Debian: DSA-1716-1: New vnc4 packages fix remote code execution

    Date31 Jan 2009
    CategoryDebian
    26
    Posted ByLinuxSecurity Advisories
    It was discovered that xvnc4viewer, a virtual network computing client software for X, is prone to an integer overflow via a malicious encoding value that could lead to arbitrary code execution.
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1716-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Steffen Joeris
    January 31, 2009                      http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : vnc4
    Vulnerability  : integer overflow
    Problem type   : remote
    Debian-specific: no
    CVE ID         : CVE-2008-4770
    Debian Bug     : 513531
    
    It was discovered that xvnc4viewer, a virtual network computing client
    software for X, is prone to an integer overflow via a malicious
    encoding value that could lead to arbitrary code execution.
    
    For the stable distribution (etch) this problem has been fixed in
    version 4.1.1+X4.3.0-21+etch1.
    
    For the unstable (sid) distribution this problem has been fixed in
    version 4.1.1+X4.3.0-31.
    
    For the testing (lenny) distribution this problem will be fixed soon.
    
    We recommend that you upgrade your vnc4 packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0-21+etch1.diff.gz
        Size/MD5 checksum:    50904 55c92400d7949023c3488dcec680d613
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0.orig.tar.gz
        Size/MD5 checksum: 31536534 b28c43385fe574d612ddbd0b645082f7
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0-21+etch1.dsc
        Size/MD5 checksum:      696 0d0f0e7f58c6440481b8bfa83af8cd63
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_alpha.deb
        Size/MD5 checksum:    19868 56d083c639e24961fcbbf98cec86dd11
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_alpha.deb
        Size/MD5 checksum:   172424 ec5afb4bf93d6988859e0dca63b922a4
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_alpha.deb
        Size/MD5 checksum:  2682410 e2ad2547dda085010c318900786ee935
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_amd64.deb
        Size/MD5 checksum:  2169248 27b31d7391acb4b7d4e98a97a341bcf3
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_amd64.deb
        Size/MD5 checksum:   144462 097687a2626960fcda86fa8df3831151
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_amd64.deb
        Size/MD5 checksum:    18778 68843484c257b04314e141a1bc370443
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_hppa.deb
        Size/MD5 checksum:   181264 ca3758fa85fb049fdd8f965d3e67ed40
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_hppa.deb
        Size/MD5 checksum:  2294922 00482f651a2008cd66f4588ac403cba2
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_hppa.deb
        Size/MD5 checksum:    19490 07ac277452d42f3f5ac8144700109c06
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_i386.deb
        Size/MD5 checksum:  2015342 a1e67da97e85e0ca290e3644b551c686
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_i386.deb
        Size/MD5 checksum:    18640 27cf156a68540519f9efd4b81fd51dff
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_i386.deb
        Size/MD5 checksum:   147628 9cedf57dd52455c76332f585f6c52dc8
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_ia64.deb
        Size/MD5 checksum:    20850 1bc4cf4b52eae3f4df103ef36b13f156
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_ia64.deb
        Size/MD5 checksum:   210896 9f611bbc3397c02056f51b7f3dc7a190
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_ia64.deb
        Size/MD5 checksum:  3436446 a80497194bfa083efc7abb605d63e8e5
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_mips.deb
        Size/MD5 checksum:   167956 a675e51fa9e97a06161aa1a39a0a40e0
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_mips.deb
        Size/MD5 checksum:    19334 ba9c0e77f3127023fb804771bbc02be1
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_mips.deb
        Size/MD5 checksum:  2219206 26797854e72b6e37ae36b3ab25fe9f81
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_mipsel.deb
        Size/MD5 checksum:   166658 f65eb37aac9e5999bfe8357cc5fa6d1a
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_mipsel.deb
        Size/MD5 checksum:    19364 8756098357f1d940067ba336f5fd2412
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_mipsel.deb
        Size/MD5 checksum:  2216976 511790cec54a6fbb4d82b7264faa828c
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_powerpc.deb
        Size/MD5 checksum:    18964 dc9aaf61e3ed3af75ec6721a34837e91
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_powerpc.deb
        Size/MD5 checksum:   150726 72aec061f31ca36cde5de15155566267
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_powerpc.deb
        Size/MD5 checksum:  2175212 dd3910238f15e0b3e5217156fb7a82b1
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_s390.deb
        Size/MD5 checksum:   146930 3944bd5e31b674d5f61df09bf559da7a
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_s390.deb
        Size/MD5 checksum:    18962 9be75dac3eb47ad7fcd3cdf2f791ef29
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_s390.deb
        Size/MD5 checksum:  2037162 90f5428057526f8ddd3597b68640278a
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_sparc.deb
        Size/MD5 checksum:   140638 8c079b90ee4f3fe80b2ce7eac796b2d0
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_sparc.deb
        Size/MD5 checksum:  1976152 695f3eca91cd7f4a8b15546fb9f53e97
      http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_sparc.deb
        Size/MD5 checksum:    18334 b5aa41215f8d4d90849bd7e17e6f3720
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.