Stay Secure with the Latest Linux Advisories

security advisorycriticaldebian

Debian 4.0: DSA-1700-1 Critical: Lasso Library Validation Bypass

It was discovered that Lasso, a library for Liberty Alliance and SAML protocols performs incorrect validation of the return value of OpenSSL's DSA_verify() function. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1700-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Moritz Muehlenhoff January 11, 2009 http://www.debian.org/security/faq - ------------------------------------------------------------------------ Package : lasso Vulnerability : incorrect API usage Problem type : local(remote) Debian-specific: no CVE Id(s) : CVE-2009-0050 Debian Bug : 511262 It was discovered that Lasso, a library for Liberty Alliance and SAML protocols performs incorrect validation of the return value of OpenSSL's DSA_verify() function. For the stable distribution (etch), this problem has been fixed in version 0.6.5-3+etch1. For the upcoming stable distribution (lenny) and the unstable distribution (sid), this problem has been fixed in version 2.2.1-2. We recommend that you upgrade your lasso package. Upgrade instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 4.0 alias etch - ------------------------------- Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc. Source archives: Size/MD5 checksum: 7571 1795008d78e35b8e3a098e5f72fabe68 Size/MD5 checksum: 1420093 6263375e5910577258a04882b50d58cd Size/MD5 checksum: 1149a2975d5f40cc77b4416189c91b640626 alpha architecture (DEC Alpha) Size/MD5 checksum: 188988 52db78dd66b6ee7af8e952423a5bae69 Size/MD5 checksum: 202066 25f98352704c905d0ec9e50a876eca5b Size/MD5 checksum: 243412 7f7cc9c581abcb282255437e0347a4a5 Size/MD5 checksum: 199052 7846d19823e3f0f3920e225565612241 Size/MD5 checksum: 102330 3162bda7c4114d1077de147f74fedca2 amd64 architecture (AMD x86_64 (AMD64)) Size/MD5 checksum: 190932 9d0ad6de3244a13c21ffd9c9f84c84cb Size/MD5 checksum: 96332 3826a242c6c8d970d16947da4f9ebad8 Size/MD5 checksum: 197730 2df1a9f5846da409446cf2fe639fdd18 Size/MD5 checksum: 181050 33a215818d3127efe4783f6450a65e38 Size/MD5 checksum: 203192 7bf3acad905bc1d1d3db1dc6a2376fb2 arm architecture (ARM) Size/MD5 checksum: 160002 98cd9c31a9c5cc6e2d00af6994df275f Size/MD5 checksum: 170136 ffdf6a636e0976dc2453c3c4cdde6148 Size/MD5 checksum: 79320 b7e55e0058211a978b081d34200b6dd2 Size/MD5 checksum: 171604 20252678b9734a661bb9d1de85bcc19f Size/MD5 checksum: 162136 27d611c443da457449aae51e1886d850 hppa architecture (HP PA RISC) Size/MD5 checksum: 205932 81450e57634addeaf1184fbd22e77e8a Size/MD5 checksum: 196804 115fb72d48047215dde67725977f4776 Size/MD5 checksum: 107412 3531a223c7c38a90ad18c1cdb305f056 Size/MD5 checksum: 194800 e76b5149eb02bab77a2748e56b1fa607 Size/MD5 checksum: 190720 16abaafbdf73a532c807f4fc08cb826a i386 architecture (Intel ia32) Size/MD5 checksum: 166418 105a00318a2b57dea1c3957c976ba73e Size/MD5 checksum: 184638 b4ba5bb2f5d38d3b60493433425c3a11 Size/MD5 checksum: 182136 594c2da1dfaea16e7f52245b5eed87aa Size/MD5 checksum: 86676 0926b46ed2e93ddf24693fdf61828521 Size/MD5 checksum: 161366 68f12ada6b09b127957371f95f77df77 ia64 architecture (Intel ia64) Size/MD5 checksum: 192958 32455f398eae4f66e7c0826d82e23081 Size/MD5 checksum: 216814 b5a48191d251e59687f8b4baeeba19f7 Size/MD5 checksum: 121722 50a3c1e995450eb0a0f8150cf02a88d3 Size/MD5 checksum: 266790 311b79245a32bb66b30dceea1cb6d3da Size/MD5 checksum: 216200 ad8b63cede6787ae731aee94d7edab16 mips architecture (MIPS (Big Endian)) Size/MD5 checksum: 78310 70edbabaad959ab6a17b676fe0ea03c6 Size/MD5 checksum: 141498 2809cae134e9d1854764975184191798 Size/MD5 checksum: 135898 0c3e46f010c591e99f56eacf57108940 Size/MD5 checksum: 174772 4b6269ed3502850709d2e649aec05851 Size/MD5 checksum: 183986 4e38bdb6f27ec82719a63b2a47a50a22 mipsel architecture (MIPS (Little Endian)) Size/MD5 checksum: 78006 47ed53cb8c5f3dcd0c60bc6f748629dc Size/MD5 checksum: 178412 192198be8b38252e0e9c37c84e3f9129 Size/MD5 checksum: 139602 7d6fba843d9ffbde9c6867e6293b50ef Size/MD5 checksum: 130842 79d8fdde15e1651da4967c132768ef11 Size/MD5 checksum: 173854 a4217a9f17adae1ddb4d1e9002fecb43 powerpc architecture (PowerPC) Size/MD5 checksum: 196058 38b56e6e3ddc7f56567c74ec643fec81 Size/MD5 checksum: 177630 f528eb20a85f706ab9f3f3758f9414f4 Size/MD5 checksum: 87580 87cc0b0cb0f50f80ac0d6a75d3cbb5a5 Size/MD5 checksum: 157740 aba541317a5ea52fc2a9a17e14e96db7 Size/MD5 checksum: 183172 c179334bd068ed62b5453b88b982eeb5 s390 architecture (IBM S/390) Size/MD5 checksum: 162292 891dc34494011b354427ff7797a41e24 Size/MD5 checksum: 190198 706bb4e0969bcc6c3b273dc9344c7da4 Size/MD5 checksum: 161716 711db09fd4150bc1f068f5b5fb1e9dbf Size/MD5 checksum: 96562 157be6e89308bfbf1bb53e30e4d0d8da Size/MD5 checksum: 175634 706adfdb4bc526064399360616de2007 sparc architecture (Sun SPARC/UltraSPARC) Size/MD5 checksum: 179674 09b871dbcaeaf3108bd6860c2fc81363 Size/MD5 checksum: 88132 f2fd28ccab190a99e2398725e4fd8b90 Size/MD5 checksum: 173448 5e1fa2fe243214d922308bf324da7e87 Size/MD5 checksum: 170024 4b80b359d3a1150818c50d92eaa37c5b Size/MD5 checksum: 181308db23cb9d622527c4032d8a98865b828f These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb https://www.debian.org/security/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. Package info: `apt-cache show ' and https://www.debian.org/distrib/packages . The Debian Security Advisory DSA-1700-1 highlights a serious vulnerability in the Lasso library. Users should promptly update their systems to reduce risks associated with this issue.. Lasso Library, Debian Security, API Issues, Critical Updates. . Severity: Critical. LinuxSecurity.com Team

Jan 11, 2009 •Critical Debian