Debian: New nas packages fix multiple remote vulnerabilities
Debian: New nas packages fix multiple remote vulnerabilities
Several vulnerabilities have been discovered in nas, the Network Audio
System.
- ------------------------------------------------------------------------ Debian Security Advisory DSA-1273-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Noah Meyerhans March 27, 2007 - ------------------------------------------------------------------------ Package : nas Vulnerability : several Problem type : remote Debian-specific: no CVE Id(s) : CVE-2007-1543 CVE-2007-1544 CVE-2007-1545 CVE-2007-1546 CVE-2007-1547 BugTraq ID : 23017 Debian Bug : 416038 Several vulnerabilities have been discovered in nas, the Network Audio System. CVE-2007-1543 A stack-based buffer overflow in the accept_att_local function in server/os/connection.c in nas allows remote attackers to execute arbitrary code via a long path slave name in a USL socket connection. CVE-2007-1544 Integer overflow in the ProcAuWriteElement function in server/dia/audispatch.c allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large max_samples value. CVE-2007-1545 The AddResource function in server/dia/resource.c allows remote attackers to cause a denial of service (server crash) via a nonexistent client ID. CVE-2007-1546 Array index error allows remote attackers to cause a denial of service (crash) via (1) large num_action values in the ProcAuSetElements function in server/dia/audispatch.c or (2) a large inputNum parameter to the compileInputs function in server/dia/auutil.c. CVE-2007-1547 The ReadRequestFromClient function in server/os/io.c allows remote attackers to cause a denial of service (crash) via multiple simultaneous connections, which triggers a NULL pointer dereference. For the stable distribution (sarge), these problems have been fixed in version 1.7-2sarge1 For the upcoming stable distribution (etch) and the unstable distribution (sid) these packages have been fixed in version 1.8-4. We recommend that you upgrade your nas package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian 3.1 (stable) - ------------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc. Source archives: https://security.debian.org/pool/updates/main/n/nas/nas_1.7.orig.tar.gz Size/MD5 checksum: 1288569 c9918e9c9c95d587a95b455bbabe3b49 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1.dsc Size/MD5 checksum: 693 2f0821d157ae249adfda1ddcf39bf9aa https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1.diff.gz Size/MD5 checksum: 124076 b057e678fb808ef95666d766944ce498 Architecture independent packages: https://security.debian.org/pool/updates/main/n/nas/nas-doc_1.7-2sarge1_all.deb Size/MD5 checksum: 150478 744cbca330f9f8463a36251836514cc4 alpha architecture (DEC Alpha) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_alpha.deb Size/MD5 checksum: 82560 ac84bfe7e6f04f0693b787b33c5a1890 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_alpha.deb Size/MD5 checksum: 1330046 e8b1709f240ca6ee0c7e893a6d4598ac https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_alpha.deb Size/MD5 checksum: 622528 6d14250da6aab5da4737af8d2f3d4930 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_alpha.deb Size/MD5 checksum: 120098 2efb7c2fd2c6cfbce699789f7b1e9782 amd64 architecture (AMD x86_64 (AMD64)) https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_amd64.deb Size/MD5 checksum: 1291220 019146fc7d079820c088bf1a597a91bf https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_amd64.deb Size/MD5 checksum: 102672 40c936bde0db91e5cef3f90c88c03168 https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_amd64.deb Size/MD5 checksum: 74620 e8d8d3d5ec14dcfdb8285d6eb5e6b67b https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_amd64.deb Size/MD5 checksum: 526904 7cc01f5259953f12f0f82cbd1b6ecc62 arm architecture (ARM) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_arm.deb Size/MD5 checksum: 70894 b55f037fe9266c92d3a3b9650ae750d7 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_arm.deb Size/MD5 checksum: 1201362 99b1f795e47faf04db5a3b9ec8ed3440 https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_arm.deb Size/MD5 checksum: 473996 863cc92b5e937cc44e6f3e13f023a374 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_arm.deb Size/MD5 checksum: 97152 dd196d5474c9e68b9096c44a7d72bf5e hppa architecture (HP PA RISC) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_hppa.deb Size/MD5 checksum: 78114 393d231f6d67274102dff5526043dc57 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_hppa.deb Size/MD5 checksum: 107144 da99e90ee80eb1f1e266c85701d26007 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_hppa.deb Size/MD5 checksum: 1310940 1c94b9c41c36e8255396c9ffd400aee5 https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_hppa.deb Size/MD5 checksum: 570894 084753a5ebc4ea153a56cc18fb784904 i386 architecture (Intel ia32) https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_i386.deb Size/MD5 checksum: 95234 edcc7d8210a2acac10c84547cfa3d2c2 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_i386.deb Size/MD5 checksum: 1189584 20f53c488e517d53e6aa517fd4a2076a https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_i386.deb Size/MD5 checksum: 71866 df4b413ad699008cfe5b96b46aab5d0b https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_i386.deb Size/MD5 checksum: 495476 2571d898d1921adeafa543a1709d0e2a ia64 architecture (Intel ia64) https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_ia64.deb Size/MD5 checksum: 746720 d9a7f324f9d4c562c197fd93b24cd3ab https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_ia64.deb Size/MD5 checksum: 95382 cf266077d4f01eadb95f27ecdad79c3a https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_ia64.deb Size/MD5 checksum: 1325658 3cb330c6a614a2aba983b5a06bc0e70b https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_ia64.deb Size/MD5 checksum: 133454 a4b8eb9bf242d0c5e92da9996099a3c0 m68k architecture (Motorola Mc680x0) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_m68k.deb Size/MD5 checksum: 67186 5b214ce898aa6f629f31eb0efacae4e6 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_m68k.deb Size/MD5 checksum: 1260302 a0132b9f2fa66dd587a39e6bfbca6622 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_m68k.deb Size/MD5 checksum: 88438 f24d7a213264eff51574b4b51dc1e0bc https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_m68k.deb Size/MD5 checksum: 418440 6f0f7e8c7f7b0b948f6efafa84547905 mips architecture (MIPS (Big Endian)) https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_mips.deb Size/MD5 checksum: 1289470 adeb481ca91d7671a549687ad1b39c5a https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_mips.deb Size/MD5 checksum: 72522 6da040afd23c865e6c9e7e6d945d2457 https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_mips.deb Size/MD5 checksum: 550000 b97c0b1c75e957549d20c7c2c9b6be59 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_mips.deb Size/MD5 checksum: 108754 feefdb5bedf589515f2a5ed3b2a0a2a3 mipsel architecture (MIPS (Little Endian)) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_mipsel.deb Size/MD5 checksum: 72440 6e2a76e66b1d68798f1fc5aeac325a6d https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_mipsel.deb Size/MD5 checksum: 1239994 c1628d859aee3dd011e9c1b380f12ddc https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_mipsel.deb Size/MD5 checksum: 550010 4e3be289e9fd903feca4bbdd99bf0996 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_mipsel.deb Size/MD5 checksum: 108672 2baa553b2134c1a5274f210fc5d74502 powerpc architecture (PowerPC) https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_powerpc.deb Size/MD5 checksum: 100542 607cdd05f11daf5d000840f831a0537c https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_powerpc.deb Size/MD5 checksum: 531068 ef8f43c27a398a651a3cff195ef603a3 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_powerpc.deb Size/MD5 checksum: 1439084 cf1e5f85964ed34733cb31532269e543 https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_powerpc.deb Size/MD5 checksum: 74744 fd09f58e22639db4e074cff228c98a37 sparc architecture (Sun SPARC/UltraSPARC) https://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_sparc.deb Size/MD5 checksum: 70474 d527e90baffd8d2829ab4e877344eef0 https://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_sparc.deb Size/MD5 checksum: 96474 2af98815309ed2d313e029dc6676c670 https://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_sparc.deb Size/MD5 checksum: 1295200 23a1e3a875f841023f456dd7e8f8429d https://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_sparc.deb Size/MD5 checksum: 473026 6494ad53d51495b309f5f6b7d122c585 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.