed to be the owner of the rights on materials developed by an employee in the course of his or her employment, unless the parties have agreed otherwise, so there is language that authors acknowledge that he or she is aware of that and "warrants, represents and guarantees" that the materials are "free of any of his or her employer's exclusive exploitation rights."

What FSFE, or the designated entity, gets is the authority to "enjoin third parties form using the software and forbid any unlawful or copyright infringing use of the Software, and shall be entitled to enforce all its rights in its own name in and out of court." The authors keep a "non-exclusive, worldwide, perpetual and unrestricted license in the Software," which includes all the rights, listed above, and FSFE or the entity grants the authors "additional nonexclusive, transferable license to use, reproduce, redistribute and make available" the software "as needed for releases of the Software under other licenses."

Some may not feel comfortable with any copyright assignment, but with projects with many authors, it's a matter of deciding which kinds of problems you'd rather deal with. The Linux kernel specifies "GPLv2 only" to keep control over licensing decisions. The same kinds of concerns that might come to mind with regard to a license will likely also be considered when it comes to a copyright assignment to another entity. On the other hand, that same restriction is what left the kernel in a position where it would be a great deal more difficult to upgrade the license even if desired. The license itself says this:

Some questions come to mind. What principles, precisely? How would you know when they are violated if they are not listed? We certainly have some guidance. The Free Software Foundation Europe is committed to following publicly defined principles. The Free Software Foundation Europe (FSFE) is a non-profit and (in some countries) a charitable non-governmental organization dedicated to Free Software as in freedom, so that restricts what it can and can't do. Their principles are listed here and in a longer version here.

I would assume, then, that a violation of the principles of Free Software would be any action undertaken with the intent to violate one of the famous four software freedoms. But if one has concerns about assigning copyright, then it's something to factor in to the decision. Legally, FSFE could do things it almost certainly never would, such as relicense. If you have control issues, the best thing would be to seek legal advice. That's always good advice anyway. And some may choose to set up their own foundation, to establish certain ground rules of their own, for that very reason. The choice is yours.

Finally, if you choose to assign copyrights to FSFE, German law applies to the agreement as the default, unless otherwise negotiated, and any conflicts would have to be settled in Munich.

The license is being released under the GNU Free Documentation License (GFDL) and the Creative Commons Attribution/Share-alike (CC by-sa) licenses. The FLA was written by Dr. Axel Metzger (ifrOSS) and FSFE in consultation with other international legal and technical experts, and the final version was then compiled by Georg Greve, president of the Free Software Foundation Europe (FSFE) and Shane M Coughlan based on feedback provided by Dr. Lucie Guibault of the Institute for Information Law in the Netherlands. The final text of the license is expected to be released on February 1.

Comments (1 posted)

Embedded Linux: Using Compressed File Systems

This series is all about making small systems, from the kernel on up. In the first part I covered the TinyLinux project and its eventual integration into the kernel to help reduce kernel sizes for small systems. In the second part, I looked at the use of the Initramfs and its role in providing a root file system (directly or indirectly) for an embedded system.

Now it's time to look at getting applications and utilities into the system, still keeping an eye on size. The most direct approach is to use as few utilities as possible, even replacing /sbin/init with a single application. This is possible in very small systems but, generally speaking, if you only have a single application to run you probably didn't need the complexity of a multitasking system like Linux to run it anyway. There are other, smaller operating systems that might be better suited in that case.

There are a number of ways to keep application layer tools small. If you have multiple applications and/or require the facilities in Linux, then you can (and should, for production systems) consider stripping your binaries of all symbols. The symbols are useful for debugging purposes but won't be of much value to your users. Additionally, using compile-time features to reduce size is another option, and will be the focus of the final article in this series. For now, we'll consider yet another option: using a compressed file system.

Compressed File Systems

File systems provide the structure for managing files on storage media, such as disks or tapes. While a device driver knows how to get data to and from those devices, file system provide the logical structure of that data. There are a huge number of file systems types, ranging from the standard ext3 you'll find on many Linux systems to parallel and clustered file systems, to steganographic file systems that can both encrypt and hide data on the media. (Note that Wikipedia has a nice long list of file systems).

A compressed file system is one that uncompresses data as it is retrieved and may or may not compresses data as it goes into the storage media. Working with compressed files is an obvious benefit for saving space on small systems. The decision to use a compressed file system is usually based on the storage media you'll use in your system. A ram-disk based system, for example, might copy data from flash into the ramdisk. Since RAM is essential for system operation the size of the ram disk would probably be best kept small. Compact flash or hard disk based systems, on the other hand, offer more storage but may still be too small to fit all the required files without some sort of compression.

While compressed file systems offer you more space for files, they also may affect performance. There may be unacceptable overhead in managing the decompression of large files at run time. And compressing files on the fly is computationally expensive; random writes of compressed data is difficult to achieve. Therefore it is far more common for compressed file systems to be read-only.

Compressing data is a common practice for live CD distributions, which use compression to squeeze a more complete distribution onto the limited size of a CD or DVD. But many of the live CD distributions don't actually use a compressed file system, instead using an conventional file system image made up of compressed blocks which are uncompressed when read using the "cloop", or compressed loopback, device. But this isn't a compressed file system. It's a block level device handling compressed data.

The Knoppix distribution popularized the use of cloop when its author, Klaus Knopper, picked up support of the driver. Many other live CDs followed suit. One advantage of using this kind of compressed image is that, since the blocks are compressed independently, it is possible to seek to specific blocks without uncompressing all the blocks. The disadvantage of such a device is that the entire image must fit into memory in order to be uncompressed.

An example of a real compressed file system is CramFS, a file system popular with embedded users of the 2.4 kernel for use with the initrd image. This file system actually has compressed files with uncompressed metadata. The files are placed in the file system from a standard directory using the mkcramfs program, which compresses the files one page at a time. This is done, for example, when creating an initrd image.

Another example of a compressed file system is e2compr. This is actually a set of patches to make the well known EXT2 file system handle on-the-fly compression and decompression. It supports both 2.4 and 2.6 kernels, but has not been submitted for inclusion in either because of the complexity of the patches. As with CramFS, metadata in e2compr is not compressed.

