SUSE Security Summary Report SUSE-SR:2005:002
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SUSE Security Summary Report
Announcement-ID: SUSE-SR:2005:002
Date: Wednesday, Jan 26th 2005 17:00 MEST
Cross References: CAN-2004-1125
CAN-2005-0064
CAN-2004-1029
CAN-2004-0991
CAN-2004-0982
CAN-2004-1036
CAN-2004-1177
CAN-2004-1178
CAN-2004-1188
CAN-2004-1187
CAN-2004-1300
CAN-2005-0021
CAN-2005-0022
Content of this advisory:
1) solved security vulnerabilities:
- new xpdf integer overflows
- awstats remote code injection
- Java Plugin security problem
- mpg123 buffer overflow
- squirrelmail cross site scripting
- MozillaThunderbird NNTP handling
- mailman cross site scripting and weak passwords
- xine-lib buffer overflows
2) pending vulnerabilities, solutions, workarounds:
- cups security problems
- mozilla problems
- several KDE problems
- ImageMagick buffer overflow
3) standard appendix (further information)
______________________________________________________________________________
1) solved security vulnerabilities
To avoid spamming lists with advisories for every small incident,
we will release weekly summary advisories for issues where we have
released updates without a full advisory. Since these are minor
issues, md5sums and ftp URLs are not included.
Fixed packages for the following incidents are already available on
our FTP server and via the YaST Online Update.
- integer overflows in xpdf
More integer overflows were reported by iDEFENSE Security. These
have been fixed and updated packages for xpdf, gpdf, pdftohtml,
kdegraphics-pdf have already been released, cups is pending testing.
These are tracked by the Mitre CVE IDs CAN-2004-1125 and CAN-2005-0064.
This affects all SUSE Linux based distributions.
- awstats remote code injection
A remote code injection with handcrafted URL parameters was found
in the awstats web statistics helper program and could lead to a remote
attacker to easily gain access to the system.
This was fixed for SUSE Linux 9.1 and 9.2, the awstats packages of older
versions appear not to be vulnerable.
- Java Plugin security
A privilege escalation problem was found in the Sun Java Plugin
which could have a remote attacker reading and writing files of
a local user browsing websites.
This is tracked by the Mitre CVE ID CAN-2004-1029.
This bug affects all SUSE versions on the Intel x86 and AMD64 /
Intel Extended Memory Architecture (EM64T) platforms.
- mpg123 buffer overflow
Another buffer overflow was found in the stream handling of
mpg123. Also the previous fix of the HTTP header handling
was improved upon. This is tracked by the Mitre CVE IDs CAN-2004-0991
and CAN-2004-0982.
All SUSE Linux products including mpg123 are affected.
- squirrelmail cross site scripting problem
A cross site scripting problem in squirrelmail was fixed. This issue
is tracked by the Mitre CVE ID CAN-2004-1036.
All SUSE Linux versions were affected by the problem.
- MozillaThunderbird
The handling of NNTP headers in Mozilla version up to 1.7.3
could lead to a remote attacker to gain access by manipulating
a remote NNTP Server.
SUSE Linux versions 9.1 and 9.2 are affected.
- cross site scripting and weak passwords in mailman
A cross site scripting problem in mailman was fixed. Also, mailman
auto generated too weak passwords (if the user did not choose a
password).
This is tracked by the Mitre CVE IDs CAN-2004-1178 and CAN-2004-1177.
All SUSE Linux based products are affected.
- xine-lib buffer overflow problems
Several problems spotted by students of djb that could have a remote
attacker exploiting buffer overflows to get local access were fixed
in the xine-lib package. This is tracked by the Mitre CVE IDs
CAN-2004-1188, CAN-2004-1187, and CAN-2004-1300.
All SUSE Linux based products are affected.
- exim local buffer overflow problems
Buffer overflows in exim helper applications could help a local
attacker gaining root access.
These issues are tracked by the Mitre CVE IDs CAN-2005-0021 and
CAN-2005-0022.
All SUSE Linux based products are affected.
- imlib2 buffer overflows
The XPM and BMP loader of the imlib2 library had several buffer
overflows. Since no network aware applications use imlib2, this
problem is of minor severity.
SUSE Linux version 9.0 to 9.2 are affected.
______________________________________________________________________________
2) Pending vulnerabilities in SUSE Distributions and Workarounds:
- several security problems in CUPS
Several problems in the print system CUPS are currently being fixed
and tested:
- xpdf buffer overflows in included pdftops filter program.
- buffer overflow in hpgltops filter program found by djb students.
- lppasswd denial of service attack found by djb students.
Packages are currently QA tested.
- Mozilla vulnerabilities
Lots of Mozilla problems have been fixed in the Mozilla and Mozilla
Firefox packages. These are currently being QA tested.
- ImageMagick buffer overflow vulnerability
A ImageMagick buffer overflow vulnerability was reported by iDEFENSE
security. Updated packages have been prepared and are currently being
QA tested.
- Several KDE vulnerabilities
Several vulnerabilities were identified within KDE:
- Java Plugin security problems similar to the Sun Java Plugin
security problems were identified and fixed.
- A FTP command injection problem was identified and fixed.
- Window injection vulnerabilities were identified and fixed.
Updated packages for all SUSE Linux based products are currently
being QA tested.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SUSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
participants (1)
-
Marcus Meissner