Debian: 'groff' printf format attack

    Date10 Aug 2001
    CategoryDebian
    2064
    Posted ByLinuxSecurity Advisories
    The pic command was vulnerable to a printf format attackwhich made it possible to circumvent the -S option and executearbitrary code.
    
    ------------------------------------------------------------------------
    Debian Security Advisory DSA-072-1                   This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                         Wichert Akkerman
    August 10, 2001
    ------------------------------------------------------------------------
    
    
    Package        : groff
    Problem type   : printf format attack
    Debian-specific: no
    
    Zenith Parse found a security problem in groff (the GNU version of
    troff). The pic command was vulnerable to a printf format attack
    which made it possible to circumvent the -S option and execute
    arbitrary code.
    
    This has been fixed in version 1.15.2-2.
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    
    Debian GNU/Linux 2.2 alias potato
    ---------------------------------
    
      Potato was released for alpha, arm, i386, m68k, powerpc and sparc.
    
      Source archives:
         http://security.debian.org/dists/stable/updates/main/source/groff_1.15.2-2.diff.gz
          MD5 checksum: 80a1f4d1a73206bc39442c59b3298c31
         http://security.debian.org/dists/stable/updates/main/source/groff_1.15.2-2.dsc
          MD5 checksum: 37c101207617f750821362f14c4d70a3
         http://security.debian.org/dists/stable/updates/main/source/groff_1.15.2.orig.tar.gz
          MD5 checksum: 0c87c54b39a71da4ad92a67f13b740a2
    
      Alpha architecture:
         http://security.debian.org/dists/stable/updates/main/binary-alpha/groff_1.15.2-2_alpha.deb
          MD5 checksum: 914c0bd3a63a42f6ad382a83af6809c3
    
      ARM architecture:
         http://security.debian.org/dists/stable/updates/main/binary-arm/groff_1.15.2-2_arm.deb
          MD5 checksum: 86e061ec9c65cd138c809ddf4dc2a32d
    
      Intel IA-32 architecture:
         http://security.debian.org/dists/stable/updates/main/binary-i386/groff_1.15.2-2_i386.deb
          MD5 checksum: cec3f02dd9c9fc020dd93e0437368a25
    
      Motorola 680x0 architecture:
         http://security.debian.org/dists/stable/updates/main/binary-m68k/groff_1.15.2-2_m68k.deb
          MD5 checksum: b06c81a8d23f54eba8e605a5ce9331fc
    
      PowerPC architecture:
         http://security.debian.org/dists/stable/updates/main/binary-powerpc/groff_1.15.2-2_powerpc.deb
          MD5 checksum: b2adb7c67438c511e9d745b87efa1667
    
      Sun Sparc architecture:
         http://security.debian.org/dists/stable/updates/main/binary-sparc/groff_1.15.2-2_sparc.deb
          MD5 checksum: 1e07e5ecbfc7c066397e97bdf23dc014
    
      These packages will be moved into the stable distribution on its next
      revision.
    
    For not yet released architectures please refer to the appropriate
    directory  ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .
    
    --
    ----------------------------------------------------------------------------
    apt-get: deb  http://security.debian.org/ stable/updates main
    dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.