SquashFS

A more recent (and more actively supported, the last updates coming in mid January 2007) compressed file system is SquashFS. SquashFS is a kind of successor to CramFS because it aims at the same target audience while providing a similar process for creation and use of the file system. What makes SquashFS an improvement over CramFS is best stated by Phillip Lougher in a linux-kernel mailing list post: "SquashFS basically gives better compression, bigger files/file system support, and more inode information."

Both SquashFS and CramFS use zlib compression. However, CramFS uses a fixed size 4KB block while SquashFS supports from 0.5KB to 64KB. This variable block size allows for much larger file systems under SquashFS, something desirable for complex embedded systems like digital video recorders. Also SquashFS supports compression of both the metadata and block fragments while CramFS does not. And, while CramFS is integrated with the kernel source, SquashFS is not. It comes as a set of kernel patches and the driver module. The CELinux Forum provides some comparisons of SquashFS against other file systems (compressed and uncompressed).

JFFS2

Another compressed file system is JFFS2, the Journaling Flash file system, version 2. It was designed specifically for use with both NOR and NAND flash devices, and recently received an update via David Woodhouse for the NAND flash memory being used in the OLPC project. JFFS2 is actually a bit more sophisticated than SquashFS because it provides mechanisms for plugging in different compression algorithms, including not using any compression at all. But unlike SquashFS, JFFS2 is integrated into the kernel.

So if you're building an embedded system with flash storage, wouldn't you be better with JFFS2? Not necessarily.

According to the OpenWRT project, which uses both SquashFS and JFFS2, SquashFS provides better performance than JFFS2. Additionally, at least in the case of the few files that need to be updated for a production version of the project, there is little advantage to using a read/write JFFS2 compressed root file system with respect to the performance hit it incurs vs a read-only SquashFS root file system used with a writable JFFS2 file system for stored files.

JFFS2 is a read/write file system while SquashFS is a read-only file system. A runtime system very often needs to write to its root file system. Imagine making updates to /etc/hosts, for example, as you might with a embedded video recorder client trying to access a server backend on a local network. If writing to the file system is required for an embedded system, how could you use SquashFS at all?

Some projects, like OpenWRT, use a hybrid system that uses a read-only root file system mixed with a read/write file system for saving files. In such a hybrid you might use special configurations or modified applications to access read/write file systems, but that doesn't help if you need write access to /etc/hosts on a read-only file system. What you need is a method of having parts of the directory structure writable while other parts are read-only. What you need is a stackable file system like UnionFS.

Using UnionFS: BusyBox and SquashFS together

UnionFS is a mechanism for mounting two directories from different file systems under the same name. For example, I could have a read-only SquashFS file system and a read/write JFFS2 file system mounted together under the root directory so that the JFFS2 would be /tmp and /etc while the SquashFS might be everything else.

So how might you use this with a compressed file system and our BusyBox based utilities we created in the last article? First, we build our kernel with SquashFS patches and then build the UnionFS driver as a loadable module. Next, we build BusyBox with all the runtime utilities we need and install the result to a local directory on the build machine, let's call it "/tmp/busybox". Next, we package those files into a compressed SquashFS file system:

    mksquashfs /tmp/busybox /tmp/busybox.sqfs -info 

This command takes the contents of /tmp/busybox and compresses it into a file system image in /tmp called busybox.sqfs. The -info option increases verbosity, printing the filenames, original size and compression ratio as they are processed.

We then create an initramfs with another build of BusyBox that has only minimal utilities - enough to do mounting of the loopback device and loading kernel modules, plus the UnionFS module we built previously (which we manually copy into the directory after we rebuild BusyBox). We might add support for other devices like a CDROM if we store the SquashFS file there or JFFS2 and support for flash memory if we store the SquashFS file there.

At runtime, I need a writable file system to go with my read-only SquashFS file system. I'll use the tmpfs file system which puts all the files I'll write at runtime in virtual memory. In my init script for my initramfs, I add:

    mkdir /.tmpfs
    mount -w -t tmpfs -o size=90% tmpfs /.tmpfs
    mkdir /.tmpfs/.overlay

The overlay directory will be used to store data written by my embedded system.

When you boot your 2.6 kernel, you'll have a BusyBox based initramfs with an init script and your SquashFS file system (or a way to get to that file system via commands in your init script). I'm mounting the busybox.sqfs file from the root directory of a CD over the loopback device onto a directory in my initramfs, so I add the following to the init script:

	mkdir /.tmpfs/.cdrom
	mount -r -t iso9660 /dev/cdrom /.tmpfs/.cdrom
	losetup /dev/loop0 /.tmpfs/.cdrom/root.sqfs

Then I can mount the loopback device as a SquashFS file system to another directory I've created in my tmpfs:

	mkdir /.tmpfs/.sqfs
	mount -r -t squashfs /dev/loop0 /.tmpfs/.sqfs

UnionFS mounts multiple directories, in either read-only or read-write mode, onto a single directory. In the init script, I place three directories side by side under a single UnionFS directory:

	mount -w -t unionfs -o \
		dirs=/.tmpfs/.overlay=rw:/.tmpfs/.cdrom=ro:/.tmpfs/.sqfs=ro \
		unionfs /.union

What this does is place all three directory structures, which are referred to as branches under UnionFS, under /.union; any conflicting directory names are resolved by taking the first one found, searching the branches left to right. So if there is an /.tmpfs/.overlay/etc/hosts (a file we've created at runtime, for example), it takes precedence over /.tmpfs/.sqfs/etc/hosts.

With this command, when you write to /.union (which later becomes the root directory due to a switch_root in the init script), the writes go to the read/write directory which is on the tmpfs file system. But this writable space is in memory and won't survive reboots. If you need to save data between boots, you could mount a compact flash drive under /.tmpfs/cf and use that instead of /.tmpfs/.overlay in the previous mount command.

Which directory gets the write if there are two read-write branches? UnionFS uses "copy-up", which causes any attempt to write to a read-only branch to be written to the next read-write branch on its left. Imagine creating a SquashFS for /etc, one for /var and one for everything else in your root partition. Then if you had 2 compact flashes you could use one for writes to /etc and one for writes to /var simply by ordering these correctly when you mounted them under the UnionFS file system.

UnionFS is considered by some to be too buggy for production use, though I've never had much trouble with it when building live CDs. If you experience problems using UnionFS, you might consider AuFS as an alternative. AuFS started out as a rewrite of UnionFS but has since evolved into its own file system. SLAX, a Slackware based live CD that originally used UnionFS, has migrated to AuFS. In fact, a bug bounty was offered by SLAX for a bug and the winner of that bounty, Junjiro Okajima, is the author of AuFS.

