Debian: noffle arbitrary code execution vulnerability

    Date27 Jan 2003
    CategoryDebian
    2504
    Posted ByLinuxSecurity Advisories
    Dan Jacobson noticed a problem in noffle, that leads to a segmentation fault. It is not yet clear whether this problem is exploitable.
    
    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 244-1                     This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                             Martin Schulze
    January 27th, 2003                       http://www.debian.org/security/faq
    - --------------------------------------------------------------------------
    
    Package        : noffle
    Vulnerability  : buffer overflows
    Problem-Type   : remote
    Debian-specific: no
    CVE Id         : CAN-2003-0037
    
    Dan Jacobson noticed a problem in noffle, an offline news server, that
    leads to a segmentation fault.  It is not yet clear whether this
    problem is exploitable.  However, if it is, a remote attacker could
    trigger arbitrary code execution under the user that calls noffle,
    probably news.
    
    For the stable distribution (woody) this problem has been fixed in
    version 1.0.1-1.1.
    
    The old stable distribution (potato) does not contain a noffle
    package.
    
    For the unstable distribution (sid) this problem has been fixed in
    version 1.1.2-1.
    
    We recommend that you upgrade your noffle package.
    
    
    Upgrade Instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 3.0 alias woody
    - --------------------------------
    
      Source archives:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1.dsc
          Size/MD5 checksum:      568 41fead6d752a47cf643b5c103779770d
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1.diff.gz
          Size/MD5 checksum:    15625 f6495c8bce145f1ac5e41feedb035b8f
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1.orig.tar.gz
          Size/MD5 checksum:   125867 fe6b49a43e7fd0341b055d558e1a8202
    
      Alpha architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_alpha.deb
          Size/MD5 checksum:    90250 31ef26b74460b1e872eb830bc986846a
    
      ARM architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_arm.deb
          Size/MD5 checksum:    78840 5bcace22be85c12902d460344f705b58
    
      Intel IA-32 architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_i386.deb
          Size/MD5 checksum:    76410 2363f56a8ec52a321cb963771135271e
    
      Intel IA-64 architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_ia64.deb
          Size/MD5 checksum:   102736 6faa80c92a43875fc71185c70f643ef5
    
      HP Precision architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_hppa.deb
          Size/MD5 checksum:    86038 bc787ecf3a2f507b0c5ca3fbd2a3757f
    
      Motorola 680x0 architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_m68k.deb
          Size/MD5 checksum:    73972 282a82c2066349d6ef9ae761abf1ed55
    
      Big endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_mips.deb
          Size/MD5 checksum:    86824 a3e1514fe172001a5168139b40aa6e21
    
      Little endian MIPS architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_mipsel.deb
          Size/MD5 checksum:    86896 fa2945f320dfbe681165d0efd504ceb5
    
      PowerPC architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_powerpc.deb
          Size/MD5 checksum:    79402 7b554b10c5a006e6892a62904e9d6eb2
    
      IBM S/390 architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_s390.deb
          Size/MD5 checksum:    80188 a4c3e1681de2445fdd94ba7fab4ee8f2
    
      Sun Sparc architecture:
    
         http://security.debian.org/pool/updates/main/n/noffle/noffle_1.0.1-1.1_sparc.deb
          Size/MD5 checksum:    80764 2e81d34a2d6b40dd7c8a71d0b7d63e9a
    
    
      These files will probably be moved into the stable distribution on
      its next revision.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    For dpkg-ftp:  ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"25","type":"x","order":"1","pct":54.35,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":10.87,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"16","type":"x","order":"3","pct":34.78,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.