- --------------------------------------------------------------------------Debian Security Advisory DSA 1165-1                    security@debian.org
http://www.debian.org/security/                             Martin Schulze
September 1st, 2006                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------Package        : capi4hylafax
Vulnerability  : missing input sanitising
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2006-3126

Lionel Elie Mamane discovered a security vulnerability in
capi4hylafax, tools for faxing over a CAPI 2.0 device, that allows
remote attackers to execute arbitrary commands on the fax receiving
system.

For the stable distribution (sarge) this problem has been fixed in
version 01.02.03-10sarge2.

For the unstable distribution (sid) this problem has been fixed in
version 01.03.00.99.svn.300-3.

We recommend that you upgrade your capi4hylafax package.


Upgrade Instructions
- --------------------wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given at the end of this advisory:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------  Source archives:

          Size/MD5 checksum:      700 ed2b42302da19f397f54be5b6ab2c70d
          Size/MD5 checksum:   233973 cb882036840592b6365e890ba2bef034
          Size/MD5 checksum:   400508 8236290d6b880ee7d5e2fe970648ad6f

  Alpha architecture:

          Size/MD5 checksum:   269704 e89fb2126460ebf99fabd817ccc135e1

  AMD64 architecture:

          Size/MD5 checksum:   205810 4fbbb15d7c0b8fa9548f669756b04c36

  ARM architecture:

          Size/MD5 checksum:   210290 5c6e249abe28be123f35321175c0caea

  Intel IA-32 architecture:

          Size/MD5 checksum:   202278 829c7e7f7aa7b51ea52aba913b84f6e9

  Intel IA-64 architecture:

          Size/MD5 checksum:   341896 020682a6d4bb63d083a05d961bddaaa8

  Motorola 680x0 architecture:

          Size/MD5 checksum:   183464 42cddb1cc2295fd753b50a0f49e9a3f4

  PowerPC architecture:

          Size/MD5 checksum:   213034 6ccc6390878b66462fc4b4c501521025

  Sun Sparc architecture:

          Size/MD5 checksum:   206634 6d82ddf94cd42c355bc125d1d542a1e9


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp:  dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org