Linux Advisory Watch: January 28th 2005

This announcement fixes several integer overflow vulnerabilities[3,4] that were encountered in libtiff by iDefense which could lead to remote arbitrary code execution.

This update fixes several vulnerabilities[2,3,4] in ethereal: CAN-2004-0633[5]: The iSNS dissector for ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow.

iDefense noticed two issuesin the xpdf code where two buffer overflows could lead to remote code execution vulnerabilities.

This update fixes several vulnerabilities in the squid web proxy cache.

A buffer overflow has been discovered in xtrlock, a minimal X display lock program which can be exploited by a malicious local attacker to crash the lock program and take over the desktop session.

advisories/debian/debian-new-xtrlock-packages-fix-authentication-bypass

Ulf Hþrnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL. advisories/debian/debian-new-sword-packages-fix-arbitrary-command-execution

Several vulnerabilities have been discovered in Squid, the internet object cache, the popular WWW proxy cache. advisories/debian/debian-new-squid-packages-fix-denial-of-service-8029

Several vulnerabilities have been discovered in unarj, a non-free ARJ unarchive utility. advisories/debian/debian-new-unarj-packages-fix-several-vulnerabilities

A buffer overflow has been detected in the X11 dissector of ethereal, a commonly used network traffic analyser. A remote attacker may be able to overflow a buffer using a specially crafted IP packet. advisories/debian/debian-new-ethereal-packages-fix-buffer-overflow-46567

Erik Sjšlund has discovered several security relevant problems in enscript, a program to convert ASCII text into Postscript and other formats. advisories/debian/debian-new-enscript-packages-fix-several-vulnerabilities

Erik Sjšlund discovered that zhcon, a fast console CJK system using the Linux framebuffer, accesses a user-controlled configuration file with elevated privileges. Thus, it is possible to read arbitrary files. advisories/debian/debian-new-zhcon-packages-fix-unauthorised-file-access

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit Team has discovered that the vdr daemon which is used for video disk recorders for DVB cards can overwrite arbitrary files. advisories/debian/debian-new-vdr-packages-fix-insecure-file-access

A heap overflow has been discovered in the DVD subpicture decoder of xine-lib. An attacker could cause arbitrary code to be executed on the victims host by supplying a malicious MPEG. By tricking users to view a malicious network stream, this is remotely exploitable. advisories/debian/debian-new-xine-lib-packages-fix-arbitrary-code-execution-5517

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit Project discovered that the DBI library, the Perl5 database interface, creates a tmporary PID file in an insecure manner. This can be exploited by a malicious user to overwrite arbitrary files owned by the person executing the parts of the library. advisories/debian/debian-new-libdbi-perl-packages-fix-insecure-temporary-file

Two problems have been discovered in the libpam-radius-auth package, the PAM RADIUS authentication module. The Common Vulnerabilities and Exposures Project identifies the following problems... advisories/debian/debian-new-libpam-radius-auth-packages-fix-several-vulnerabilities

Rapha‘l Enrici discovered that the KDE screensaver can crash under certain local circumstances. This can be exploited by an attacker with physical access to the workstation to take over the desktop session. advisories/debian/debian-new-kdebase-packages-fix-authentication-bypass

Javier Fern‡ndez-Sanguino Pe–a from the Debian Security Audit project discovered that f2c and fc, which are both part of the f2c package, a fortran 77 to C/C++ translator, open temporary files insecurely and are hence vulnerable to a symlink attack. advisories/debian/debian-new-f2c-packages-fix-insecure-temporary-files-36661

This package fixes a buffer overflow which may possibly allow attackers to execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-2-update-cups-1120-1110-09-45-00-117983

This package fixes a buffer overflow which may possibly allow attackers to execute arbitrary code as the "lp" user. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-3-update-cups-1122-0rc184-09-45-00-117984

A flaw in the alsa mixer code was discovered, which disabled stack execution protection for the libasound.so library distributed with Fedora Core 3. The effect of this flaw resulted in stack execution protection, through NX or Exec-Shield, which was disabled for any application linked to libasound. advisories/fedora/fedora-core-3-update-alsa-lib-106-7fc3-09-46-00-117985

This update fixes a small regression in handling multibyte input for "grep -Fi", and further improves performance when processing UTF-8 input. advisories/fedora/fedora-core-3-update-grep-251-314-12-55-00-117992

Applied patch to fix CAN-2005-0064 (bug #145050) advisories/fedora/fedora-core-2-update-xpdf-300-37-12-58-00-117993

Applied patch to fix CAN-2005-0064 (bug #145050) advisories/fedora/fedora-core-3-update-xpdf-300-102-12-59-00-117994

