-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2005:019
Date: Fri, 19 Aug 2005 13:00:00 +0000
Cross-References: CAN-2005-2102
CAN-2005-2103
CAN-2005-1852
CAN-2004-0519
CAN-2005-2471
CAN-2005-1527
CAN-2005-2301
CAN-2005-2302
CAN-2005-2097
CAN-2005-2215
CAN-2005-1888
CAN-2005-2360
CAN-2005-2361
CAN-2005-2362
CAN-2005-2363
CAN-2005-2364
CAN-2005-2365
CAN-2005-2366
CAN-2005-2367
Content of this advisory:
1) Solved Security Vulnerabilities:
- SUSE Linux 8.2 discontinued.
- pstopnm use of ghostscript without -dSAFER
- gaim various security problems
- kopete gadu denial of service attack
- squirrelmail various cross site scripting issues
- awstats remote code execution
- powerdns denial of service attack
- gpdf denial of service attack
- kpdf denial of service attack
- mediawiki cross site scripting problem
- wipe left around backup copies
- ethereal various security issues
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
- acroread plugin buffer overflow
- various kernel security issues
- evolution format string problems
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
or download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- SUSE Linux 8.2 discontinued
As previously announced we have discontinued support of SUSE Linux 8.2
on the 31rd of July.
Begin of next week we will now move away the directories for the
YaST Online Update to free disk space on the mirrors.
The YOU patches and fixed RPMs will remain on:
ftp://ftp.suse.com/pub/suse/discontinued/i386/8.2/
- pstopnm use of ghostscript without -dSAFER
pstopnm in netpbm does not properly use the "-dSAFER" option when
calling Ghostscript to convert convert a Postscript file into a (1)
PBM, (2) PGM, or (3) PNM file, which allows external user-complicit
attackers to execute arbitrary commands.
This is tracked by the Mitre CVE ID CAN-2005-2471.
This problem affects all SUSE Linux based products.
- gaim various security problems
Various memory corruption bugs within the GNOME instant messenger
client gaim have been fixed:
- An AIM/ICQ malformed filename crash. Mitre CVE ID: CAN-2005-2102 -
- An AIM/ICQ away-message buffer overflow. Mitre CVE ID: CAN-2005-2103
For the SUSE Linux 9.3 and 9.2 distributions a memory alignment
bug within libgadu has been fixed too, tracked by the Mitre CVE
ID CAN-2005-1852.
All SUSE Linux versions including gaim are affected.
- kopete gadu denial of service attack
The KDE instant messenging program 'kopete' was affected by a
problem within the "gadu" protocol handling. A specially crafted
'gadu' message could crash the program.
This is tracked by the Mitre CVE ID CAN-2005-1852. Only SUSE Linux
9.3 contained the vulnerable code, no other versions were affected.
- squirrelmail various cross site scripting issues
The web mailer squirrelmail had several more cross site scripting
problems which were fixed upstream. This patch integrates them into
our packages.
This is tracked by the Mitre CVE ID CAN-2004-0519.
This issue affects SUSE Linux Professional 9.0 up to 9.3.
- awstats remote code execution
The web statistics program 'awstats' contains an invalid usage
of the eval() function within the awstats perl script. This
vulnerability can be used by remote attackers to execute arbitrary
code.
This issue is tracked by the Mitre CVE ID CAN-2005-1527 and affects
SUSE Linux 9.0 up to 9.3.
- powerdns denial of service attack
The PowerDNS nameserver was updated to fix the following security
issues:
- The LDAP backend could fail and not respond anymore.
This is tracked by the Mitre CVE ID CAN-2005-2301.
- Recursive Queries of unauthorized clients could temporarily block
queries of authorized clients.
This is tracked by the Mitre CVE ID CAN-2005-2302.
Only SUSE Linux 9.3 contains the pdns package and is affected.
- gpdf and kpdf denial of service attack
Broken as well as specially crafted PDF files can cause the GNOME
PDF viewer gpdf and the KDE PDF viewer PDF to create large files
in /tmp until the filesystem runs out of space.
This is tracked by the Mitre CVE ID CAN-2005-2097.
Only gpdf and kpdf in SUSE Linux 9.3 are affected by this problem.
- MediaWiki cross site scripting problem
Several cross site scripting (XSS) bugs were found and fixed in
MediaWiki.
- in the page move template, tracked by the Mitre CVE ID
CAN-2005-2215.
- with HTML attributes In page templates, tracked by the Mitre CVE
ID CAN-2005-1888.
Only SUSE Linux 9.3 includes MediaWiki and is affected by this
problem.
- wipe left around backup copies
Due to bad path handling the secure file deletion tool 'wipe' in
some cases leaves around a copy of the original file.
This problem affects SUSE Linux 9.1 up to 9.3.
- ethereal various security issues
This update upgrades ethereal to version 0.10.12 which has all
known security bugs fixed. Bugs fixed are tracked by the Mitre CVE
IDs CAN-2005-2360, CAN-2005-2361, CAN-2005-2362, CAN-2005-2363,
CAN-2005-2364, CAN-2005-2365, CAN-2005-2366, and CAN-2005-2367.
A detailed list of bugs fixed can be found at:
http://ethereal.com/appnotes/enpa-sa-00020.html
All SUSE Linux versions were affected by this problem.
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
- acroread plugin buffer overflow
A buffer overflow was reported in the Acrobat Reader plugin, allowing
remote attackers to potentially execute code as the viewing user.
This is tracked by the Mitre CVE ID CAN-2005-2470, we are
currently testing updates.
- various kernel security issues
We are currently preparing a security kernel update for
the 2.6 lines of kernels fixing currently known issues.
We expect it to be released end of next week.
- evolution format string problems
Format string problems were reported in the evolution mail client.
We are preparing updates for this issue.
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team