SUSE Security Summary Report SUSE-SR:2005:026
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2005:026
Date: Fri, 11 Nov 2005 09:00:00 +0000
Cross-References: CVE-2005-2006, CVE-2005-2629, CVE-2005-2869
CVE-2005-2958, CVE-2005-2974, CVE-2005-3122
CVE-2005-3123, CVE-2005-3239, CVE-2005-3252
CVE-2005-3300, CVE-2005-3301, CVE-2005-3303
CVE-2005-3350, CVE-2005-3388, CVE-2005-3389
CVE-2005-3390, CVE-2005-3500, CVE-2005-3501
Content of this advisory:
1) Solved Security Vulnerabilities:
- RealPlayer security problem
- giflib,libungif denial of service attack / buffer overflows
- snort overflow in back orifice preprocessor
- clamav buffer overflows
- jboss information disclosure
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
- zope
- phpMyAdmin cross site scripting and file inclusion problems
- libdga format string problem
- php4,php5
- gnump3d various problems
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
or download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- RealPlayer security problem
A RealPlayer security problem was found where a specially crafted
.rm movie file could overflow a buffer and allow remote attackers
to execute code in the context of the user running the player.
We already released a fix with our previous RealPlayer security
update, check SUSE-SA:2005:059.
This is tracked by the Mitre CVE ID CVE-2005-2629.
- giflib,libungif denial of service attack / buffer overflows
The GIF processing libraries libungif and giflib were updated to
fix the following security issues:
- Specially crafted GIF files could crash applications
(CVE-2005-2974).
- Specially crafted GIF files could overwrite memory which
potentially allowed to execute arbitrary code (CVE-2005-3350).
This affects all SUSE Linux based products.
- snort overflow in back orifice preprocessor
A buffer overflow in snort's Back Orifice preprocessor code was
fixed. This bug can be exploited by remote attackers to execute
arbitrary code with the privileges of the snort daemon.
This is tracked by the Mitre CVE ID CVE-2005-3252.
All SUSE Linux based products containing snort were affected.
- clamav buffer overflows
The clamav virus scan engine was updated to version 0.87.1.
This upgrade fixes among other things the following security issues:
- clamav could be made to crash via a malformed DOC file
(CVE-2005-3239).
- a buffer overflow in the FSG decoder (CVE-2005-3303).
- clamav could run into an endless loop due to malformed CAB files
(CVE-2005-3500, CVE-2005-3501).
All SUSE Linux based distributions containing clamav were affected.
- jboss information disclosure
The default configuration of jboss allows disclosure of sensitive
information to remote users, by using a GET request with "%." to
reveal the local installation path, or "%" before a filename to
reveal the contents of this file.
We will not release updated packages for this. The jboss group
recommends disabling the RMIClassLoadingService webservice.
In all jboss-service.xml files you have, change this snippet:
<mbean code="org.jboss.web.WebService"
name="jboss:service=WebService">
<attribute name="Port">8083</attribute>
<!-- Should resources and non-EJB classes be downloadable -->
<attribute name="DownloadServerClasses">true</attribute>
<attribute name="Host">${jboss.bind.address}</attribute>
<attribute name="BindAddress">${jboss.bind.address}</attribute>
</mbean>
to:
<!-- Disabled to address CVE-2005-2006
<mbean code="org.jboss.web.WebService"
name="jboss:service=WebService">
<attribute name="Port">8083</attribute>
<attribute name="DownloadServerClasses">true</attribute>
<attribute name="Host">${jboss.bind.address}</attribute>
<attribute name="BindAddress">${jboss.bind.address}</attribute>
</mbean>
-->
This is tracked by the Mitre CVE ID CVE-2005-2006.
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
- zope
Zope honors file inclusion directives in RestructuredText objects
which potentially allowed attackers to execute arbitrary code (Zope
Hotfix 2005-10-09).
Updates are currently being QA tested.
All SUSE LINUX products >= 9.1 and SLES9 are affected.
- phpMyAdmin cross site scripting and file inclusion problems
We are preparing updates for the following issues:
- multiple cross-site scripting (XSS) bugs (CVE-2005-3301,
CVE-2005-2869, PMASA-2005-5).
- multiple file inclusion vulnerabilities that allowed an attacker
to include arbitrary files (CVE-2005-3300, CVE-2005-3301,
PMASA-2005-5).
All SUSE LINUX products are affected.
- libdga format string problem
libgda contains two format string bugs in logging routines. Those
bugs could potentially indirectly lead to arbitrary code execution
via applications that link against libgda and supply data to libgda
(CVE-2005-2958).
Updates are currently being QA tested.
All SUSE LINUX products and SLES9 are affected.
- php4,php5
Stefan Esser discovered a cross-site scripting bug in the phpinfo()
function (CVE-2005-3388), a bug that allows an attacker to enable
register_globals (CVE-2005-3389) and a bug that allows an attacker
to overwrite the $GLOBALS array (CVE-2005-3390).
We are preparing updates for these issues.
All SUSE LINUX based products are affected.
- gnump3d various problems
Steve Kemp discovered a cross-site scripting bug (CVE-2005-3122) and
a directory traversal bug (CVE-2005-3123) in gnump3d.
We are preparing updates for these issues.
All SUSE LINUX products are affected.
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team
participants (1)
-
Marcus Meissner