Next in the series: uClibc

This long running series (it's taken me awhile to write each of the three articles so far) has one piece left: using uClibc to reduce program size. This is a reduced size version of the standard glibc library, specifically built for small footprint systems.

Comments (18 posted)

An LWN reader survey

The first announced LWN Weekly Edition was published on January 29, 1998 - though we had quietly put out a test issue the week before. So, it seems, we just had our ninth birthday. We could never have imagined we would still be at it after this many years - but we have no intention of stopping now. Thanks to all of you for keeping us going for so long.

Every now and then, an LWN reader notes that there have been no "state of LWN" postings in recent times. There is a reason for that: LWN is supposed to be about the Linux and free software community. LWN talking about itself just seems less interesting, somehow.

There is another reason, however: things simply have not changed that much. The number of subscribers grows very slowly; subscription counts still have not reached a level where LWN can truly be said to be paying for itself. We would like to change that, and make LWN better in the process. To that end, we would like to get a better handle on what our subscribers think of LWN now.

For our subscribers: if you could please take a few minutes and give us your input on the ups and downs of LWN, we would more than appreciate it. The survey will remain open until February 8. For those coming after that date, you can see what answers we got by going directly to the results page. Thank you for helping us to make LWN better.

Comments (4 posted)

Page editor: Jonathan Corbet

Security

Who owns your domain?

Using a domain registrar to reserve a domain seems a relatively straightforward transaction; one pays the registrar to ensure that the domain resolves to the addresses specified. The content at the domain would seem to be the responsibility of the registrant, leaving the registrar unconcerned with anything other than the technical DNS issues and making deposits. Unfortunately, that is not always the case as Fyodor (of Nmap fame) found out recently when GoDaddy effectively shut down his seclists.org site. With essentially no warning, GoDaddy stopped anyone from viewing the content of seclists (an excellent, comprehensive archive of security mailing lists) due to a complaint from MySpace.

Evidently concerned about MySpace username/password lists that were floating around the Internet and being posted to mailing lists, such as full-disclosure, MySpace went directly to the registrar of a site that archives the list. They made no attempt to contact Fyodor, whose email is prominently listed on the seclists contact page, to request that he remove the offending posts. When contacted, GoDaddy evidently deliberated for a minute or two before rerouting DNS requests for seclists.org to NS1.SUSPENDED-FOR.SPAM-AND-ABUSE.COM.

One would like to think that a registrar might require a complaining party to take some steps to try and have the offending content removed. One would also hope that a registrar might check with their customer about the complaint before taking any action. Unfortunately, if one uses GoDaddy, neither of those is likely to be the case. GoDaddy was willing to completely block access to content, the vast majority of which is outside the scope of the complaint, based on a single request from a large company. It is also unclear what steps GoDaddy took to confirm the validity of the complaint before shutting down the site. One would hope that randomly calling GoDaddy and claiming to be from MySpace (or another large organization) would not be a route to shutting down sites.

In Fyodor's account of the incident, he had to make numerous attempts to contact someone at GoDaddy to even find out why the site had been blocked. GoDaddy did not even see fit to tell their paying customer why they blocked the site and provided no easy route for reinstatement. This kind of behavior is not likely to lead to customer satisfaction; unsurprisingly, Fyodor is currently looking for a new registrar. He has also started the NoDaddy site to document abuses by GoDaddy and to help find alternative providers that will not cave in to the slightest pressure.

After numerous phone calls and emails, Fyodor was finally able to get the site back up. He was quite willing to remove the content that so offended MySpace as he has in the past for content, mostly from the full-disclosure list, that has generated legitimate complaints. It should be noted, however, that removing the content from seclists.org did almost nothing to fix the problem; much like trying to put toothpaste back in the tube, reversing an information leak onto the Internet is well nigh impossible. Worse yet, the way they went about things caused enough of a stink that now even casual observers know how to track down this password list; the malicious folks, of course, already had it.

This story might have been less damaging to GoDaddy (and MySpace for that matter) had they admitted a mistake was made and that in the future they would make some efforts to work with their customer to resolve complaints. Instead, they did the opposite and went on the offensive claiming that giving any notice was "generous" while essentially admitting that the notice was on the order of one minute. They were also quick to play the "its for the children" card in defending their actions. Somehow the fact that the lists had been available for nine days and that MySpace did nothing at their end (such as suspending the accounts if there was a password match from the list) to alleviate the problem, went completely over the heads of the folks at GoDaddy.

It seems implausible that MySpace would put up with the same treatment. If one were to find a page at MySpace with a list of usernames and passwords for that site or some other site frequented by teenagers, does that mean you can have MySpace routed to spam-and-abuse.com with a simple phone call to their registrar? The whole idea of registrars participating in web censorship is a slippery slope and one that sensible registrars will avoid; do they want to be in the middle of these kinds of disputes? It probably seemed very easy to GoDaddy in this case, MySpace vs. a 'hacker', but where are they going to draw the line?

For domain owners, this situation should provide an opportunity to go back and review the Terms of Service at your registrar. A community effort, like the one at NoDaddy, can hopefully identify a number of registrars who are more interested in providing the service they are paid for to the people who pay them than they are in appeasing the MySpaces of the world.

Comments (20 posted)

New vulnerabilities

bind: denial of service

Package(s):	bind	CVE #(s):	CVE-2007-0493 CVE-2007-0494
Created:	January 26, 2007	Updated:	March 14, 2007
Description:	The bind package is vulnerable to two remote denial of service attacks in which attackers can cause the bind daemon to to crash or exit unexpectedly by providing malformed data to the daemon in a DNS request.
Alerts:	Red Hat RHSA-2007:0057-02 2007-03-14 Gentoo 200702-06 2007-02-17 Red Hat RHSA-2007:0044-01 2007-02-06 Ubuntu USN-418-1 2007-02-05 Trustix TSLSA-2007-0005 2007-02-05 Mandriva MDKSA-2007:030 2006-01-30 SuSE SUSE-SA:2007:014 2007-01-30 Fedora FEDORA-2007-147 2007-01-29 Debian DSA-1254-1 2007-01-27 OpenPKG OpenPKG-SA-2007.007 2007-01-29 Slackware SSA:2007-026-01 2007-01-29 rPath rPSA-2007-0021-1 2007-01-25

