Linux Advisory Watch: August 1st, 2008

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.19 (Version 3.0, Release 19). This release includes many updated packages and bug fixes and some feature enhancements to the EnGarde Secure Linux Installer and the SELinux policy.

news/vendors-products/engarde-secure-community-3019-now-available

Chris Evans discovered that a buffer overflow in the RC4 functions of libexslt may lead to the execution of arbitrary code.

advisories/debian/debian-new-libxslt-packages-fix-arbitrary-code-execution

This update changes Debian's dnsmasq packages to implement the recommended countermeasure: UDP query source port randomization. This change increases the size of the space from which an attacker has to guess values in a backwards-compatible fashion and makes successful attacks significantly more difficult.

advisories/debian/debian-new-dnsmasq-packages-fix-cache-poisoning

It was discovered that newsx, an NNTP news exchange utility, was affected by a buffer overflow allowing remote attackers to execute arbitrary code via a news article containing a large number of lines starting with a period.

advisories/debian/debian-new-newsx-packages-fix-arbitrary-code-execution

It was discovered that a buffer overflow in MIME decoding can lead to the execution of arbitrary code.

advisories/debian/debian-new-icedove-packages-fix-several-vulnerabilities-99151

Several vulnerabilities have been discovered in the interpreter for the Python language.

advisories/debian/debian-new-python25-packages-fix-several-vulnerabilities

Multiple weaknesses have been identified in PyDNS, a DNS client implementation for the Python language. Dan Kaminsky identified a practical vector of DNS response spoofing and cache poisoning, exploiting the limited entropy in a DNS transaction ID and lack of UDP source port randomization in many DNS implementations. Scott Kitterman noted that python-dns is vulnerable to this predictability, as it randomizes neither its transaction ID nor its source port. Taken together, this lack of entropy leaves applications using python-dns to perform DNS queries highly susceptible to response forgery.

advisories/debian/debian-new-python-dns-packages-fix-dns-response-spoofing

Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some configurations, such as when clamav is used in combination with mail servers, this could cause a system to "fail open," facilitating a follow-on viral attack.

advisories/debian/debian-new-clamav-packages-fix-denial-of-service-32713

In DSA-1603-1, Debian released an update to the BIND 9 domain name server, which introduced UDP source port randomization to mitigate the threat of DNS cache poisoning attacks (identified by the Common Vulnerabilities and Exposures project as CVE-2008-1447)

advisories/debian/debian-new-refpolicy-packages-fix-incompatible-policy

Damian Put discovered a vulnerability in the ClamAV anti-virus toolkit's parsing of Petite-packed Win32 executables. The weakness leads to an invalid memory access, and could enable an attacker to crash clamav by supplying a maliciously crafted Petite-compressed binary for scanning. In some configurations, such as when clamav is used in combination with mail servers, this could cause a system to "fail open," facilitating a follow-on viral attack.

advisories/debian/debian-new-clamav-packages-fix-denial-of-service-32713

A buffer overflow vulnerability in Pan may allow remote attacker to execute arbitrary code.

Multiple vulnerabilities in VLC may allow for the execution of arbitrary code.

A flaw was discovered in licq versions prior to 1.3.6 that allowed a remote attacker to cause a denial of service (crash) via a large number of connections (CVE-2008-1996). The updated packages have been patched to correct this issue.

A vulnerability was found in the SILC toolkit before version 1.1.5 that allowed a remote attacker to cause a denial of service (crash), or possibly execute arbitrary code via long input data (CVE-2008-1227). A vulnerability was found in the SILC toolkit before version 1.1.7 that allowed a remote attacker to execute arbitrary code via a crafted PKCS#2 message (CVE-2008-1552).

A vulnerability was found in how ffmpeg handled STR file demuxing. If a user were tricked into processing a malicious STR file, a remote attacker could execute arbitrary code with user privileges via applications linked against ffmpeg (CVE-2008-3162). The updated packages have been patched to correct this issue.

