-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2006:005
Date: Fri, 03 Mar 2006 15:00:00 +0000
Cross-References: CVE-2002-0399, CVE-2005-1918, CVE-2005-2337
CVE-2005-3313, CVE-2006-0188, CVE-2006-0195
CVE-2006-0300, CVE-2006-0377, CVE-2006-0455
CVE-2006-0709, CVE-2006-0804, CVE-2006-0855
Content of this advisory:
1) Solved Security Vulnerabilities:
- tin single byte overflow
- ethereal denial of service in IRC dissector
- zoo buffer overflow in filename handling
- ruby security check circumvention
- metamail buffer overflow
- squirrelmail several security problems
- gpg2 signature checking problems
- tar buffer overflow during PAX header parsing
- tar directory traversal fixes
- opera upgraded to 8.52
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
None listed this week.
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
or download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- tin single byte overflow
A single byte overflow was fixed in the USENET News Reader tin.
This issue is tracked by the Mitre CVE ID CVE-2006-0804 and affects
all SUSE Linux versions.
- ethereal denial of service in IRC dissector
A denial-of-service bug in the IRC dissector of the network analysis
program ethereal was fixed.
This issue is tracked by the Mitre CVE ID CVE-2005-3313 and affects
all SUSE Linux based products.
- zoo buffer overflow in filename handling
A buffer overflow in the archiver zoo while handling long filenames
was fixed. This bug could be used in conjunction with other programs
(MUA, virus scanners, ...) to potentially execute arbitrary code
remotely.
This is tracked by the Mitre CVE ID CVE-2006-0855 and affects all
SUSE Linux based products.
- ruby security check circumvention
A remote attacker could circumvent certain security checks in ruby
to be able to execute arbitrary code.
This is tracked by the Mitre CVE ID CVE-2005-2337 and affects all
SUSE Linux products containing ruby.
- metamail buffer overflow
A buffer overflow was found in metamail. This bug could be exploited
remotely to execute arbitrary code by handcrafting specific
boundary tags.
This issue is tracked by the Mitre CVE ID CVE-2006-0709 and affects
all SUSE Linux products containing metamail.
- squirrelmail several security problems
Three security issues were fixed in the web mailer squirrelmail:
- CVE-2006-0188: webmail.php in Squirrelmail 1.4.0 to 1.4.5 allows
remote attackers to inject arbitrary web pages into the right frame
via a URL in the right_frame parameter.
- CVE-2006-0195: Interpretation conflict in the MagicHTML filter
in Squirrelmail 1.4.0 to 1.4.5 allows remote attackers to conduct
cross-site scripting (XSS) attacks via style sheet specifiers with
invalid (1) "/*" and "*/" comments, or (2) a newline in a "URL"
specifier, which is processed by certain web browsers including
Internet Explorer.
- CVE-2006-0377: CRLF injection vulnerability in Squirrelmail
1.4.0 to 1.4.5 allows remote attackers to inject arbitrary IMAP
commands via newline characters in the mailbox parameter of the
sqimap_mailbox_select command, aka "IMAP injection."
- gpg2 signature checking problems
The signature verification code in GPG 2 had the same problems as the
one in GPG. Before this update gpg2 returned a 0 (valid signature)
when used on command-line with option --verify. This bug for example
makes automatic tools vulnerable that confirm downloaded information
files via GPG signatures before using the information in them.
This issue is tracked by the Mitre CVE ID CVE-2006-0455. SUSE Linux
9.2 up to 10.0 and Novell Linux Desktop 9 are affected.
- tar buffer overflow during PAX header parsing
The archiver tar had a buffer overflow during parsing PAX extended
headers. An attacker can exploit this to execute arbitrary code
with the privileges of the user running tar.
This is tracked by the Mitre CVE ID CVE-2006-0300 and affects SUSE Linux 9.3
and 10.0.
- tar directory traversal fixes
The bugfix for directory traversal in the tar archiver tracked by
CVE-2002-0399 was incorrect. This bug leads to the possibility to
overwrite files when extracting a specially crafted archive.
This is tracked by the Mitre CVE ID CVE-2005-1918 and affects SUSE
Linux 9.1, SUSE Linux Enterprise Server 8 and SUSE LINUX Enterprise
Server 9.
- Opera upgraded to 8.52
The free web browser Opera was upgraded to version 8.52 to fix
following security related problems:
- Replaced expired SSL certificates from TrustCenter.
- CVE-2005-3699: Solved status bar issue described in Secunia Advisory 17571.
- Implemented stricter handling of the Online Certificate Status Protocol (OCSP).
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
None listed this week.
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team