Comments (none posted)

cvstrac: denial of service

Package(s):	cvstrac	CVE #(s):	CVE-2007-0347
Created:	January 29, 2007	Updated:	January 31, 2007
Description:	Ralf S. Engelschall from OpenPKG GmbH discovered a denial of service (DoS) vulnerability in the CVS/Subversion/Git Version Control System (VCS) frontend CVSTrac, version 2.0.0.
Alerts:	OpenPKG OpenPKG-SA-2007.008 2007-01-29

Comments (none posted)

rmake: privilege escalation

Package(s):	rmake	CVE #(s):	CVE-2007-0536 CVE-2007-0557
Created:	January 26, 2007	Updated:	January 31, 2007
Description:	Rmake prior to version 1.0.3-2-0.1 does not drop supplemental users in the changeroot environment for builds. This provides malicious packages with excess permissions that are configuration-dependent, and may allow local users to run arbitrary code as the root user.
Alerts:	rPath rPSA-2007-0020-2 2007-01-25 rPath rPSA-2007-0020-1 2007-01-25

Comments (none posted)

ulogd: buffer overflow

Package(s):	ulogd	CVE #(s):	CVE-2007-0460
Created:	January 29, 2007	Updated:	March 19, 2007
Description:	A buffer overflow in ulogd has an unknown impact and attack vectors related to "improper string length calculations."
Alerts:	Gentoo 200703-17 2007-03-18 Mandriva MDKSA-2007:028 2007-01-26

Comments (none posted)

Updated vulnerabilities

apache: cross-site scripting

Package(s):	apache	CVE #(s):	CVE-2006-3918
Created:	August 9, 2006	Updated:	April 4, 2008
Description:	From the Red Hat advisory: "A bug was found in Apache where an invalid Expect header sent to the server was returned to the user in an unescaped error message. This could allow an attacker to perform a cross-site scripting attack if a victim was tricked into connecting to a site and sending a carefully crafted Expect header."
Alerts:	SuSE SUSE-SA:2008:021 2008-04-04 Ubuntu USN-575-1 2008-02-04 SuSE SUSE-SA:2006:051 2006-09-08 Debian DSA-1167-1 2005-09-04 Red Hat RHSA-2006:0619-01 2006-08-10 Red Hat RHSA-2006:0618-01 2006-08-08

Comments (none posted)

bind: denial of service

Package(s):	bind	CVE #(s):	CVE-2006-4095 CVE-2006-4096
Created:	September 7, 2006	Updated:	February 1, 2007
Description:	Bind has two denial of service vulnerabilities. Recursive servers queries for SIG records will trigger an assertion failure if more than one RR set is returned. An INSIST failure can be triggered by sending a large number of recursive queries.
Alerts:	Fedora FEDORA-2007-164 2007-01-31 Gentoo 200609-11 2006-09-15 Slackware SSA:2006-257-01 2006-09-15 Fedora FEDORA-2006-966 2006-09-11 Debian DSA-1172-1 2006-09-09 Mandriva MDKSA-2006:163 2006-09-08 rPath rPSA-2006-0166-1 2006-09-08 Ubuntu USN-343-1 2006-09-07 OpenPKG OpenPKG-SA-2006.019 2006-09-07

Comments (none posted)

bluez-utils: hidd vulnerability

Package(s):	bluez-utils	CVE #(s):	CVE-2006-6899
Created:	January 16, 2007	Updated:	May 14, 2007
Description:	hidd in BlueZ (bluez-utils) before 2.25 allows remote attackers to obtain control of the Mouse and Keyboard Human Interface Device (HID) via a certain configuration of two HID (PSM) endpoints, operating as a server, aka HidAttack.
Alerts:	Red Hat RHSA-2007:0065-01 2007-05-14 Ubuntu USN-413-1 2007-01-24 Mandriva MDKSA-2007:014 2006-01-15

Comments (none posted)

bugzilla: multiple vulnerabilities

Package(s):	bugzilla	CVE #(s):	CVE-2006-5453 CVE-2006-5454 CVE-2006-5455
Created:	November 10, 2006	Updated:	August 28, 2007
Description:	Bugzilla has the following vulnerabilities: Input data passed to various fields is not properly sanitized before being passed back to users. Users can gain unauthorized access to read attachment descriptions while using diff mode. HTTP GET and HTTP POST requests can be used to perform unauthorized actions due to improper verification. Input that is passed to showdependencygraph.cgi is not properly sanitized before being returned to users.
Alerts:	Debian DSA-1208-1 2006-11-11 Gentoo 200611-04 2006-11-09

Comments (none posted)

busybox: insecure password generation

Package(s):	busybox	CVE #(s):	CVE-2006-1058
Created:	May 5, 2006	Updated:	May 2, 2007
Description:	The BusyBox 1.1.1 passwd command does not use a proper salt when generating passwords. This would create an instance where a brute force attack could take very little time.
Alerts:	Red Hat RHSA-2007:0244-02 2007-05-01 Fedora FEDORA-2006-511 2006-05-04 Fedora FEDORA-2006-510 2006-05-04

Comments (2 posted)

cacti: multiple vulnerabilities

Package(s):	cacti	CVE #(s):	CVE-2006-6799
Created:	January 1, 2007	Updated:	January 26, 2007
Description:	The network monitoring and graphing frontend Cacti has three vulnerabilities. The cmd.php script allows command line usage and is also installed in a web-accessible location. The cmd.php input is insufficiently sanitized, a passed-in URL can be used to inject arbitrary SQL code. The cmd.php script can be used by a remote attacker to execute arbitrary shell commands via improperly sanitized results from SQL queries.
Alerts:	Gentoo 200701-23 2007-01-26 Debian DSA-1250-1 2007-01-17 Mandriva MDKSA-2007:015 2007-01-15 SuSE SUSE-SA:2007:007 2007-01-12 OpenPKG OpenPKG-SA-2007.001 2007-01-01

Comments (none posted)

centericq: buffer overflow

Package(s):	centericq	CVE #(s):	CVE-2007-0160
Created:	January 24, 2007	Updated:	January 24, 2007
Description:	The code in centericq which interfaces with the LiveJournal service suffers from a buffer overflow. This vulnerability is exploitable if a user can be convinced to connect to an unofficial LiveJournal server.
Alerts:	Gentoo 200701-20 2007-01-24

