-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SUSE Security Summary Report
Announcement ID: SUSE-SR:2005:025
Date: Fri, 04 Nov 2005 14:00:00 +0000
Cross-References: CVE-2005-2869, CVE-2005-2917, CVE-2005-2958
CVE-2005-2959, CVE-2005-2971, CVE-2005-2974
CVE-2005-3068, CVE-2005-3120, CVE-2005-3122
CVE-2005-3123, CVE-2005-3184, CVE-2005-3185
CVE-2005-3241, CVE-2005-3242, CVE-2005-3243
CVE-2005-3244, CVE-2005-3245, CVE-2005-3246
CVE-2005-3247, CVE-2005-3248, CVE-2005-3249
CVE-2005-3258, CVE-2005-3300, CVE-2005-3301
CVE-2005-3313, CVE-2005-3318, CVE-2005-3350
CVE-2005-3388, CVE-2005-3389, CVE-2005-3390
CVE-2005-3393, CVE-2005-3409
Content of this advisory:
1) Solved Security Vulnerabilities:
- openvpn
- lynx
- liby2util
- wget
- kchmviewer
- koffice-wordprocessing
- ethereal
2) Pending Vulnerabilities, Solutions, and Work-Arounds:
- zope
- phpMyAdmin
- libgda
- squid
- php4, php5
- gnump3d
- libungif, giflib
- sudo
- eric
3) Authenticity Verification and Additional Information
______________________________________________________________________________
1) Solved Security Vulnerabilities
To avoid flooding mailing lists with SUSE Security Announcements for minor
issues, SUSE Security releases weekly summary reports for the low profile
vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
or download URLs like the SUSE Security Announcements that are released for
more severe vulnerabilities.
Fixed packages for the following incidents are already available on our FTP
server and via the YaST Online Update.
- openvpn
An openvpn update fixes the following security bugs:
- a malicious or compromised server could exploit a format string
bug in clients to execute arbitrary code (CVE-2005-3393).
- a server in TCP mode could be made to crash due to insufficient
checks for the error code of the accept() system call
(CVE-2005-3409).
SUSE Linux 9.3 and 10.0 are affected.
- lynx
This update fixes a buffer overflow in function HTrjis() that occurs while
processing NNTP headers. An attacker can exploit this remotely by persuading
the victim user to connect to a NNTP server which includes a malformated
article to execute arbitrary code. (CAN-2005-3120)
All SUSE LINUX based products and SLES9 are affected.
- liby2util
The previous liby2util update on SUSE Linux 9.1 was broken. Fixed
packages have been released.
- wget
Updates for SUSE Linux 9.2 that fix CAN-2005-3185 where missing
previously. Update packages are now available.
- kchmviewer
kchmviewer contained a copy of chmlib that was prone to a buffer
overflow (CVE-2005-3318).
SUSE Linux 10.0 is affected.
- koffice-wordprocessing
A buffer overflow in the RTF import filter in koffice was fixed
(CAN-2005-2971 / CESA-2005-005). It allowed remote attackers to
execute code in the koffice process by preparing a special RTF
file.
All SUSE LINUX products and SLD are affected.
- ethereal
A version upgrade to ethereal 0.10.13 fixes several security
related bugs ranging from crashes to arbitrary code execution.
(CVE-2005-3241, CVE-2005-3242, CVE-2005-3243, CVE-2005-3244,
CVE-2005-3245, CVE-2005-3246, CVE-2005-3247, CVE-2005-3248,
CVE-2005-3249, CVE-2005-3184, CVE-2005-3313)
All SUSE LINUX based products are affected.
______________________________________________________________________________
2) Pending Vulnerabilities, Solutions, and Work-Arounds
- zope
Zope honors file inclusion directives in RestructuredText objects
which potentially allowed attackers to execute arbitrary code (Zope
Hotfix 2005-10-09).
Updates are currently being QA tested.
All SUSE LINUX products >= 9.1 and SLES9 are affected.
- phpMyAdmin
We are preparing updates for the following issues:
- multiple cross-site scripting (XSS) bugs (CVE-2005-3301,
CAN-2005-2869, PMASA-2005-5).
- multiple file inclusion vulnerabilities that allowed an attacker
to include arbitrary files (CVE-2005-3300, CVE-2005-3301,
PMASA-2005-5).
All SUSE LINUX products are affected.
- libgda
libgda contains two format string bugs in logging routines. Those
bugs could potentially indirectly lead to arbitrary code execution
via applications that link against libgda and supply data to libgda
(CAN-2005-2958).
Updates are currently beeing QA tested.
All SUSE LINUX products and SLES9 are affected.
- squid
We are preparing updates for the following issues:
- A bug in the NTLM authentication could crash squid (CVE-2005-2917)
- Odd replies of FTP servers could crash squid (CVE-2005-3258)
Updates are currently being QA tested.
All SUSE LINUX based products are affected
- php4, php5
Stefan Esser discovered a cross-site scripting bug in the phpinfo()
function (CVE-2005-3388), a bug that allows an attacker to enable
register_globals (CVE-2005-3389) and a bug that allows an attacker
to overwrite the $GLOBALS array (CVE-2005-3390).
We are preparing updates for these issues.
All SUSE LINUX based products are affected.
- gnump3d
Steve Kemp discovered a cross-site scripting bug (CVE-2005-3122) and
a directory traversal bug (CVE-2005-3123) in gnump3d.
We are preparing updates for these issues.
All SUSE LINUX products are affected.
- libungif, giflib
We are preparing updates for the following issues:
- specially crafted GIF files could crash applications
(CVE-2005-2974).
- specially crafted GIF files could overwrite memory which
potentially allowed to execute arbitrary code (CVE-2005-3350).
Updates are currently being QA tested.
All SUSE LINUX based products are affected.
- sudo
The fix for CVE-2005-2959 further extends the sudo internal
environment variable blacklist to prevent interpretation of those
variables by the bash shell. In our opinion a blacklist based
approach to improve security is doomed to fail. If you use sudo to
grant limited super user access to regular users you should rather
configure sudo to clean the entire environment by setting the
options env_reset and always_set_home. We will therefore not release
security updates for the sole purpose of extending the blacklist.
- eric
Eric project files may contain python code which is run through
eval() by eric. The fix for CVE-2005-3068 does not prevent this.
A project file is some kind of Makefile, executing code in such a
development environment is a natural property. GPG signatures should
be used to validate integrity and authenticity of source releases.
We are therefore not going release security updates for eric.
______________________________________________________________________________
3) Authenticity Verification and Additional Information
- Announcement authenticity verification:
SUSE security announcements are published via mailing lists and on Web
sites. The authenticity and integrity of a SUSE security announcement is
guaranteed by a cryptographic signature in each announcement. All SUSE
security announcements are published with a valid signature.
To verify the signature of the announcement, save it as text into a file
and run the command
gpg --verify <file>
replacing <file> with the name of the file containing the announcement.
The output for a valid signature looks like:
gpg: Signature made <DATE> using RSA key ID 3D25D3D9
gpg: Good signature from "SuSE Security Team