Debian & Ubuntu Security Advisories: CUPS and OpenSSH Vulnerabilities

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.18 (Version 3.0, Release 18). This release includes the brand new Health Center, new packages for FWKNP and PSAD, updated packages and bug fixes, some feature enhancements to Guardian Digital WebTool and the SELinux policy, as well as other new features.

In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database and e-mail security, integrated intrusion detection and SELinux policies and more.

Alin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set of tools for display and conversion of Portable Document Format (PDF) files. The Common Vulnerabilities and Exposures project identifies the following three problems:

advisories/debian/debian-new-xpdf-packages-fix-multiple-vulnerabilities

Inadequate EXIF property validation could lead to invalid memory accesses if executed on a maliciously crafted image, potentially including heap corruption and the execution of arbitrary code.

advisories/debian/debian-new-exiftags-packages-fix-several-vulnerabilities-67098

Several local vulnerabilities have been discovered in Xine, a media player library, allowed for a denial of service or arbitrary code execution, which could be exploited through viewing malicious content. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-libxine-packages-fix-several-vulnerabilities

Several remote vulnerabilities have been discovered in the Iceweasel web browser, an unbranded version of the Firefox browser. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-iceweasel-packages-fix-several-vulnerabilities-60726

The previous update for policyd-weight was unfortunately not complete. Updated packages have been released that fully address the vulnerability. For reference the original advisory follows.

advisories/debian/debian-new-policyd-weight-packages-fix-insecure-temporary-files-13408

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite. Peter Brodersen and Alexander Klink discovered that the autoselection of SSL client certificates could lead to users being tracked, resulting in a loss of privacy.

advisories/debian/debian-new-iceape-packages-fix-several-vulnerabilities-79321

Inadequate EXIF property validation could lead to invalid memory accesses if executed on a maliciously crafted image, potentially including heap corruption and the execution of arbitrary code.

advisories/debian/debian-new-exiftags-packages-fix-several-vulnerabilities-67098

Several remote vulnerabilities have been discovered in Xulrunner, a runtime environment for XUL applications. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-xulrunner-packages-fix-several-vulnerabilities-73165

Chris Howells discovered that policyd-weight, a policy daemon for the Postfix mail transport agent, created its socket in an insecure way, which may be exploited to overwrite or remove arbitary files from the local system.

advisories/debian/debian-new-policyd-weight-packages-fix-insecure-temporary-files-13408

Multiple security problems have been discovered in the Firebird database, which may lead to the execution of arbitrary code or denial of service.

advisories/debian/debian-new-firebird-packages-fix-several-vulnerabilities

Multiple vulnerabilities have been discovered in CUPS, allowing for the remote execution of arbitrary code and a Denial of Service.

A heap-based buffer overflow in CUPS 1.2.x and later was discovered by regenrecht of VeriSign iDenfense that could allow a remote attacker to execute arbitrary code via a crafted CGI search expression (CVE-2008-0047).

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Firefox program, version 2.0.0.13. This update provides the latest Firefox to correct these issues.

This update fixes a few minor issues like a rare crash on searching (#37626), a rare crash when an icon is missing (#37700) and a crash with non existing packages (#36529). We really query local packages with the proper UTF-8 locale.

A stack-based buffer overflow in sarg (Squid Analysis Report Generator) allowed remote attackers to execute arbitrary code via a long Squid proxy server User-Agent header (CVE-2008-1167).

Updated thunderbird packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.Several flaws were found in the processing of some malformed HTML mail content. An HTML mail message containing such malicious content could cause Thunderbird to crash or, potentially, execute arbitrary code as the user running Thunderbird. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-thunderbird-security-update-RHSA-2007-0723-01

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. Two vulnerabilities in the Java Runtime Environment allowed an untrusted application or applet to elevate the assigned privileges. This could be misused by a malicious website to read and write local files or execute local applications in the context of the user running the Java process.

advisories/red-hat/redhat-critical-java-150-ibm-security-update-89380

An updated gnome-screensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux FasTrack 5. When a system used a remote directory service for login credentials, a local attacker able to cause a network outage could cause gnome-screensaver to crash, unlocking the screen.

