Debian: New librpcsecgss packages fix arbitrary code execution

    Date15 Oct 2007
    CategoryDebian
    2491
    Posted ByLinuxSecurity Advisories
    It has been discovered that the original patch for a buffer overflow in svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5 (CVE-2007-3999, DSA-1368-1) was insufficient to protect from arbitrary code execution in some environments.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1387                    This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                           Florian Weimer
    October 15th, 2007                    http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : librpcsecgss
    Vulnerability  : buffer overflow
    Problem type   : remote
    Debian-specific: no
    CVE ID         : CVE-2007-4743
    
    It has been discovered that the original patch for a buffer overflow in
    svc_auth_gss.c in the RPCSEC_GSS RPC library in MIT Kerberos 5
    (CVE-2007-3999, DSA-1368-1) was insufficient to protect from arbitrary
    code execution in some environments.
    
    The old stable distribution (sarge) does not contain a librpcseggss
    package.
    
    For the stable distribution (etch), this problem has been fixed in
    version 0.14-2etch3.
    
    For the unstable distribution (sid), this problem has been fixed in
    version 0.14-4.
    
    We recommend that you upgrade your librpcsecgss package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss_0.14-2etch3.dsc
        Size/MD5 checksum:     1038 dbb737ea9be3a8c959754d43b63982f4
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss_0.14.orig.tar.gz
        Size/MD5 checksum:   363503 0d4cdee46a98731b1b71e30504589281
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss_0.14-2etch3.diff.gz
        Size/MD5 checksum:     1849 c7078a95bfcf735d6d31c2d5f3ef25cd
    
    Alpha architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_alpha.deb
        Size/MD5 checksum:    36716 ed385368f5108ea22a704a288631c5f6
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_alpha.deb
        Size/MD5 checksum:    57488 93acfd2f2984d657222aca703e58d1a5
    
    AMD64 architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_amd64.deb
        Size/MD5 checksum:    47982 bc12c0c2c58dc51888c7269319dca08b
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_amd64.deb
        Size/MD5 checksum:    34174 376f547b1227b6f8faaf9c1acca32ea1
    
    ARM architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_arm.deb
        Size/MD5 checksum:    31182 3d7ccf54913d51bb1db0724008ad3e9d
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_arm.deb
        Size/MD5 checksum:    43822 904c1a29bd61e225f2d7eb8f6230c367
    
    HP Precision architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_hppa.deb
        Size/MD5 checksum:    36920 cd4f99818fefce5824eaf808bf31fe03
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_hppa.deb
        Size/MD5 checksum:    50996 a962c70ecf318b82c49e67814a50aff1
    
    Intel IA-32 architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_i386.deb
        Size/MD5 checksum:    31308 925e844098880d4f3f4cdc6ae36ddee1
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_i386.deb
        Size/MD5 checksum:    42004 87f60564e6ebf3a0d2a7bd4d5bffe949
    
    Intel IA-64 architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_ia64.deb
        Size/MD5 checksum:    63390 774a0fdb01e0e94e7194edfe7156a0e8
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_ia64.deb
        Size/MD5 checksum:    47070 729964f2405fcc237f1dfcb8ae6640e5
    
    Big endian MIPS architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_mips.deb
        Size/MD5 checksum:    49386 f55502c118efeba50b3b38bad88f6d6c
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_mips.deb
        Size/MD5 checksum:    32302 f1c08ffd0614f188011a27d7ee9b1261
    
    Little endian MIPS architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_mipsel.deb
        Size/MD5 checksum:    50160 e7d887c8bf5f597f3a755dbbe8c409dc
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_mipsel.deb
        Size/MD5 checksum:    32930 633e57cdd675769637f55c04c8e496e3
    
    PowerPC architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_powerpc.deb
        Size/MD5 checksum:    47160 38fd21665791bd6b6bc7b8d66f28f89b
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_powerpc.deb
        Size/MD5 checksum:    34494 da7f562b38579a589fb15736a5e585c7
    
    IBM S/390 architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_s390.deb
        Size/MD5 checksum:    34930 ae3cac28da2073fef0f02bc587747d56
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_s390.deb
        Size/MD5 checksum:    45480 89c63c16c6572437621e217bf64285ea
    
    Sun Sparc architecture:
    
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss3_0.14-2etch3_sparc.deb
        Size/MD5 checksum:    30776 6a70b84b9837c00688044e6ad0d89810
      http://security.debian.org/pool/updates/main/libr/librpcsecgss/librpcsecgss-dev_0.14-2etch3_sparc.deb
        Size/MD5 checksum:    43336 26a3bc069f160803f64014ca0a7550f9
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.