Comments (none posted)

cpio: arbitrary code execution

Package(s):	cpio	CVE #(s):	CVE-2005-4268
Created:	January 2, 2006	Updated:	May 8, 2007
Description:	Richard Harms discovered that cpio did not sufficiently validate file properties when creating archives. Files with e. g. a very large size caused a buffer overflow. By tricking a user or an automatic backup system into putting a specially crafted file into a cpio archive, a local attacker could probably exploit this to execute arbitrary code with the privileges of the target user (which is likely root in an automatic backup system).
Alerts:	rPath rPSA-2007-0094-1 2007-05-07 Red Hat RHSA-2007:0245-02 2007-05-01 Ubuntu USN-234-1 2006-01-02

Comments (none posted)

Cyrus-SASL: DIGEST-MD5 Pre-Authentication Denial of Service

Package(s):	cyrus-sasl	CVE #(s):	CVE-2006-1721
Created:	April 21, 2006	Updated:	September 4, 2007
Description:	Cyrus-SASL contains an unspecified vulnerability in the DIGEST-MD5 process that could lead to a Denial of Service. An attacker could possibly exploit this vulnerability by sending specially crafted data stream to the Cyrus-SASL server, resulting in a Denial of Service even if the attacker is not able to authenticate.
Alerts:	Red Hat RHSA-2007:0878-01 2007-09-04 Red Hat RHSA-2007:0795-01 2007-09-04 SuSE SUSE-SA:2006:025 2006-05-05 Fedora FEDORA-2006-515 2006-05-04 Debian DSA-1042-1 2006-04-25 Mandriva MDKSA-2006:073 2006-04-24 Ubuntu USN-272-1 2006-04-24 Gentoo 200604-09 2006-04-21

Comments (none posted)

dbus: denial of service

Package(s):	dbus	CVE #(s):	CVE-2006-6107
Created:	December 15, 2006	Updated:	February 12, 2007
Description:	Unspecified vulnerability in the match_rule_equal function in bus/signals.c in D-Bus before 1.0.2 allows local applications to remove match rules for other applications and cause a denial of service (lost process messages).
Alerts:	rPath rPSA-2006-0233-1 2007-02-09 Red Hat RHSA-2007:0008-01 2007-02-08 Ubuntu USN-401-1 2007-01-04 OpenPKG OpenPKG-SA-2006.041 2006-12-21 Fedora FEDORA-2006-1475 2006-12-19 Mandriva MDKSA-2006:233 2006-12-18 Fedora FEDORA-2006-1464 2006-12-14

Comments (none posted)

dovecot: index cache file handling error

Package(s):	dovecot	CVE #(s):	CVE-2006-5973
Created:	November 29, 2006	Updated:	May 8, 2007
Description:	The dovecot IMAP server has an error in its index cache file handling code which could be exploited by an authenticated user to execute arbitrary code. Only servers with the (non-default) mmap_disable=yes option setting are vulnerable.
Alerts:	Fedora FEDORA-2006-1504 2006-12-27 Fedora FEDORA-2006-1396 2006-12-18 rPath rPSA-2006-0220-1 2006-11-30 Ubuntu USN-387-1 2006-11-28

Comments (none posted)

ed: symlink attack

Package(s):	ed	CVE #(s):	CVE-2006-6939
Created:	January 19, 2007	Updated:	January 24, 2007
Description:	GNU ed before 0.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files, possibly in the open_sbuf function.
Alerts:	rPath rPSA-2007-0012-1 2007-01-23 Fedora FEDORA-2007-100 2007-01-18 Fedora FEDORA-2007-099 2007-01-18

Comments (none posted)

elinks: arbitrary file access

Package(s):	elinks	CVE #(s):	CVE-2006-5925
Created:	November 16, 2006	Updated:	February 1, 2007
Description:	The elinks text-mode browser has an arbitrary file access vulnerability in the Elinks SMB protocol handler. If a user can be tricked into visiting a specially crafted web page, arbitrary files may be read or written with the user's permissions.
Alerts:	Gentoo 200701-27 2007-01-30 OpenPKG OpenPKG-SA-2006.043 2006-12-26 Debian DSA-1240-1 2006-12-21 Gentoo 200612-16 2006-12-14 Debian DSA-1228-1 2006-12-05 Debian DSA-1226-1 2006-12-03 Fedora FEDORA-2006-1278 2006-11-21 Fedora FEDORA-2006-1277 2006-11-21 Mandriva MDKSA-2006:216 2006-11-20 Red Hat RHSA-2006:0742-01 2006-11-15

Comments (none posted)

fetchmail: password disclosure and DOS

Package(s):	fetchmail	CVE #(s):	CVE-2006-5867 CVE-2006-5974
Created:	January 9, 2007	Updated:	March 16, 2007
Description:	Fetchmail suffers from a password disclosure vulnerability due to a failure to use secure protocols (advisory) and a denial of service vulnerability (advisory).
Alerts:	SuSE SUSE-SR:2007:004 2007-03-16 Debian DSA-1259-1 2007-02-14 Red Hat RHSA-2007:0018-01 2007-01-31 Slackware SSA:2007-024-01 2007-01-25 Gentoo 200701-13 2007-01-22 Fedora FEDORA-2007-042 2007-01-16 Fedora FEDORA-2007-041 2007-01-16 Mandriva MDKSA-2007:016 2006-01-15 Ubuntu USN-405-1 2007-01-11 rPath rPSA-2007-0003-1 2007-01-09 OpenPKG OpenPKG-SA-2007.004 2007-01-08

Comments (none posted)

ffmpeg: buffer overflows

Package(s):	ffmpeg	CVE #(s):	CVE-2006-4799 CVE-2006-4800
Created:	September 14, 2006	Updated:	May 28, 2007
Description:	the AVI processing code in FFmpeg has a number of buffer overflow vulnerabilities. If an attacker can trick a user into loading a specially crafted crafted AVI, arbitrary code can be executed with the user's privileges.
Alerts:	Gentoo 200609-09 2006-09-13

Comments (2 posted)