advisories/red-hat/redhat-moderate-gnome-screensaver-security-update-74196

An updated gnome-screensaver package that fixes a security flaw is now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-gnome-screensaver-security-update-74196

Updated cups packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. A heap buffer overflow flaw was found in a CUPS administration interface CGI script. A local attacker able to connect to the IPP port (TCP port 631) could send a malicious request causing the script to crash or, potentially, execute arbitrary code as the "lp" user. Please note: the default CUPS configuration in Red Hat Enterprise Linux 5 does not allow remote connections to the IPP TCP port

advisories/red-hat/redhat-moderate-cups-security-update-9153

Updated lspp-eal4-config-ibm and capp-lspp-eal4-config-hp packages that fix a security issue are now available for Red Hat Enterprise Linux 5. This update has been rated as having important security impact by the Red Hat Security Response Team. The lspp-eal4-config-ibm and capp-lspp-eal4-config-hp packages contain utilities and documentation for configuring a machine for the Controlled Access Protection Profile, or the Labeled Security Protection Profile. It was discovered that use of the "capp-lspp-config" script results in the "/etc/pam.d/system-auth" file being set to world-writable. Authorized local users who have limited privileges could then exploit this to gain additional access, or to escalate their privileges.

advisories/red-hat/redhat-important-lspp-eal4-config-ibm-and-RHSA-2008-0193-02

This update has been rated as having moderate security impact by the Red Hat Security Response Team.A buffer overflow flaw was discovered in the GIF decoding routines used by CUPS image converting filters "imagetops" and "imagetoraster". An attacker could create a malicious GIF file that could possibly execute arbitrary code as the "lp" user if the file was printed.

advisories/red-hat/redhat-moderate-cups-security-update-9153

New cups packages are available for Slackware 12.0, and -current to fix security issues. The change from CUPS 1.2.x to CUPS 1.3.x was tested here, but if you're on a completely secured internal network these issues may be less of a risk than upgrading. If your IPP port is open to the internet, you'd be advised to upgrade as soon as possible (or firewall the port at the gateway if you're not in need of printer jobs coming in from the internet).

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. Earlier versions of xine-lib suffer from an integer overflow which may lead to a buffer overflow that could potentially be used to gain unauthorized access to the machine if a malicious media file is played back. File types affected this time include .flv, .mov, .rm, .mve, .mkv, and .cak.

New xine-lib packages are available for Slackware 10.0, 10.1, 10.2, 11.0, 12.0, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2008-0073

New seamonkey packages are available for Slackware 11.0, 12.0, and -current to fix security issues. For more information, see: https://www.mozilla.org/en-US/security/known-vulnerabilities/

New mozilla-firefox packages are available for Slackware 10.2, 11.0, 12.0, and -current to fix security issues. For more information, see: https://www.mozilla.org/en-US/security/known-vulnerabilities/

It was discovered that the CUPS administration interface contained a heap- based overflow flaw. A local attacker, and a remote attacker if printer sharing is enabled, could send a malicious request and possibly execute arbitrary code as the non-root user in Ubuntu 6.06 LTS, 6.10, and 7.04. In Ubuntu 7.10, attackers would be isolated by the AppArmor CUPS profile. (CVE-2008-0047)

advisories/ubuntu/ubuntu-cups-vulnerabilities-28950

USN-588-1 fixed vulnerabilities in MySQL. In fixing CVE-2007-2692 for Ubuntu 6.06, additional improvements were made to make privilege checks more restictive. As a result, an upstream bug was exposed which could cause operations on tables or views in a different database to fail. This update fixes the problem.

advisories/ubuntu/ubuntu-mysql-regression

Timo Juhani Lindfors discovered that the OpenSSH client, when port forwarding was requested, would listen on any available address family. A local attacker could exploit this flaw on systems with IPv6 enabled to hijack connections, including X11 forwards.

advisories/ubuntu/ubuntu-openssh-vulnerability-81597