Debian: New gnutls13 packages fix potential code execution

    Date20 May 2008
    CategoryDebian
    2492
    Posted ByLinuxSecurity Advisories
    A pre-authentication heap overflow involving oversized session resumption data may lead to arbitrary code execution (CVE-2008-1948).
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1581-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Florian Weimer
    May 20, 2008                          http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : gnutls13
    Vulnerability  : several
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2008-1948, CVE-2008-1949, CVE-2008-1950
    
    Several remote vulnerabilities have been discovered in GNUTLS, an
    implementation of the SSL/TLS protocol suite.
    
    NOTE: The libgnutls13 package, which provides the GNUTLS library, does
    not contain logic to automatically restart potentially affected
    services.  You must restart affected services manually (mainly Exim,
    using "/etc/init.d/exim4 restart") after applying the update, to make
    the changes fully effective.  Alternatively, you can reboot the system.
    
    The following vulnerabilities have been identified:
    
    A pre-authentication heap overflow involving oversized session
    resumption data may lead to arbitrary code execution (CVE-2008-1948).
    
    Repeated client hellos may result in a pre-authentication denial of
    service condition due to a null pointer dereference (CVE-2008-1949).
    
    Decoding cipher padding with an invalid record length may cause GNUTLS
    to read memory beyond the end of the received record, leading to a
    pre-authentication denial of service condition (CVE-2008-1950).
    
    For the stable distribution (etch), these problems have been fixed in
    version 1.4.4-3+etch1.  (Builds for the arm architecture are currently
    not available and will be released later.)
    
    For the unstable distribution (sid), these problems will be fixed soon. 
    
    We recommend that you upgrade your GNUTLS packages.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch1.diff.gz
        Size/MD5 checksum:    19173 12dfc774f73fbfff5a9853255eb4044e
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4.orig.tar.gz
        Size/MD5 checksum:  4752009 c06ada020e2b69caa51833175d59f8b2
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls13_1.4.4-3+etch1.dsc
        Size/MD5 checksum:     1251 f3b7538539a9a255eac70d8ed816e2d2
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-doc_1.4.4-3+etch1_all.deb
        Size/MD5 checksum:  2305156 92f5504bb67e96400b279148ff36954a
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_alpha.deb
        Size/MD5 checksum:   327962 019adc4281f16b70ee32b6fb098b6db4
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_alpha.deb
        Size/MD5 checksum:   547270 baf92f790799abc128bb9efed980b53d
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_alpha.deb
        Size/MD5 checksum:   523926 fadab0e3396daaa51e25aaf764ebff32
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_alpha.deb
        Size/MD5 checksum:   196278 2435a7c5406d9e2ea0b75ab7c06f9ee9
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_amd64.deb
        Size/MD5 checksum:   182806 c6be7ccc98eed7ed736e62494b816698
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_amd64.deb
        Size/MD5 checksum:   538864 a044b7f079d9e26263e019cc097961d2
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_amd64.deb
        Size/MD5 checksum:   314566 339849e531211778332d01e39e806b37
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_amd64.deb
        Size/MD5 checksum:   389130 830c1b21cdfd37cb104c8f5638e8ecd2
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_hppa.deb
        Size/MD5 checksum:   521698 24bc2603d20bd09f1b50dbc284d7c002
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_hppa.deb
        Size/MD5 checksum:   183890 0f5af046360a12c7974af8b8f47c12ca
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_hppa.deb
        Size/MD5 checksum:   312458 bc455a6e70342a891e3e50928df33627
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_hppa.deb
        Size/MD5 checksum:   434892 d6e3aca67b9e59bb3689fda6a479d1d3
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_i386.deb
        Size/MD5 checksum:   358100 a1417f99c68ccfe7fe3baaf5b0a82fc4
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_i386.deb
        Size/MD5 checksum:   281748 1b968342495c6fd9e35974fe7794c66a
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_i386.deb
        Size/MD5 checksum:   524782 4af9debc5ebb2f0afbb552599b04a1ea
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_i386.deb
        Size/MD5 checksum:   172744 1fc64ca700778b7c076fe18078898293
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_ia64.deb
        Size/MD5 checksum:   550132 6cdee2122fcabf7538cbb8a5f8a46dc8
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_ia64.deb
        Size/MD5 checksum:   527970 f79a04ada0467a5e2ad881486f180524
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_ia64.deb
        Size/MD5 checksum:   394710 f3539e1074b5fdf7b4e05a5ae18910d6
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_ia64.deb
        Size/MD5 checksum:   229100 a5b608a5d0b08366d46a7e7b378cb76f
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_mips.deb
        Size/MD5 checksum:   552510 4d33587b3d164660b88e1a0aece6de07
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_mips.deb
        Size/MD5 checksum:   417916 e7b68ae5b9a26748f7ee5c608c6871ad
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_mips.deb
        Size/MD5 checksum:   277948 b4aa68014ab9005a66dc04b8424fe941
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_mips.deb
        Size/MD5 checksum:   181700 810ae6a3d92eb7609a0cfd32db043433
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_mipsel.deb
        Size/MD5 checksum:   541700 657c1167d217eb639cf3655b486fcc62
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_mipsel.deb
        Size/MD5 checksum:   417032 f3beae1dd61de2e3fac5d292fcb1c377
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_mipsel.deb
        Size/MD5 checksum:   277698 48986a326282563af743147dc76f0fd5
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_mipsel.deb
        Size/MD5 checksum:   182654 e86e98f4fbd9659b1b7da3f5ac3ca442
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_powerpc.deb
        Size/MD5 checksum:   184542 dfed7b8ae7a888d65d82e28f4a15d0bd
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_powerpc.deb
        Size/MD5 checksum:   288842 38db064a06a7b073e456425f74392a51
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_powerpc.deb
        Size/MD5 checksum:   538618 9cfd7c7cdf36aea9c445e237156a8898
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_powerpc.deb
        Size/MD5 checksum:   388748 50dd9f5a82dca333bdbd282992488eab
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_s390.deb
        Size/MD5 checksum:   537378 b60c8caef47fa70cc68399db3b1bde5a
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_s390.deb
        Size/MD5 checksum:   311484 363d2d588467086e7fe144acbd420e56
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_s390.deb
        Size/MD5 checksum:   184454 837c2b3b9e82118952a8051d4d52c5ee
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_s390.deb
        Size/MD5 checksum:   380122 6345f76b43ce87b7419d5f519bb5ab98
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13-dbg_1.4.4-3+etch1_sparc.deb
        Size/MD5 checksum:   491030 26a5ca2cb1de39a51c22e90d3894ee87
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls13_1.4.4-3+etch1_sparc.deb
        Size/MD5 checksum:   271018 4fc9a17eb374885cf809575bcecbe8a9
      http://security.debian.org/pool/updates/main/g/gnutls13/gnutls-bin_1.4.4-3+etch1_sparc.deb
        Size/MD5 checksum:   169546 a717fb3d1c0cf0b28069693d6da91495
      http://security.debian.org/pool/updates/main/g/gnutls13/libgnutls-dev_1.4.4-3+etch1_sparc.deb
        Size/MD5 checksum:   378820 7d307f07e38974f276b189eb90599161
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"4","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":14.29,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.