Mozilla stuff: multiple vulnerabilities

Package(s):	firefox thunderbird seamonkey	CVE #(s):	CVE-2006-6497 CVE-2006-6498 CVE-2006-6501 CVE-2006-6502 CVE-2006-6503 CVE-2006-6504 CVE-2006-6505
Created:	December 20, 2006	Updated:	March 12, 2007
Description:	The Mozilla Project has released new versions of firefox, thunderbird, and seamonkey to address the usual pile of security issues; see this announcement or this CERT advisory for details.
Alerts:	Debian DSA-1265-1 2007-03-10 Debian DSA-1258-1 2007-02-07 Debian DSA-1253-1 2006-01-27 Ubuntu USN-398-4 2007-01-27 SuSE SUSE-SA:2007:006 2007-01-12 Mandriva MDKSA-2007:011 2007-01-11 Mandriva MDKSA-2007:010 2007-01-11 Gentoo 200701-04 2007-01-10 Ubuntu USN-400-1 2007-01-04 Gentoo 200701-03 2007-01-04 Gentoo 200701-02 2007-01-04 Ubuntu USN-398-2 2007-01-03 Ubuntu USN-398-3 2007-01-04 Ubuntu USN-398-1 2007-01-02 Fedora FEDORA-2006-004 2007-01-02 rPath rPSA-2006-0234-2 2006-12-22 SuSE SUSE-SA:2006:080 2006-12-29 Slackware SSA:2006-357-03 2006-12-25 Slackware SSA:2006-357-01 2006-12-25 Slackware SSA:2006-357-02 2006-12-25 rPath rPSA-2006-0234-1 2006-12-22 Fedora FEDORA-2006-1499 2006-12-21 Fedora FEDORA-2006-1491 2006-12-20 Fedora FEDORA-2006-1492 2006-12-20 Red Hat RHSA-2006:0759-01 2006-12-19 Red Hat RHSA-2006:0760-01 2006-12-19 Red Hat RHSA-2006:0758-01 2006-12-19

Comments (none posted)

freeradius: several vulnerabilities

Package(s):	freeradius	CVE #(s):	CVE-2005-4745 CVE-2005-4746
Created:	August 8, 2006	Updated:	April 24, 2007
Description:	Several remote vulnerabilities have been discovered in freeradius, a high-performance RADIUS server, which may lead to SQL injection or denial of service.
Alerts:	Mandriva MDKSA-2007:092 2007-04-23 Debian DSA-1145-1 2006-08-08

Comments (none posted)

freetype: integer overflows

Package(s):	freetype	CVE #(s):	CVE-2006-0747 CVE-2006-1861 CVE-2006-2493 CVE-2006-2661 CVE-2006-3467
Created:	June 8, 2006	Updated:	October 10, 2007
Description:	The FreeType library has several integer overflow vulnerabilities. If a user can be tricked into installing a specially crafted font file, arbitrary code can be executed with the privilege of the user.
Alerts:	Gentoo 200710-09 2007-10-09 Debian DSA-1178-1 2006-09-16 Ubuntu USN-341-1 2006-09-06 Gentoo 200609-04 2006-09-06 rPath rPSA-2006-0157-1 2006-08-25 Mandriva MDKSA-2006:148 2006-08-24 Red Hat RHSA-2006:0635-01 2006-08-21 Red Hat RHSA-2006:0634-01 2006-08-21 Fedora FEDORA-2006-912 2006-08-14 SuSE SUSE-SA:2006:045 2006-08-01 OpenPKG OpenPKG-SA-2006.017 2006-07-28 Ubuntu USN-324-1 2006-07-27 Slackware SSA:2006-207-02 2006-07-27 Mandriva MDKSA-2006:129 2006-07-20 Gentoo 200607-02 2006-07-09 SuSE SUSE-SA:2006:037 2006-06-27 Mandriva MDKSA-2006:099-1 2006-06-13 Mandriva MDKSA-2006:099 2006-06-12 rPath rPSA-2006-0100-1 2006-06-12 Debian DSA-1095-1 2006-06-10 Ubuntu USN-291-1 2006-06-08

Comments (none posted)

ftpd: privilege escalation

Package(s):	ftpd	CVE #(s):	CVE-2006-5778
Created:	November 10, 2006	Updated:	February 14, 2007
Description:	Ftpd is vulnerable to a privilege escalation attack, an incorrect seteuid() call can be used by an FTP user to gain unauthorized access to files or directories.
Alerts:	Gentoo 200611-05:02 2006-11-10 Debian DSA-1217-1 2006-11-20 Gentoo 200611-05 2006-11-10

Comments (none posted)

gcc: file overwrite vulnerability

Package(s):	gcc	CVE #(s):	CVE-2006-3619
Created:	September 6, 2006	Updated:	March 14, 2008
Description:	The fastjar utility found in the GNU compiler collection does not perform adequate file path checking, allowing the creation or overwriting of files outside of the current directory tree.
Alerts:	Mandriva MDVSA-2008:066 2007-03-13 Red Hat RHSA-2007:0473-01 2007-06-11 Red Hat RHSA-2007:0220-02 2007-05-01 Debian DSA-1170-1 2006-09-06

Comments (none posted)

gdb: buffer overflow

Package(s):	gdb	CVE #(s):	CVE-2006-4146
Created:	September 15, 2006	Updated:	June 12, 2007
Description:	A buffer overflow in dwarfread.c and dwarf2read.c debugging code in GNU Debugger (GDB) 6.5 allows user-assisted attackers, or restricted users, to execute arbitrary code via a crafted file with a location block (DW_FORM_block) that contains a large number of operations.
Alerts:	Red Hat RHSA-2007:0469-01 2007-06-11 Red Hat RHSA-2007:0229-02 2007-05-01 Ubuntu USN-356-1 2006-10-02 Fedora FEDORA-2006-975 2006-09-14

Comments (none posted)

gdm: improper file permissions

Package(s):	gdm	CVE #(s):	CVE-2006-1057
Created:	April 19, 2006	Updated:	May 2, 2007
Description:	The .ICEauthority file may be created with the wrong ownership and permissions; gdm 2.14.2 fixes the problem.
Alerts:	Red Hat RHSA-2007:0286-02 2007-05-01 Mandriva MDKSA-2006:083 2006-05-09 Ubuntu USN-278-1 2006-05-03 Debian DSA-1040-1 2006-04-24 Fedora FEDORA-2006-338 2006-04-19