A race condition was preventing dbus from starting correctly when user authentication was network based (LDAP, etc.). This could prevent other desktop functions from working properly, such as device automounting. This update provides updated dbus and initscript packages that fix this issue. Both packages must be upgraded at the same time.

Tavis Ormandy of the Google Security Team discovered a flaw in how libpng handles zero-length unknown chunks in PNG files, which could lead to memory corruption in applications that make use of certain functions (CVE-2008-1382). The updated packages have been patched to correct this issue.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.16 (CVE-2008-1233, CVE-2008-1234, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237, CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2802, CVE-2008-2803, CVE-2008-2807, CVE-2008-2809, CVE-2008-2811). This update provides the latest Thunderbird to correct these issues. It also provides Thunderbird 2.x for Corporate 3.0 systems.

A number of security vulnerabilities have been discovered and corrected in the latest Mozilla Thunderbird program, version 2.0.0.16 (CVE-2008-1233, CVE-2008-1234, CVE-2008-1235, CVE-2008-1236, CVE-2008-1237, CVE-2008-2785, CVE-2008-2798, CVE-2008-2799, CVE-2008-2802, CVE-2008-2803, CVE-2008-2807, CVE-2008-2809, CVE-2008-2811).

RealPlayer 10.0.9 is vulnerable to a critical security flaw and should no longer be used. A remote attacker could leverage this flaw to execute arbitrary code as the user running RealPlayer. (CVE-2007-5400) This issue is addressed in RealPlayer 11. Red Hat is unable to ship RealPlayer 11 due to additional proprietary codecs included in that version. Therefore, users who wish to continue to use RealPlayer should get an update directly from www.real.com.

advisories/red-hat/redhat-critical-realplayer-security-update-56018

Updated java-1.5.0-ibm packages that fix several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-critical-java-150-ibm-security-update-89380

Updated libxslt packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-libxslt-security-update-RHSA-2008-0649-01

An updated nfs-utils package that fixes a security issue is now available for Red Hat Enterprise Linux 5. A flaw was found in the nfs-utils package build. The nfs-utils package was missing TCP wrappers support, which could result in an administrator believing they had access restrictions enabled when they did not. This update has been rated as having moderate security impact by the RedHat Security Response Team.

advisories/red-hat/redhat-moderate-nfs-utils-security-update-RHSA-2008-0486-01

Updated mysql packages that fix various security issues, several bugs, and add an enhancement are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-moderate-mysql-security-bug-fix-RHSA-2008-0768-01

Updated coreutils packages that fix a security issue are now available for Red Hat Enterprise Linux 4. This update has been rated as having low security impact by the Red Hat Security Response Team.

advisories/red-hat/redhat-low-coreutils-security-update-RHSA-2008-0780-01

An updated vsftpd package that fixes a security issue is now available. The version of vsftpd as shipped in Red Hat Enterprise Linux 3 when used in combination with Pluggable Authentication Modules (PAM) had a memory leak on an invalid authentication attempt. Since vsftpd prior to version 2.0.5 allows any number of invalid attempts on the same connection this memory leak could lead to an eventual DoS.

advisories/red-hat/redhat-moderate-vsftpd-security-update-RHSA-2008-0579-01

Updated kernel packages are now available as part of ongoing support and maintenance of Red Hat Enterprise Linux 4. This is the seventh regular update. A security flaw was found in the Linux kernel Universal Disk Format file system.

advisories/red-hat/redhat-moderate-updated-kernel-packages-for-red-hat-RHSA-2008-0665-01

An updated vsftpd package that fixes a security issue and various bugs is now available. The version of vsftpd as shipped in Red Hat Enterprise Linux 4 when used in combination with Pluggable Authentication Modules (PAM) had a memory leak on an invalid authentication attempt. Since vsftpd prior to version 2.0.5 allows any number of invalid attempts on the same connection this memory leak could lead to an eventual DoS. (CVE-2008-2375)

advisories/red-hat/redhat-moderate-vsftpd-security-and-bug-fix-update-RHSA-2008-0680-01