Update microcode_ctl to 1.11 (#131885) advisories/fedora/fedora-core-2-update-kernel-utils-24-91131fc2-14-21-00-117997

Update microcode_ctl to 1.11 advisories/fedora/fedora-core-3-update-kernel-utils-24-13149fc3-14-22-00-117998

New upstream release advisories/fedora/fedora-core-3-update-hal-046-1fc3-16-51-00-118004

This is a bugfix update. advisories/fedora/fedora-core-3-update-im-sdk-121-10fc3-09-35-00-118010

This is a version upgrade to 2.1.5. More cameras are supported in this version. advisories/fedora/fedora-core-3-update-gphoto2-215-11-09-35-00-118011

This update includes a regenerated version of the bundled libtool script, which fixes some build issues with third-party httpd modules. advisories/fedora/fedora-core-3-update-apr-094-242-09-36-00-118012

Fix PAM_IGNORE return value handling and correct the grubb_leak patch to fix #143750 advisories/fedora/fedora-core-3-update-pam-077-662-13-05-00-118019

Updated tetex package fixes another xpdf buffer overflow. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-2-update-tetex-202-14fc22-67950-12-07-00-118078

Updated tetex package fixes another xpdf buffer overflow. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-3-update-tetex-202-213-61115-12-08-00-118079

This update fixes several vulnerabilities in the ethereal package. advisories/fedora/fedora-core-3-update-ethereal-0109-1fc31-09-21-00-118041

This update fixes several vulnerabilities in the ethereal package. advisories/fedora/fedora-core-2-update-ethereal-0109-1fc21-09-21-00-118042

This update fixes a buffer overflow in the koffice package. advisories/fedora/fedora-core-2-update-koffice-135-0fc21-09-22-00-118043

This update fixes a buffer overflow in the koffice package. advisories/fedora/fedora-core-3-update-koffice-135-0fc31-09-23-00-118044

This update fixes several vulnerabilities in graphics-related KDE packages. advisories/fedora/fedora-core-2-update-kdegraphics-322-13-09-23-00-118045

This update fixes several vulnerabilities in graphics-related KDE packages. advisories/fedora/fedora-core-3-update-kdegraphics-331-23-09-24-00-118046

This update fixes several vulnerabilities in KDE. advisories/fedora/fedora-core-2-update-kdelibs-322-12fc2-09-25-00-118047

This update fixes several vulnerabilities in KDE. advisories/fedora/fedora-core-3-update-kdelibs-331-26fc3-09-25-00-118048

Several security relevant problems in enscript, a program to converts ASCII text to Postscript and other formats. advisories/fedora/fedora-core-2-update-enscript-161-252-12-05-00-118075

Fixes a great many bugs. Refer to the official changelog for details. advisories/fedora/fedora-core-2-update-gaim-112-0fc2-12-06-00-118076

Fixes a great many bugs. Refer to the official changelog for details. advisories/fedora/fedora-core-3-update-gaim-112-0fc3-12-06-00-118077

Updated tetex package fixes another xpdf buffer overflow. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-2-update-tetex-202-14fc22-67950-12-07-00-118078

Updated tetex package fixes another xpdf buffer overflow. The Common Vulnerabilities and Exposures projects (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue. advisories/fedora/fedora-core-3-update-tetex-202-213-61115-12-08-00-118079

Several security relevant problems in enscript, a program to converts ASCII text to Postscript and other formats. advisories/fedora/fedora-core-3-update-enscript-161-2802-12-09-00-118080

The procps package contains a set of system utilities that provide system information. advisories/fedora/fedora-core-3-update-procps-323-51-12-39-00-118093

The procps package contains a set of system utilities that provide system information. advisories/fedora/fedora-core-2-update-procps-320-12-12-39-00-118094

ImageMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.

Multiple vulnerabilities exist in Ethereal, which may allow an attacker to run arbitrary code, crash the program or perform DoS by CPU and disk utilization.

A stack overflow was discovered in Xpdf, potentially resulting in the execution of arbitrary code. GPdf includes Xpdf code and therefore is vulnerable to the same issue.

Mailman is vulnerable to cross-site scripting attacks.

CUPS includes Xpdf code and therefore is vulnerable to the recent stack overflow issue, potentially resulting in the remote execution of arbitrary code.

teTeX, pTeX and CSTeX make use of vulnerable Xpdf code which may allow the remote execution of arbitrary code. Furthermore, the xdvizilla script is vulnerable to temporary file handling issues.

KPdf and KOffice both include vulnerable Xpdf code to handle PDF files, making them vulnerable to the execution of arbitrary code.

MySQL is vulnerable to symlink attacks, potentially allowing a local user to overwrite arbitrary files.

Konversation contains multiple vulnerabilities that could lead to remote command execution or information leaks.