Comments (none posted)

geoip: path traversal

Package(s):	geoip	CVE #(s):	CVE-2007-0159
Created:	January 10, 2007	Updated:	January 24, 2007
Description:	Geoip fails to do sanity checking on returned filenames, opening up a path traversal vulnerability.
Alerts:	Ubuntu USN-412-1 2007-01-23 Mandriva MDKSA-2007:004 2007-01-08

Comments (none posted)

gnupg: stack overwrite

Package(s):	gnupg	CVE #(s):	CVE-2006-6235
Created:	December 12, 2006	Updated:	March 13, 2007
Description:	A "stack overwrite" vulnerability in GnuPG (gpg) allows attackers to execute arbitrary code via crafted OpenPGP packets that cause GnuPG to dereference a function pointer from deallocated stack memory.
Alerts:	Fedora FEDORA-2007-316 2007-03-12 Fedora FEDORA-2007-315 2007-03-12 SuSE SUSE-SA:2006:075 2006-12-13 Mandriva MDKSA-2006:228 2006-12-11

Comments (3 posted)

gtk2: denial of service

Package(s):	gtk2	CVE #(s):	CVE-2007-0010
Created:	January 24, 2007	Updated:	February 8, 2007
Description:	From the Red Hat advisory: A bug was found in the way the gtk2 GdkPixbufLoader() function processed invalid input. Applications linked against gtk2 could crash if they loaded a malformed image file.
Alerts:	Mandriva MDKSA-2007:039 2007-02-07 Ubuntu USN-415-1 2007-02-01 Debian DSA-1256-1 2007-01-31 SuSE SUSE-SR:2007:002 2007-01-26 rPath rPSA-2007-0019-1 2007-01-25 Red Hat RHSA-2007:0019-02 2007-01-24

Comments (1 posted)

gv: stack-based buffer overflow

Package(s):	gv	CVE #(s):	CVE-2006-5864
Created:	November 20, 2006	Updated:	April 9, 2007
Description:	Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header.
Alerts:	Gentoo 200704-06 2007-04-06 Gentoo 200703-24 2007-03-26 Debian DSA-1243-1 2006-12-28 Debian DSA-1214-2 2006-12-27 Mandriva MDKSA-2006:229 2006-12-13 rPath rPSA-2006-0230-1 2006-12-12 Fedora FEDORA-2006-1438 2006-12-11 Fedora FEDORA-2006-1437 2006-12-11 Ubuntu USN-390-3 2006-12-06 Ubuntu USN-390-2 2006-12-06 Mandriva MDKSA-2006:214-1 2006-12-04 Ubuntu USN-390-1 2006-11-30 Gentoo 200611-20 2006-11-24 Debian DSA-1214-1 2006-11-20 Mandriva MDKSA-2006:214 2006-11-17

Comments (none posted)

gzip: multiple vulnerabilities

Package(s):	gzip	CVE #(s):	CVE-2006-4334 CVE-2006-4335 CVE-2006-4336 CVE-2006-4337 CVE-2006-4338
Created:	September 19, 2006	Updated:	June 1, 2007
Description:	Tavis Ormandy of the Google Security Team discovered two denial of service flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to hang or crash. Tavis Ormandy of the Google Security Team discovered several code execution flaws in the way gzip expanded archive files. If a victim expanded a specially crafted archive, it could cause the gzip executable to crash or execute arbitrary code.
Alerts:	Fedora FEDORA-2007-557 2007-05-31 Gentoo 200611-24 2006-11-28 Fedora-Legacy FLSA:211760 2006-11-13 Fedora FEDORA-2006-989 2006-10-10 SuSE SUSE-SA:2006:056 2006-09-26 Gentoo 200609-13 2006-09-23 Trustix TSLSA-2006-0052 2006-09-22 Mandriva MDKSA-2006:167 2006-09-20 Slackware SSA:2006-262-01 2006-09-20 OpenPKG OpenPKG-SA-2006.020 2006-09-20 Debian DSA-1181-1 2006-09-19 rPath rPSA-2006-0170-1 2006-09-19 Ubuntu USN-349-1 2006-09-19 Red Hat RHSA-2006:0667-01 2006-09-19

Comments (1 posted)

horde-kronolith: local file inclusion

Package(s):	horde-kronolith	CVE #(s):	CVE-2006-6175
Created:	January 17, 2007	Updated:	March 7, 2008
Description:	Kronolith contains a mistake in lib/FBView.php where a raw, unfiltered string is used instead of a sanitized string to view local files. An authenticated attacker could craft an HTTP GET request that uses directory traversal techniques to execute any file on the web server as PHP code, which could allow information disclosure or arbitrary code execution with the rights of the user running the PHP application (usually the webserver user).
Alerts:	Gentoo 200701-11 2007-01-16

Comments (none posted)

imagemagick: buffer overflows

Package(s):	imagemagick	CVE #(s):	CVE-2006-5868
Created:	November 28, 2006	Updated:	February 16, 2007
Description:	Daniel Kobras discovered multiple buffer overflows in ImageMagick's SGI file format decoder. By tricking a user or an automated system into processing a specially crafted SGI image, this could be exploited to execute arbitrary code with the user's privileges.
Alerts:	Red Hat RHSA-2007:0015-01 2007-02-15 Mandriva MDKSA-2006:223 2006-12-01 Ubuntu USN-386-1 2006-11-28

Comments (1 posted)

ImageMagick: buffer overflows

Package(s):	ImageMagick	CVE #(s):	CVE-2006-5456
Created:	October 31, 2006	Updated:	March 8, 2007
Description:	Multiple buffer overflows in GraphicsMagick before 1.1.7 and ImageMagick 6.0.7 allow user-assisted attackers to cause a denial of service and possibly execute execute arbitrary code via (1) a DCM image that is not properly handled by the ReadDCMImage function in coders/dcm.c, or (2) a PALM image that is not properly handled by the ReadPALMImage function in coders/palm.c.
Alerts:	Slackware SSA:2007-066-06 2007-03-08 rPath rPSA-2007-0029-1 2007-02-08 rPath rPSA-2006-0218-1 2006-11-27 Gentoo 200611-19 2006-11-24 Fedora FEDORA-2006-1285 2006-11-22 Fedora FEDORA-2006-1286 2006-11-22 Debian DSA-1213-1 2006-11-19 SuSE SUSE-SA:2006:066 2006-11-14 Gentoo 200611-07 2006-11-13 Ubuntu USN-372-1 2006-11-01 Mandriva MDKSA-2006:193 2006-10-30