An updated nss_ldap package that fixes a security issue and several bugs is now available. A race condition was discovered in nss_ldap, which affected certain applications that make LDAP connections, such as Dovecot. This could cause nss_ldap to answer a request for information about one user with the information about a different user. (CVE-2007-5794)

advisories/red-hat/redhat-low-nssldap-security-and-bug-fix-update-59514

Updated rdesktop packages that fix a security issue and a bug are now available for Red Hat Enterprise Linux 4. An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

advisories/red-hat/redhat-moderate-rdesktop-security-and-bug-fix-update-RHSA-2008-0725-01

An updated rdesktop package that fixes a security issue is now available for Red Hat Enterprise Linux 5.An integer underflow and integer signedness issue were discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801, CVE-2008-1803)

advisories/red-hat/redhat-moderate-rdesktop-security-update-97098

Updated rdesktop packages that fix a security issues are now available for Red Hat Enterprise Linux 3.An integer underflow vulnerability was discovered in the rdesktop. If an attacker could convince a victim to connect to a malicious RDP server, the attacker could cause the victim's rdesktop to crash or, possibly, execute an arbitrary code. (CVE-2008-1801)

advisories/red-hat/redhat-moderate-rdesktop-security-update-97098

New libxslt packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. A buffer overflow when processing XSL stylesheets could result in the execution of arbitrary code.

New mtr packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. Upgraded to mtr-0.73. This fixes a minor security bug where a very long hostname in the trace path could lead to an overflow (and most likely just a crash).

New links packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix a security issue when using proxies.Unspecified vulnerability in Links before 2.1, when "only proxies" is enabled, has unknown impact and attack vectors related to providing "URLs to external programs."

New net-snmp packages are available for Slackware 12.0, 12.1, and -current to fix security issues. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0960 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2292

New mozilla-thunderbird packages are available for Slackware 10.2, 11.0, 12.0, 12.1, and -current to fix security issues. More details about the issues may be found on the Mozilla site: https://www.mozilla.org/en-US/security/known-vulnerabilities/thunderbird-2.0/

New httpd packages are available for Slackware 12.0, 12.1, and -current to fix XSS security issues. This release fixes flaws which could allow XSS attacks.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.Patched to fix a possible denial of service when "-v -v" options are used.

New openssl packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues. The Codenomicon TLS test suite uncovered security bugs in OpenSSL. If OpenSSL was compiled using non-default options (Slackware's package is not), then a malicious packet could cause a crash. Also, a malformed TLS handshake could also lead to a crash. Upgraded OpenSSH packages have been provided to make sure that ssh is not broken my the update -- especially if your machine is a remote one, be SURE to upgrade to the new openssh package as well!

New pcre packages are available for Slackware 12.0, 12.1, and -current to fix a security issue. Tavis Ormandy of the Google Security Team found a buffer overflow triggered when handling certain regular expressions. This could lead to a crash or possible execution of code as the user of the PCRE-linked application.

New vim packages are available for Slackware 11.0, 12.0, 12.1, and -current to fix security issues. This fixes several security issues related to the automatic processing of untrusted files.

A flaw was discovered in the browser engine. A variable could be made to overflow causing the browser to crash. If a user were tricked into opening a malicious web page, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2785)

advisories/ubuntu/ubuntu-firefox-and-xulrunner-vulnerabilities-13145

Felipe Andres Manzano discovered that poppler did not correctly initialize certain page widgets. If a user were tricked into viewing a malicious PDF file, a remote attacker could exploit this to crash applications linked against poppler, leading to a denial of service.

advisories/ubuntu/ubuntu-poppler-vulnerability-81822

A flaw was discovered in Thunderbird that allowed overwriting trusted objects via mozIJSSubScriptLoader.loadSubScript(). If a user had Javascript enabled and was tricked into opening a malicious web page, an attacker could execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2803)

advisories/ubuntu/ubuntu-thunderbird-vulnerabilities-67510