CUPS was vulnerable to multiple vulnerabilities and as a fix we recommended upgrading to version 1.1.23_rc1. This version is affected by a remote Denial Of Service, so we now recommend upgrading to the final 1.1.23 release which does not have any known vulnerability.

An overflow in the camel-lock-helper application can be exploited by an attacker to execute arbitrary code with elevated privileges.

AWStats fails to validate certain input, which could lead to the remote execution of arbitrary code.

GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop Document (PSD) files, which could lead to arbitrary code execution.

The Perl DBI library and File::Path::rmtree function are vulnerable to symlink attacks.

Erik Sjolund discovered that zhcon accesses a user-controlled configuration file with elevated privileges which could make it possible to read arbitrary files.

A number of vulnerabilities were found in Ethereal, all of which are fixed in version 0.10.9: The COPS dissector could go into an infinite loop (CAN-2005-0006); the DLSw dissector could cause an assertion, making Ethereal exit prematurely (CAN-2005-0007); the DNP dissector could cause memory corruption (CAN-2005-0008); the Gnutella dissector could cause an assertion, making Ethereal exit prematurely (CAN-2005-0009); the MMSE dissector could free static memory (CAN-2005-0010); and the X11 protocol dissector is vulnerable to a string buffer overflow (CAN-2005-0084).

"infamous41md" discovered two vulnerabilities in the squid proxy cache server. The first is a buffer overflow in the Gopher response parser which leads to memory corruption and would usually crash squid (CAN-2005-0094). The second is an integer overflow in the receiver of WCCP (Web Cache Communication Protocol) messages. An attacker could send a specially crafted UDP datagram that would cause squid to crash (CAN-2005-0095).

When php tries to opens a connection using fsockopen(), but the connection fails, php would not close the socket.

Florian Weimer discovered a vulnerability in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks. Input is not properly sanitised by "scripts/driver" when returning error pages. This can be exploited to execute arbitrary HTML or script code in a user's browser session in context of a vulnerable site by tricking a user into visiting a malicious web site or follow a specially crafted link.

A buffer overflow vulnerability was discovered in the xpdf PDF viewer, which could allow for arbitrary code execution as the user viewing a PDF file. The vulnerability exists due to insufficient bounds checking while processing a PDF file that provides malicious values in the /Encrypt /Length tag. The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. Cups uses xpdf code and is susceptible to the same vulnerability. The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. Tetex uses xpdf code and is susceptible to the same vulnerability. The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. Gpdf uses xpdf code and is susceptible to the same vulnerability. The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. Koffice uses xpdf code and is susceptible to the same vulnerability. The updated packages have been patched to prevent these problems.

A buffer overflow vulnerability was discovered in the xpdf PDF code, which could allow for arbitrary code execution as the user viewing a PDF file. Kdegraphics uses xpdf code and is susceptible to the same vulnerability. 10.1 packages also include a fix for ksvg kde bug #74457. The updated packages have been patched to prevent these problems.

A number of vulnerabilities are fixed in the 2.4 and 2.6 kernels with this advisory.

A vulnerability was discovered in BIND version 9.3.0 where a remote attacker may be able to cause named to exit prematurely, causing a Denial of Service due to an incorrect assumption in the validator function authvalidated(). The updated packages have been patched to prevent this problem.

New KDE packages are available to address various bugs.

Max Vozeler discovered an integer overflow in the camel-lock-helper application.

A bug in the upsd initscript used by nut exists where it starts the upsd/powerdown script earlier in the halt/shutdown process to ensure it still has access to USB.

A permissions flaw was found on /etc/sysconfig/mdkonline which prevented users from reading the file.

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 2.1 are now available. advisories/red-hat/redhat-updated-kernel-packages-fix-security-2652

Updated kernel packages that fix several security issues in Red Hat Enterprise Linux 2.1 are now available. advisories/red-hat/redhat-updated-itanium-kernel-packages-fix-security-RHSA-2005-017-01

Updated Xpdf package that fixes a stack based buffer overflow security issue is now available. advisories/red-hat/redhat-updated-xpdf-package-fixes-security-issue-RHSA-2005-059-01

An updated less package that fixes segmentation fault when viewing binary files is now available. advisories/red-hat/redhat-updated-less-package-fixes-security-issue-RHSA-2005-068-01

Several exploitable security problems were identified and fixed in the Linux kernel, the core of every SUSE Linux product.

eEye Security in October 2004 discovered a flaw in the .rm RealMovie stream handling routines which allows a remote attacker to exploit an integer overflow vulnerability using a special .rm file. This might allow a remote attacker to execute code as the user running RealPlayer.

These vulnerabilities may allow remote attackers to execute arbitrary code via malformed PDF files.