Linux Advisory Watch: January 26th 2007

Updated package.

advisories/debian/debian-new-netrik-packages-fix-arbitary-shell-command-execution

Fetchmail has been found to have numerous vulnerabilities allowing for Denial of Service and password disclosure.

Mod_auth_kerb is vulnerable to a buffer overflow possibly allowing a Denial of Service.

Multiple unspecified vulnerabilities have been identified in Sun Java Development Kit (JDK) and Java Runtime Environment (JRE).

Adobe Acrobat Reader is vulnerable to remote code execution, Denial of Service, and cross-site scripting attacks.

libgtop improperly handles filenames, possibly allowing for the execution of arbitrary code.

xine-ui improperly handles format strings, possibly allowing for the execution of arbitrary code.

A shell script commonly released with OpenLDAP makes insecure usage of files in /tmp during the emerge process.

Centericq does not properly handle communications with the LiveJournal service, allowing for the remote execution of arbitrary code.

Multiple vulnerabilities in MIT Kerberos 5 could potentially result in the execution of arbitrary code.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. The updated packages have been patched to correct this problem.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. The updated packages have been patched to correct this problem.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. The updated packages have been patched to correct this problem.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. The updated packages have been patched to correct this problem.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node. The updated packages have been patched to correct this problem.

Stack-based buffer overflow in the glibtop_get_proc_map_s function in libgtop before 2.14.6 (libgtop2) allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a process with a long filename that is mapped in its address space, which triggers the overflow in gnome-system-monitor. The updated packages have been patched to correct this problem.

The version of glibc shipped with Mandriva 2007 has a bug that prevents the system from passing the lsb-runtime test suite (T.ttyname_r). This update also includes sparc64 updates and Unicode 5.0 support.

Due to an error in the compilation system, the firefox-dependant packages provided in MDKSA-2007:010 for Mandriva 2007/x86_64 were linked to the older version of Firefox. This update corrects the problem.

The Adobe PDF specification 1.3, as implemented by xpdf 3.0.1 patch 2, kpdf in KDE before 3.5.5, and other products, allows remote attackers to have an unknown impact, possibly including denial of service (infinite loop), arbitrary code execution, or memory corruption, via a PDF file with a (1) crafted catalog dictionary or (2) a crafted Pages attribute that references an invalid page tree node.

Due to changes in the structure of the documentation, the Help buttons of the Software Management tools led to broken links. This update fixes the links catalog system so the inline help works again.

Some vulnerabilities were discovered and corrected in the Linux 2.6 kernel.

A stack-based buffer overflow in the sreplace function in ProFTPD 1.3.0 and earlier, allows remote attackers to cause a denial of service, as demonstrated by vd_proftpd.pm, a "ProFTPD remote exploit."

A vulnerability in squid was discovered that could be remotely exploited by using a special ftp:// URL (CVE-2007-0247)

Updated acroread packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-adobe-acrobat-reader-security-update-90817

Updated gtk2 packages that fix a security issue are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-gtk2-security-update-RHSA-2007-0019-02

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue.

Various security problems and bugs have been fixed in the IBMJava JRE and SDK. The IBM Java packages were updated to: IBM Java 1.4.2 to Service Refresh 7. IBM JAVA 1.3.10 to Service Refresh 10. It contains several security fixes also fixed in SUN Java including: CVE-2006-4339: fix for the RSA exponent padding attack. CVE-2006-6736,CVE-2006-6737: 2 unspecified vulnerabilities that allow untrusted applets to access data in other applets. CVE-2006-6745: Multiple unspecified vulnerabilities that allow applets to gain privileges related to serialization bugs in the JRE. CVE-2006-6731: Multiple buffer overflows in java image handling routines that allow attackers to potentially read/write/execute local files.

The Adobe Acrobat Reader has been updated to version 7.0.9. This update also includes following security fixes: CVE-2006-5857: A memory corruption problem was fixed in Adobe Acrobat Reader can potentially lead to code execution. CVE-2007-0044: Universal Cross Site Request Forgery (CSRF) problems were fixed in the Acrobat Reader plugin which could be exploited by remote attackers to conduct CSRF attacks using any site that is providing PDFs. CVE-2007-0045: Cross site scripting problems in the Acrobat Reader plugin were fixed, which could be exploited by remote attackers to conduct XSS attacks against any site that is providing PDFs. CVE-2007-0046: A double free problem in the Acrobat Reader plugin was fixed which could be used by remote attackers to potentially execute arbitrary code. Note that all platforms using Adobe Reader currently have counter measures against such attack where it will just cause a controlled abort(). CVE-2007-0047 and CVE-2007-0048 affect only Microsoft Windows and Internet Explorer. Please note that the Acrobat Reader on SUSE Linux Enterprise Server 9 is affected too, but can not be updated currently due to GTK+ 2.4 requirements. We are trying to find a solution. Acrobat Reader on SUSE Linux Enterprise Server 8 and SUSE Linux Desktop 1 is no longer supported and should be deinstalled.

This update fixes a remotely exploitable denial-of-service bug in squid that can be triggered by using special ftp:// URLs. (CVE-2007-0247) Additionally the 10.2 package needed a fix for another DoS bug (CVE-2007-0248) and for max_user_ip handling in ntlm_auth.

This update fixes several format string bugs that can be exploited remotely with user-assistance to execute arbitrary code. Since SUSE Linux version 10.1 format string bugs are not exploitable anymore. (CVE-2007-0017)

The poppler PDF loader library did not limit the recursion depth of the page model tree. By tricking a user into opening a specially crafter PDF file, this could be exploited to trigger an infinite loop and eventually crash an application that uses this library. kpdf in Ubuntu 5.10, and KOffice in all Ubuntu releases contains a copy of this code and thus is affected as well.

advisories/ubuntu/ubuntu-poppler-vulnerability-81822

Roland Lezuo and Josselin Mouette discovered that the HTTP server code in libsoup did not correctly verify request headers. Remote attackers could crash applications using libsoup by sending a crafted HTTP request, resulting in a denial of service.

advisories/ubuntu/ubuntu-libsoup-vulnerability

Dean Gaudet discovered that the GeoIP update tool did not validate the filename responses from the update server. A malicious server, or man-in-the-middle system posing as a server, could write to arbitrary files with user privileges.

advisories/ubuntu/ubuntu-geoip-vulnerability

A flaw was discovered in the HID daemon of bluez-utils. A remote attacker could gain control of the mouse and keyboard if hidd was enabled. This does not affect a default Ubuntu installation, since hidd is normally disabled.

advisories/ubuntu/ubuntu-bluez-vulnerability

David Duncan Ross Palmer and Henrik Nordstrom discovered that squid incorrectly handled special characters in FTP URLs. Remote users with access to squid could crash the server leading to a denial of service.

advisories/ubuntu/ubuntu-squid-vulnerabilities