-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1700-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Moritz Muehlenhoff January 11, 2009 https://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : lasso Vulnerability : incorrect API usage Problem type : local(remote) Debian-specific: no CVE Id(s) : CVE-2009-0050 Debian Bug : 511262 It was discovered that Lasso, a library for Liberty Alliance and SAML protocols performs incorrect validation of the return value of OpenSSL's DSA_verify() function. For the stable distribution (etch), this problem has been fixed in version 0.6.5-3+etch1. For the upcoming stable distribution (lenny) and the unstable distribution (sid), this problem has been fixed in version 2.2.1-2. We recommend that you upgrade your lasso package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: https://security.debian.org/pool/updates/main/l/lasso/lasso_0.6.5-3+etch1.diff.gz Size/MD5 checksum: 7571 1795008d78e35b8e3a098e5f72fabe68 https://security.debian.org/pool/updates/main/l/lasso/lasso_0.6.5.orig.tar.gz Size/MD5 checksum: 1420093 6263375e5910577258a04882b50d58cd https://security.debian.org/pool/updates/main/l/lasso/lasso_0.6.5-3+etch1.dsc Size/MD5 checksum: 1149 a2975d5f40cc77b4416189c91b640626 alpha architecture (DEC Alpha) https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_alpha.deb Size/MD5 checksum: 188988 52db78dd66b6ee7af8e952423a5bae69 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_alpha.deb Size/MD5 checksum: 202066 25f98352704c905d0ec9e50a876eca5b https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_alpha.deb Size/MD5 checksum: 243412 7f7cc9c581abcb282255437e0347a4a5 https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_alpha.deb Size/MD5 checksum: 199052 7846d19823e3f0f3920e225565612241 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_alpha.deb Size/MD5 checksum: 102330 3162bda7c4114d1077de147f74fedca2 amd64 architecture (AMD x86_64 (AMD64)) https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_amd64.deb Size/MD5 checksum: 190932 9d0ad6de3244a13c21ffd9c9f84c84cb https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_amd64.deb Size/MD5 checksum: 96332 3826a242c6c8d970d16947da4f9ebad8 https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_amd64.deb Size/MD5 checksum: 197730 2df1a9f5846da409446cf2fe639fdd18 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_amd64.deb Size/MD5 checksum: 181050 33a215818d3127efe4783f6450a65e38 https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_amd64.deb Size/MD5 checksum: 203192 7bf3acad905bc1d1d3db1dc6a2376fb2 arm architecture (ARM) https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_arm.deb Size/MD5 checksum: 160002 98cd9c31a9c5cc6e2d00af6994df275f https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_arm.deb Size/MD5 checksum: 170136 ffdf6a636e0976dc2453c3c4cdde6148 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_arm.deb Size/MD5 checksum: 79320 b7e55e0058211a978b081d34200b6dd2 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_arm.deb Size/MD5 checksum: 171604 20252678b9734a661bb9d1de85bcc19f https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_arm.deb Size/MD5 checksum: 162136 27d611c443da457449aae51e1886d850 hppa architecture (HP PA RISC) https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_hppa.deb Size/MD5 checksum: 205932 81450e57634addeaf1184fbd22e77e8a https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_hppa.deb Size/MD5 checksum: 196804 115fb72d48047215dde67725977f4776 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_hppa.deb Size/MD5 checksum: 107412 3531a223c7c38a90ad18c1cdb305f056 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_hppa.deb Size/MD5 checksum: 194800 e76b5149eb02bab77a2748e56b1fa607 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_hppa.deb Size/MD5 checksum: 190720 16abaafbdf73a532c807f4fc08cb826a i386 architecture (Intel ia32) https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_i386.deb Size/MD5 checksum: 166418 105a00318a2b57dea1c3957c976ba73e https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_i386.deb Size/MD5 checksum: 184638 b4ba5bb2f5d38d3b60493433425c3a11 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_i386.deb Size/MD5 checksum: 182136 594c2da1dfaea16e7f52245b5eed87aa https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_i386.deb Size/MD5 checksum: 86676 0926b46ed2e93ddf24693fdf61828521 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_i386.deb Size/MD5 checksum: 161366 