Linux Security
    Linux Security
    Linux Security

    Debian: New sword packages fix arbitrary command execution

    Date 20 Jan 2005
    Posted By Joe Shakespeare
    Ulf Härnhammar discovered that due to missing input sanitising in diatheke, a CGI script for making and browsing a bible website, it is possible to execute arbitrary commands via a specially crafted URL.
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 650-1                     This email address is being protected from spambots. You need JavaScript enabled to view it.                             Martin Schulze
    January 20th, 2005               
    - --------------------------------------------------------------------------
    Package        : sword
    Vulnerability  : missing input sanitising
    Problem-Type   : remote
    Debian-specific: no
    CVE ID         : CAN-2005-0015
    Ulf Härnhammar discovered that due to missing input sanitising in
    diatheke, a CGI script for making and browsing a bible website, it is
    possible to execute arbitrary commands via a specially crafted URL.
    For the stable distribution (woody) this problem has been fixed in
    version 1.5.3-3woody2.
    For the unstable distribution (sid) this problem will be fixed soon.
    We recommend that you upgrade your diatheke package.
    Upgrade Instructions
    - --------------------
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    Debian GNU/Linux 3.0 alias woody
    - --------------------------------
      Source archives:
          Size/MD5 checksum:      612 9204579e3a264d7d43297c1b7bf98438
          Size/MD5 checksum:    21169 c355f97deb2ef2c39b82aec857b15a21
          Size/MD5 checksum:  2389613 055f9c1e7c081a667674d9f4112abf11
      Alpha architecture:
          Size/MD5 checksum:    82154 2c73838e4e5d1112ded21365df2578a3
          Size/MD5 checksum:  1712920 e3914e31b0b0217ac8f227f8730c0ace
          Size/MD5 checksum:    13312 29c89888a4b51b5aa555ff55b0a410ad
          Size/MD5 checksum:   601828 dfcf6f97b2b3eead528e92b5dc387fe6
      ARM architecture:
          Size/MD5 checksum:    56756 0a83537894f73c59aac38b8698d68dc8
          Size/MD5 checksum:   989694 18f31fc2d82aec5b342a62822f6421d8
          Size/MD5 checksum:    13326 f8a405bc39b9e73d84cb42448144b4ec
          Size/MD5 checksum:   298826 53df2455c33de26ddc7f661f1ff74a43
      Intel IA-32 architecture:
          Size/MD5 checksum:    54788 7329737ccfe2988b667bf1cf4d0b684d
          Size/MD5 checksum:   923510 87cbc45e59453e36004331d8a1ba4950
          Size/MD5 checksum:    13320 190147bb90a295003c9bf6ad0e0a48d4
          Size/MD5 checksum:   281460 c0c5beeb00046e67a6fa9089e9d43d14
      Intel IA-64 architecture:
          Size/MD5 checksum:    62174 fbf8fac6dfc7d61a739b3bdb3f499566
          Size/MD5 checksum:  1291474 d38e91788454487c3fc8b40e017fc682
          Size/MD5 checksum:    13308 b24742b3c41724e34669d0b921cb3d27
          Size/MD5 checksum:   333424 7aaaaf076026a95ac0d0bdbe488777fb
      HP Precision architecture:
          Size/MD5 checksum:    62118 2504df74d92b6adb4910a6a4f3452183
          Size/MD5 checksum:  1104178 07328cd8ee7dde27dfed04296e3ae908
          Size/MD5 checksum:    13320 d62ee10092df4e13ad703662fd5ffdda
          Size/MD5 checksum:   321394 ab1a13bf24f55ca743a8c760adebc8e9
      Motorola 680x0 architecture:
          Size/MD5 checksum:    53082 39829e678361864e1da30406d34b63eb
          Size/MD5 checksum:   932564 a1189885065e93581e8467cc85b270cd
          Size/MD5 checksum:    13340 2b3407e4e1f8e272f86d297d6ff73738
          Size/MD5 checksum:   298670 47ec4a13a6a9492deaa50d841366458d
      Big endian MIPS architecture:
          Size/MD5 checksum:    52350 e4c719c9a0dda7691232f30eef22dbde
          Size/MD5 checksum:  1109974 878366a171bca33b56ee9710119412c9
          Size/MD5 checksum:    13332 91fe931443f5ae22621628db2deef543
          Size/MD5 checksum:   256508 82fb17f0ff951a96d406d1f65eac8a26
      Little endian MIPS architecture:
          Size/MD5 checksum:    52126 5e61bca3b51666582fbb182398f0f9bd
          Size/MD5 checksum:  1099316 5de4d4a7a89bc24bb3e50f4bf6edf740
          Size/MD5 checksum:    13346 f0fcbee29448cd9c32d906ecdee962f3
          Size/MD5 checksum:   240420 b71294049ac28ea1fafe85968b6499de
      PowerPC architecture:
          Size/MD5 checksum:    53026 4063714e63bb48f93c16c70be949d2c1
          Size/MD5 checksum:  1000066 7eda6d983cd89dee3543b6db26a3bdfe
          Size/MD5 checksum:    13318 3687a1d751652c987d9e658463e71e9a
          Size/MD5 checksum:   306722 8d01c00d9235925512c46b5e4efe5bfe
      IBM S/390 architecture:
          Size/MD5 checksum:    50260 6dafccc1e39907a9852bb8f73be90c30
          Size/MD5 checksum:   889972 dc0a114eb6df20568623173363c34fab
          Size/MD5 checksum:    13322 520de046e8134166d87d0ea4eb699d1f
          Size/MD5 checksum:   278278 9fcd920f31203c18884a74d3e2b208ad
      Sun Sparc architecture:
          Size/MD5 checksum:    53248 ed0cafc23539322dd589c13d74fef525
          Size/MD5 checksum:   953876 862ce2d7c89eeb445a1348158439838f
          Size/MD5 checksum:    13322 d7db9daeb609981e322caa1549b84015
          Size/MD5 checksum:   281526 2d918e10ef4eba590d5185410e11340d
      These files will probably be moved into the stable distribution on
      its next update.
    - ---------------------------------------------------------------------------------
    For apt-get: deb stable/updates main
    For dpkg-ftp: dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.

    LinuxSecurity Poll

    'Tis the season of giving! How have you given back to the open-source community?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    [{"id":"171","title":"I've contributed to the development of an open-source project.","votes":"11","type":"x","order":"1","pct":34.38,"resources":[]},{"id":"172","title":"I've reviewed open-source code for security bugs.","votes":"6","type":"x","order":"2","pct":18.75,"resources":[]},{"id":"173","title":"I've made a donation to an open-source project.","votes":"15","type":"x","order":"3","pct":46.88,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350

    Please vote first in order to view vote results.


    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.