Debian: New libnet-dns-perl packages fix several vulnerabilities

    Date11 Mar 2008
    CategoryDebian
    3880
    Posted ByLinuxSecurity Advisories
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1515-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Florian Weimer
    March 11, 2008                        http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : libnet-dns-perl
    Vulnerability  : several
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2007-3377 CVE-2007-3409 CVE-2007-6341
    Debian Bug     : 457445
    
    Several remote vulnerabilities have been discovered in libnet-dns-perl.
    The Common Vulnerabilities and Exposures project identifies the
    following problems:
    
    It was discovered that libnet-dns-perl generates very weak transaction
    IDs when sending queries (CVE-2007-3377).  This update switches
    transaction ID generation to the Perl random generator, making
    prediction attacks more difficult.
    
    Compression loops in domain names resulted in an infinite loop in the
    domain name expander written in Perl (CVE-2007-3409).  The Debian
    package uses an expander written in C by default, but this vulnerability
    has been addressed nevertheless.
    
    Decoding malformed A records could lead to a crash (via an uncaught
    Perl exception) of certain applications using libnet-dns-perl
    (CVE-2007-6341).
    
    For the stable distribution (etch), these problems have been fixed in
    version 0.59-1etch1.
    
    For the old stable distribution (sarge), these problems have been fixed in
    version 0.48-1sarge1.
    
    We recommend that you upgrade your libnet-dns-perl package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.1 alias sarge
    - --------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48.orig.tar.gz
        Size/MD5 checksum:    95754 bd5bab1de250b947a3f00148d426f2e2
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1.diff.gz
        Size/MD5 checksum:     6853 72b2f73855eceafb316f7fde51bc474e
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1.dsc
        Size/MD5 checksum:      916 69ce0c55a0c3876faaee37e78c592ec8
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_alpha.deb
        Size/MD5 checksum:   218240 71fd2aa70013343c56393c39e531c519
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_amd64.deb
        Size/MD5 checksum:   217376 142332f79bb63901d36918d57dd6c3e1
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_arm.deb
        Size/MD5 checksum:   217576 4e3532c27961f8a6c2dc55be1d203203
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_hppa.deb
        Size/MD5 checksum:   217734 7ef76c96fd941eb8448b53e14b9caab7
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_i386.deb
        Size/MD5 checksum:   217226 ee51c0d78f1482161f241fa9a37aba5a
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_ia64.deb
        Size/MD5 checksum:   218274 6bf0d11ccddea933acaf4c5211b3d23d
    
    m68k architecture (Motorola Mc680x0)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_m68k.deb
        Size/MD5 checksum:   217352 659799bf4aff06dc35e10329fcf46038
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_mips.deb
        Size/MD5 checksum:   217448 4c643d81f131bef41dab281d5506aad6
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_mipsel.deb
        Size/MD5 checksum:   217142 6a604d3b26de424c6ffe074bc088b805
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_powerpc.deb
        Size/MD5 checksum:   218728 cfccb7c876b8bef24b448fefac3360c1
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_s390.deb
        Size/MD5 checksum:   217020 269b4d4665f700c01677a903a195515c
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.48-1sarge1_sparc.deb
        Size/MD5 checksum:   217214 512d734a1fd6783ec7319ce1edd9dd85
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1.diff.gz
        Size/MD5 checksum:     7584 bfbdf3851e092853756b78e648b5af29
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59.orig.tar.gz
        Size/MD5 checksum:   137998 d3408875f34e5fa0a313a4a21c70e832
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1.dsc
        Size/MD5 checksum:      915 97a61f446273f49c42348334f5cc9ba8
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_alpha.deb
        Size/MD5 checksum:   253686 f64df4fbbef1d1a4859defc99b78735a
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_amd64.deb
        Size/MD5 checksum:   252906 ac599d5c037f6488e039887081d4d93b
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_arm.deb
        Size/MD5 checksum:   253716 3f9421ad70af6f70dd034c2958d8cd51
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_hppa.deb
        Size/MD5 checksum:   252768 d31f1e9d902efe591c334d29142c993f
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_i386.deb
        Size/MD5 checksum:   252170 0db91e6dd980d9f17dbc86f4684bd92c
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_ia64.deb
        Size/MD5 checksum:   253362 e977ad76777c9e17d45118b42c85860a
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_mips.deb
        Size/MD5 checksum:   252402 b470009b3dac4cb244e47af19047f884
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_mipsel.deb
        Size/MD5 checksum:   251640 43ffbd75ca18b847dd16d47c06e2f97f
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_powerpc.deb
        Size/MD5 checksum:   253538 2aa432f5f20882fa3236375f1fa10e61
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_s390.deb
        Size/MD5 checksum:   251724 0de26882626711d87f84d19c1c6af194
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libn/libnet-dns-perl/libnet-dns-perl_0.59-1etch1_sparc.deb
        Size/MD5 checksum:   251638 3edbe84034df5c69c5a23a08738faa21
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"7","type":"x","order":"1","pct":58.33,"resources":[]},{"id":"88","title":"Should be more technical","votes":"3","type":"x","order":"2","pct":25,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"2","type":"x","order":"3","pct":16.67,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.