68f12ada6b09b127957371f95f77df77 ia64 architecture (Intel ia64) https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_ia64.deb Size/MD5 checksum: 192958 32455f398eae4f66e7c0826d82e23081 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_ia64.deb Size/MD5 checksum: 216814 b5a48191d251e59687f8b4baeeba19f7 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_ia64.deb Size/MD5 checksum: 121722 50a3c1e995450eb0a0f8150cf02a88d3 https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_ia64.deb Size/MD5 checksum: 266790 311b79245a32bb66b30dceea1cb6d3da https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_ia64.deb Size/MD5 checksum: 216200 ad8b63cede6787ae731aee94d7edab16 mips architecture (MIPS (Big Endian)) https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_mips.deb Size/MD5 checksum: 78310 70edbabaad959ab6a17b676fe0ea03c6 https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_mips.deb Size/MD5 checksum: 141498 2809cae134e9d1854764975184191798 https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_mips.deb Size/MD5 checksum: 135898 0c3e46f010c591e99f56eacf57108940 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_mips.deb Size/MD5 checksum: 174772 4b6269ed3502850709d2e649aec05851 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_mips.deb Size/MD5 checksum: 183986 4e38bdb6f27ec82719a63b2a47a50a22 mipsel architecture (MIPS (Little Endian)) https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_mipsel.deb Size/MD5 checksum: 78006 47ed53cb8c5f3dcd0c60bc6f748629dc https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_mipsel.deb Size/MD5 checksum: 178412 192198be8b38252e0e9c37c84e3f9129 https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_mipsel.deb Size/MD5 checksum: 139602 7d6fba843d9ffbde9c6867e6293b50ef https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_mipsel.deb Size/MD5 checksum: 130842 79d8fdde15e1651da4967c132768ef11 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_mipsel.deb Size/MD5 checksum: 173854 a4217a9f17adae1ddb4d1e9002fecb43 powerpc architecture (PowerPC) https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_powerpc.deb Size/MD5 checksum: 196058 38b56e6e3ddc7f56567c74ec643fec81 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_powerpc.deb Size/MD5 checksum: 177630 f528eb20a85f706ab9f3f3758f9414f4 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_powerpc.deb Size/MD5 checksum: 87580 87cc0b0cb0f50f80ac0d6a75d3cbb5a5 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_powerpc.deb Size/MD5 checksum: 157740 aba541317a5ea52fc2a9a17e14e96db7 https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_powerpc.deb Size/MD5 checksum: 183172 c179334bd068ed62b5453b88b982eeb5 s390 architecture (IBM S/390) https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_s390.deb Size/MD5 checksum: 162292 891dc34494011b354427ff7797a41e24 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_s390.deb Size/MD5 checksum: 190198 706bb4e0969bcc6c3b273dc9344c7da4 https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_s390.deb Size/MD5 checksum: 161716 711db09fd4150bc1f068f5b5fb1e9dbf https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_s390.deb Size/MD5 checksum: 96562 157be6e89308bfbf1bb53e30e4d0d8da https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_s390.deb Size/MD5 checksum: 175634 706adfdb4bc526064399360616de2007 sparc architecture (Sun SPARC/UltraSPARC) https://security.debian.org/pool/updates/main/l/lasso/php4-lasso_0.6.5-3+etch1_sparc.deb Size/MD5 checksum: 179674 09b871dbcaeaf3108bd6860c2fc81363 https://security.debian.org/pool/updates/main/l/lasso/liblasso3_0.6.5-3+etch1_sparc.deb Size/MD5 checksum: 88132 f2fd28ccab190a99e2398725e4fd8b90 https://security.debian.org/pool/updates/main/l/lasso/liblasso-java_0.6.5-3+etch1_sparc.deb Size/MD5 checksum: 173448 5e1fa2fe243214d922308bf324da7e87 https://security.debian.org/pool/updates/main/l/lasso/liblasso3-dev_0.6.5-3+etch1_sparc.deb Size/MD5 checksum: 170024 4b80b359d3a1150818c50d92eaa37c5b https://security.debian.org/pool/updates/main/l/lasso/python-lasso_0.6.5-3+etch1_sparc.deb Size/MD5 checksum: 181308 db23cb9d622527c4032d8a98865b828f These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show' and https://packages.debian.org/
Debian: DSA-1700-1: New lasso packages fix validation bypass
Debian: DSA-1700-1: New lasso packages fix validation bypass
It was discovered that Lasso, a library for Liberty Alliance and SAML protocols performs incorrect validation of the return value of OpenSSL's DSA_verify() function.