Comments (2 posted)

imlib2: arbitrary code execution

Package(s):	imlib2	CVE #(s):	CVE-2006-4806 CVE-2006-4807 CVE-2006-4808 CVE-2006-4809
Created:	November 6, 2006	Updated:	August 13, 2007
Description:	M. Joonas Pihlaja discovered that imlib2 did not sufficiently verify the validity of ARGB, JPG, LBM, PNG, PNM, TGA, and TIFF images. If a user were tricked into viewing or processing a specially crafted image with an application that uses imlib2, the flaws could be exploited to execute arbitrary code with the user's privileges.
Alerts:	Mandriva MDKSA-2007:156 2007-08-10 Gentoo 200612-20 2006-12-20 Fedora FEDORA-EXTRAS-2006-004 2006-11-09 Mandriva MDKSA-2006:198-1 2006-11-06 Mandriva MDKSA-2006:198 2006-11-06 Ubuntu USN-376-2 2006-11-06 Ubuntu USN-376-1 2006-11-03

Comments (none posted)

java: multiple vulnerabilities

Package(s):	java	CVE #(s):	CVE-2006-4339 CVE-2006-4790 CVE-2006-6731 CVE-2006-6736 CVE-2006-6737 CVE-2006-6745
Created:	January 18, 2007	Updated:	June 8, 2007
Description:	java has multiple vulnerabilities, these include: an RSA exponent padding attack vulnerability, two vulnerabilities which allow untrusted applets to access data in other applets, vulnerabilities that involve applets gaining privileges due to serialization bugs in the JRE and buffer overflows in the java image handling routines that can give attackers read/write/execute capabilities for local files.
Alerts:	Gentoo 200705-20 2007-05-26 Red Hat RHSA-2007:0073-01 2007-02-09 Red Hat RHSA-2007:0072-01 2007-02-08 Red Hat RHSA-2007:0062-02 2007-02-07 Gentoo 200701-15 2007-01-22 SuSE SUSE-SA:2007:010 2007-01-18

Comments (1 posted)

kdelibs: integer overflow

Package(s):	kdelibs	CVE #(s):	CVE-2006-4811
Created:	October 18, 2006	Updated:	March 5, 2007
Description:	The KDE khtml library can pass untrusted parameters into Qt, allowing a hostile user to trigger an integer overflow there and execute arbitrary code.
Alerts:	Gentoo 200703-06 2007-03-04 Gentoo 200611-02 2006-11-06 Red Hat RHSA-2006:0725-01 2006-11-01 Debian DSA-1200-1 2006-10-30 Slackware SSA:2006-298-01 2006-10-26 rPath rPSA-2006-0195-2 2006-10-18 Mandriva MDKSA-2006:186 2006-10-19 rPath rPSA-2006-0195-1 2006-10-18 Red Hat RHSA-2006:0720-01 2006-10-18

Comments (none posted)

kdenetwork: denial of service

Package(s):	kdenetwork	CVE #(s):	CVE-2006-6811
Created:	January 11, 2007	Updated:	February 1, 2007
Description:	The KsIRC 1.3.12 utility in kdenetwork is vulnerable to a remote denial of service attack that can be caused by a malicious IRC server sending a long PRIVMSG string. This causes an assertion failure and an associated NULL pointer dereference.
Alerts:	Gentoo 200701-26 2007-01-29 rPath rPSA-2007-0007-1 2007-01-15 Ubuntu USN-409-1 2007-01-15 Mandriva MDKSA-2007:009 2007-01-10

Comments (none posted)

kernel: multiple vulnerabilities

Package(s):	kernel	CVE #(s):	CVE-2006-5749 CVE-2006-4814 CVE-2006-6106
Created:	January 5, 2007	Updated:	May 7, 2008
Description:	A security issue has been reported in Linux kernel due to an error in drivers/isdn/i4l/isdn_ppp.c as the "isdn_ppp_ccp_reset_alloc_state()" function never initializes an event timer before scheduling it with the "add_timer()" function. The mincore function in the kernel does not properly lock access to user space, which has unspecified impact and attack vectors, possibly related to a deadlock. Another vulnerability has been reported in Linux kernel caused by a boundary error within the handling of incoming CAPI messages in net/bluetooth/cmtp/capi.c. This can be exploited to overwrite certain Kernel data structures.
Alerts:	CentOS CESA-2008:0211 2008-05-07 Red Hat RHSA-2008:0211-01 2008-05-07 Debian DSA-1503 2008-02-22 Debian DSA-1503-2 2008-03-06 SuSE SUSE-SA:2007:035 2007-06-14 SuSE SUSE-SA:2007:053 2007-10-12 Ubuntu USN-416-2 2007-03-01 Ubuntu USN-416-1 2007-02-01 rPath rPSA-2007-0031-1 2007-02-09 Mandriva MDKSA-2007:040 2007-02-07 Red Hat RHSA-2007:0014-01 2007-01-30 Mandriva MDKSA-2007:025 2007-01-23 Fedora FEDORA-2007-058 2007-01-18 Mandriva MDKSA-2007:012 2006-01-12 Trustix TSLSA-2007-0002 2007-01-05

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-4623
Created:	October 18, 2006	Updated:	November 14, 2007
Description:	The kernel DVB layer can be caused to crash with maliciously-formatted unidirectional lightweight encapsulation (ULE) data.
Alerts:	Ubuntu USN-489-1 2007-07-19 rPath rPSA-2006-0194-1 2006-10-17

Comments (none posted)

kernel: denial of service

Package(s):	kernel	CVE #(s):	CVE-2006-4535 CVE-2006-4538
Created:	September 18, 2006	Updated:	December 3, 2007
Description:	Sridhar Samudrala discovered a local denial of service vulnerability in the handling of SCTP sockets. By opening such a socket with a special SO_LINGER value, a local attacker could exploit this to crash the kernel. (CVE-2006-4535) Kirill Korotaev discovered that the ELF loader on the ia64 and sparc platforms did not sufficiently verify the memory layout. By attempting to execute a specially crafted executable, a local user could exploit this to crash the kernel. (CVE-2006-4538)
Alerts:	Red Hat RHSA-2007:1049-01 2007-12-03 Mandriva MDKSA-2006:182 2006-10-11 Red Hat RHSA-2006:0689-01 2006-10-05 Debian DSA-11