Debian And Mandriva Security Advisories: March 21, 2008 Update

Guardian Digital is happy to announce the release of EnGarde Secure Community 3.0.18 (Version 3.0, Release 18). This release includes the brand new Health Center, new packages for FWKNP and PSAD, updated packages and bug fixes, some feature enhancements to Guardian Digital WebTool and the SELinux policy, as well as other new features.

In distribution since 2001, EnGarde Secure Community was one of the very first security platforms developed entirely from open source, and has been engineered from the ground-up to provide users and organizations with complete, secure Web functionality, DNS, database and e-mail security, integrated intrusion detection and SELinux policies and more.

Tilghman Lesher discovered that database-based registrations are insufficiently validated. This only affects setups, which are configured to run without a password and only host-based authentication.

advisories/debian/debian-new-asterisk-packages-fix-several-vulnerabilities-43808

Several remote vulnerabilities have been discovered in the Iceape internet suite, an unbranded version of the Seamonkey Internet Suite. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-iceape-packages-fix-regression-2711

Several remote vulnerabilities have been discovered in the kdc component of the krb5, a system for authenticating users and services on a network. An unauthenticated remote attacker may cause a krb4-enabled KDC to crash, expose information, or execute arbitrary code. Successful exploitation of this vulnerability could compromise the Kerberos key database and host security on the KDC host.

advisories/debian/debian-new-krb5-packages-fix-multiple-vulnerabilities

Josh Triplett discovered that ikiwiki did not block Javascript in URLs, leading to cross-site scripting vulnerabilities (CVE-2008-0808, CVE-2008-0809).

advisories/debian/debian-new-ikiwiki-packages-fix-cross-site-scripting

Tavis Ormandy discovered that unzip, when processing specially crafted ZIP archives, could pass invalid pointers to the C library's free routine, potentially leading to arbitrary code execution (CVE-2008-0888).

advisories/debian/debian-new-unzip-packages-fix-potential-code-execution

Jesse Ruderman, Kai Engert, Martijn Wargers, Mats Palmgren and Paul Nickerson discovered crashes in the layout engine, which might allow the execution of arbitrary code.

advisories/debian/debian-new-icedove-packages-fix-regression

Several local/remote vulnerabilities have been discovered in the image loading library for the Simple DirectMedia Layer 1.2. The Common Vulnerabilities and Exposures project identifies the following problems:

advisories/debian/debian-new-sdl-image12-packages-fix-arbitrary-code-execution-30287

Julien Cayzac discovered that under certain circumstances lighttpd, a fast webserver with minimal memory footprint, might allow the reading of arbitrary files from the system. This problem could only occur with a non-standard configuration.

advisories/debian/debian-new-lighttpd-packages-fix-arbitrary-file-disclosure

It was discovered that the regex module in Smarty, a PHP templating engine, allows attackers to call arbitrary PHP functions via templates using the regex_replace plugin by a specially crafted search string.

advisories/debian/debian-new-smarty-packages-fix-arbitrary-code-execution

It was discovered that the Horde web application framework permits arbitrary file inclusion by a remote attacker through the theme preference parameter.

advisories/debian/debian-new-horde3-packages-fix-information-disclosure

Micha Lenk discovered that backup-manager, a command-line backup tool, sends the password as a command line argument when calling a FTP client, which may allow a local attacker to read this password (which provides access to all backed-up files) from the process listing.

advisories/debian/debian-new-backup-manager-packages-fix-information-disclosure

Don Armstrong discovered that ldapscripts, a suite of tools to manipulate user accounts in LDAP, sends the password as a command line argument when calling LDAP programs, which may allow a local attacker to read this password from the process listing.

advisories/debian/debian-new-ldapscripts-packages-fix-information-disclosure

Prior to this update, the default configuration for Dovecot used by Debian runs the server daemons with group mail privileges. This means that users with write access to their mail directory by other means (for example, through an SSH login) could read mailboxes owned by other users for which they do not have direct write access (CVE-2008-1199). In addition, an internal interpretation conflict in password handling has been addressed proactively, even though it is not known to be exploitable.

advisories/debian/debian-new-dovecot-packages-fix-privilege-escalation

An error in the usage of the ssl-cert eclass within multiple ebuilds might allow for disclosure of generated SSL private keys.

Multiple security issues have been reported in ViewVC, which can be exploited by malicious people to bypass certain security restrictions.

An insecure temporary file creation vulnerability has been discovered in Adobe Acrobat Reader.

Two vulnerabilities in Dovecot allow for information disclosure and argument injection.

A flaw was discovered in how the Kerberos krb5kdc handled Kerberos v4 protocol packets. An unauthenticated remote attacker could use this flaw to crash the krb5kdc daemon, disclose portions of its memory, or possibly %execute arbitrary code using malformed or truncated Kerberos v4 protocol requests (CVE-2008-0062, CVE-2008-0063).

A memory management flaw was found in the GSSAPI library used by Kerberos that could result in an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code (CVE-2007-5971).

Multiple memory management flaws were found in the GSSAPI library used by Kerberos that could result in the use of already freed memory or an attempt to free already freed memory, possibly leading to a crash or allowing the execution of arbitrary code (CVE-2007-5901, CVE-2007-5971).

Tavis Ormandy of Google Security discovered an invalid pointer flaw in unzip that could lead to the execution of arbitrary code with the privileges of the user running unzip. The updated packages have been patched to correct this issue.

A buffer overflow in the check_snmp plugin allowed remote attackers to cause a denial of service via crafted snmpget replies (CVE-2007-5623). Cross-site scripting vulnerabilities in Nagios allowed remote attackers to inject arbitrary web script or HTML via unknown vectors to unspecified CGI scripts (CVE-2007-5624, CVE-2008-1360).

Jurgen Weigert found a directory traversal vulnerability in fastjar versions prior to 0.93. This vulnerability allows user-assisted attackers to overwrite arbitrary files via a .jar file containing filename with ../ sequences. The updated packages have been patched to correct this issue.

This drakconf update fixes a bug where some icons were hidden when translations contained certain meta characters. It also fixes a few translation errors, and enables visiting the Mandriva Tour from the Mandriva Control Center.

his update fixes three vulnerabilities, two of them are only possible if krb4 support is enabled.

The function emf_multipart_encrypted() that is used to process encrypted messages is vulnerable to format-string bugs. This bug can be abused by a remote attacker to execute arbitrary code by sending a crafted encrypted eMail.

Masaaki Hirose discovered that MySQL could be made to dereference a NULL pointer. An authenticated user could cause a denial of service (application crash) via an EXPLAIN SELECT FROM on the INFORMATION_SCHEMA table. This issue only affects Ubuntu 6.06 and 6.10. (CVE-2006-7232) Alexander Nozdrin discovered that MySQL did not restore database access privileges when returning from SQL SECURITY INVOKER stored routines. An authenticated user could exploit this to gain privileges. This issue does not affect Ubuntu 7.10. (CVE-2007-2692)

advisories/ubuntu/ubuntu-mysql-vulnerabilities-82610

It was discovered that krb5 did not correctly handle certain krb4 requests. An unauthenticated remote attacker could exploit this flaw by sending a specially crafted traffic, which could expose sensitive information, cause a crash, or execute arbitrary code. (CVE-2008-0062, CVE-2008-0063)

advisories/ubuntu/ubuntu-kerberos-vulnerabilities

Multiple cross-site scripting flaws were discovered in mailman. A malicious list administrator could exploit this to execute arbitrary JavaScript, potentially stealing user credentials.

advisories/ubuntu/ubuntu-mailman-vulnerability