SuSE Security Announcement: KDE (SuSE-SA:2003:026)
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: KDE
Announcement-ID: SuSE-SA:2003:0026
Date: Thu Apr 24 12:00:00 MEST 2003
Affected products: 7.1, 7.2, 7.3, 8.0, 8.1, 8.2
SuSE eMail Server 3.1
SuSE eMail Server III
SuSE Firewall Adminhost VPN
SuSE Linux Admin-CD for Firewall
SuSE Firewall on CD 2 - VPN
SuSE Firewall on CD 2
SuSE Linux Connectivity Server
SuSE Linux Enterprise Server 7
SuSE Linux Office Server
Vulnerability Type: various security vulnerabilities
Severity (1-10): 5
SuSE default package: yes
Cross References: http://www.kde.org/info/security/advisory-20030409-1.txt
http://www.kde.org/info/security/advisory-20021220-1.txt
http://www.kde.org/announcements/announce-3.0.5a.html
Content of this advisory:
1) security vulnerability resolved: Results of security audit of KDE.
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- glibc
- pptpd
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The K Desktop Environment KDE allows to generate postscript previews which
can be viewed via certain konqueror plug-ins for example. The previews
are generated by invoking the ghostscript program but without supplying the
"-dSAFER" option as an argument. This allows embedded code to be executed.
Additionally to the correction made to the postscript generation process,
various other security related bug fixes and patches from KDE 3.0.5a have
been incorporated. For more information regarding these fixes please visit
the URLs given as cross references.
The complete list of fixed packages is as follows:
kdelibs3
kdelibs3-cups
kdebase3
kdebase3-kdm
kdebase3-konqueror
kdebase3-ksysguardd
kdebase3-extra
kdegames3
kdegames3-board
kdegraphics3-fax
kdegraphics3-tex
kdegraphics3-viewer
kdegraphics3-postscript
kdemultimedia3-midi
kdemultimedia3-sound
kdemultimedia3-video
kdenetwork3
kdenetwork3-mail
kdenetwork3-chat
kdenetwork3-lan
kdepim3-organizer
kdepim3-kpilot
kdesdk3
kdeutils3
kdeutils3-laptop
Due to the large list of update packages we do not provide MD5 sums in this
advisory. This would blow up the advisory and make it unreadable.
Rather we recommend to either update your system via YaST2 where the
auto updater automatically checks the integrity of the packages or to follow
the guideline from section 3, "Package authenticity verification".
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- glibc
New glibc packages will be available soon which fix a RPC XDR integer
overflow. The packages are currently being tested.
- pptpd
A buffer overflow was found in the pptpd server. New packages will be
available soon.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
On Don, 24 Apr 2003, Sebastian Krahmer wrote:
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- glibc New glibc packages will be available soon which fix a RPC XDR integer overflow. The packages are currently being tested.
- pptpd A buffer overflow was found in the pptpd server. New packages will be available soon.
Does this mean that unlisted but exisiting vulnerabilities won't get fixed? -- Dirk
On Thu, 24 Apr 2003, Dirk Mueller wrote:
On Don, 24 Apr 2003, Sebastian Krahmer wrote:
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- glibc New glibc packages will be available soon which fix a RPC XDR integer overflow. The packages are currently being tested.
- pptpd A buffer overflow was found in the pptpd server. New packages will be available soon.
Does this mean that unlisted but exisiting vulnerabilities won't get fixed? No.
Sebastian -- ~ ~ perl self.pl ~ $_='print"\$_=\47$_\47;eval"';eval ~ krahmer@suse.de - SuSE Security Team ~
On Mon, 28 Apr 2003, Sebastian Krahmer wrote:
Does this mean that unlisted but exisiting vulnerabilities won't get fixed? No.
Ok, so when can one expect those fixes? There are several vulnerabilities "pending" for several months and there is still no update available. -- Dirk
Hi there! I have a little problem with our Linux server and I don't know, if it's perhaps a security problem. We run a samba server with SuSE 7.3 Last days, it behaves a little bit strange: At the first time, I wasn't able to login at the console with the root account. After entering the username root, nothing happens. From remote with ssh, I could login. Now, after some days, no root login is possible - even ssh says "access denied" When I login as normal user, I see two files in the root directory of the volume named "devory" and "slamet". I didn't create the files. They have the same date attribute and nearly the same time attribute. The server itself seems to work without problems. Is this a security problem, a hard disk problem or what else? Regards, Wolfgang Eul
On Wednesday 14 May 2003 22:35, Wolfgang Eul wrote:
Hi there!
I have a little problem with our Linux server and I don't know, if it's perhaps a security problem.
We run a samba server with SuSE 7.3
Last days, it behaves a little bit strange:
At the first time, I wasn't able to login at the console with the root account. After entering the username root, nothing happens. From remote with ssh, I could login.
Now, after some days, no root login is possible - even ssh says "access denied"
When I login as normal user, I see two files in the root directory of the volume named "devory" and "slamet". I didn't create the files. They have the same date attribute and nearly the same time attribute.
The server itself seems to work without problems.
Is this a security problem, a hard disk problem or what else?
You've been hacked!! Take the machine off the net immediatly because someone else owns it, and godonly knows what they are doing with it. Similar thing happened to my SuSE 7.3 box last week, and its now running 8.2. I still don't know how they got in, but I suspect it was via ssh-1 protocol, which for some reason I has not disabled. -- _____________________________________ John Andersen
In message
______________________________________________________________________________
SuSE Security Announcement
Package: KDE Announcement-ID: SuSE-SA:2003:0026 Date: Thu Apr 24 12:00:00 MEST 2003
On my 8.0 system, a change in /opt/kde3/lib/ksirc.so breaks KSirc (on connecting with a server it give an "eval error" which seems to stop many if not all commands working). Is this a security alteration to ksirc.so, or can I safely use the old one (which works)? (Thanks, I hope this is not too much off topic!) -- Roger Hayter
participants (5)
-
Dirk Mueller -
John Andersen -
Roger Hayter -
Sebastian Krahmer -
Wolfgang Eul