MESSAGE
| DATE | 2005-06-07 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [NYLXS - HANGOUT] [Fwd: [suse-security-announce] SUSE Security Summary Report
|
-----Forwarded Message-----
> From: Marcus Meissner
> To: suse-security-announce-at-suse.com
> Subject: [suse-security-announce] SUSE Security Summary Report SUSE-SR:2005:014
> Date: Tue, 07 Jun 2005 15:35:35 +0200
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> ______________________________________________________________________________
>
> SUSE Security Summary Report
>
> Announcement ID: SUSE-SR:2005:014
> Date: Tue, 07 Jun 2005 14:00:00 +0000
> Cross-References: CAN-2005-1151
> CAN-2005-1152
> CAN-2005-1349
> CAN-2005-0103
> CAN-2005-0104
> CAN-2005-1455
> CAN-2005-1454
> CAN-2004-1456 - CAN-2004-1470
>
> Content of this advisory:
> 1) Solved Security Vulnerabilities:
> - freeradius problems
> - clamav version update
> - squirrelmail cross site scripting and code inclusion problem
> - perl-Convert-UUlib buffer overflow
> - ethereal various security problems
> - info2html cross site scripting
> - qpopper problems
> - libtiff buffer overflow
> - Mozilla Firefox various security problems
>
> 2) Pending Vulnerabilities, Solutions, and Work-Arounds:
> - various kernel security problems
> - postgresql
> 3) Authenticity Verification and Additional Information
>
> ______________________________________________________________________________
>
> 1) Solved Security Vulnerabilities
>
> To avoid flooding mailing lists with SUSE Security Announcements for minor
> issues, SUSE Security releases weekly summary reports for the low profile
> vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
> or download URLs like the SUSE Security Announcements that are released for
> more severe vulnerabilities.
>
> Fixed packages for the following incidents are already available on our FTP
> server and via the YaST Online Update.
>
> - freeradius problems
>
> The FreeRADIUS SQL support is prone to a SQL command injection
> (CAN-2005-1455) and to a buffer overflow (CAN-2005-1454). The buffer
> overflow might be exploitable remotely to execute arbitrary code.
>
> This affects all SUSE Linux products.
>
>
> - clamav version update
>
> The anti virus scan engine "clamav" was updated to the 0.85.1 upstream
> release. This update contains several improvements and bugfixes
> for Clamav. See /usr/share/doc/packages/clamav/ChangeLog for details.
>
> All SUSE Linux products containing clamav are affected.
>
>
> - squirrelmail cross site scripting and code inclusion problem
>
> This update fixes the following security problems:
>
> - Bugs that allowed a cross site scripting attack (CAN-2005-0104)
> - Missing access restrictions on config files
> - A bug that allowed an attacker to execute arbitrary PHP code
> (CAN-2005-0103)
>
> SUSE Linux Box product versions 9.0 up to 9.3 are affected.
>
>
> - perl-Convert-UUlib
>
> This update fixes a buffer overflow in perl-Convert-UUlib that
> could allow an attacker to execute arbitrary code.
>
> This is tracked by the Mitre CVE ID CAN-2005-1349.
>
> - ethereal
>
> Multiple security vulnerabilities have been found in the network
> analyzing tool ethereal.
>
> This update upgrade ethereal to the latest release (0.10.11) which
> has all the security bugs fixed.
>
> A full list of those bugs is on:
> http://www.ethereal.com/appnotes/enpa-sa-00019.html
>
> This updates fixes the issues tracked by the Mitre CVE IDs
> CAN-2004-1456 up to CAN-2004-1470.
>
> All SUSE Linux based products are affected.
>
> - info2html
>
> The info2html document converter had cross site / cross frame
> scripting problems due to insufficient argument escaping.
>
> All SUSE Linux based products are affected.
>
> - qpopper
>
> Qpopper was handling user files while running as root. Qpopper
> could also be tricked into overwriting system files.
>
> Mitre has assigned the CVE IDs CAN-2005-1151 and CAN-2005-1152 to
> these issues.
>
>
> - libtiff
>
> This update fixes a buffer overflow in the BitsPerSample() function.
>
> This problem affects all SUSE Linux based distributions.
>
>
> - Mozilla Firefox
>
> Mozilla Firefox has been upgraded to version 1.0.4, fixing following
> security problems:
>
> MFSA 2005-42: A problem in the install confirmation dialog together
> with a bad fix for MFSA 2005-41 allowed a remote attacker to execute
> arbitrary code with the help of a cross site scripting problem on
> the Mozilla website.
>
> MFSA 2005-43: By causing a frame to navigate back to a previous
> javascript: URL an attacker can inject script into the forward
> site. This site can be controlled by the attacker allowing them
> to steal cookies or sensitive data from that page or to perform
> actions on behalf of that user.
>
> MFSA 2005-44: A variant of MFSA 2005-41 overrides properties on a
> non-DOM node and then substitutes that object for one chrome script
> will access. Most examples involved the attacker synthesizing an
> event targeted at a non-DOM node, and overriding standard DOM node
> properties such as type with references to eval() calls or Script()
> objects.
>
> This affects SUSE Linux 9.0, 9.1, 9.2 and Novell Linux Desktop 9.
> ______________________________________________________________________________
>
> 2) Pending Vulnerabilities, Solutions, and Work-Arounds
>
> - various kernel security problems
>
> Various security problems were found in both the 2.4 and 2.6 Linux
> kernels.
>
> We are currently testing updates for all current issues and will
> be releasing them shortly.
>
> All SUSE Linux based products are affected.
>
>
> - postgresql
>
> Two security errors in PostgreSQL may allow an unprivileged database
> user to crash the backend process or allow an unprivileged user to
> gain the privileges of a database superuser.
>
> To fix those problems please carefully read the instructions on
> http://www.postgresql.org/about/news.315
>
> This is tracked by the Mitre CVE IDs CAN-2005-1409 and CAN-2005-1410
>
> All SUSE LINUX based products except for SLES8 are affected.
> ______________________________________________________________________________
>
> 3) Authenticity Verification and Additional Information
>
> - Announcement authenticity verification:
>
> SUSE security announcements are published via mailing lists and on Web
> sites. The authenticity and integrity of a SUSE security announcement is
> guaranteed by a cryptographic signature in each announcement. All SUSE
> security announcements are published with a valid signature.
>
> To verify the signature of the announcement, save it as text into a file
> and run the command
>
> gpg --verify
>
> replacing with the name of the file containing the announcement.
> The output for a valid signature looks like:
>
> gpg: Signature made using RSA key ID 3D25D3D9
> gpg: Good signature from "SuSE Security Team "
>
> where is replaced by the date the document was signed.
>
> If the security team's key is not contained in your key ring, you can
> import it from the first installation CD. To import the key, use the
> command
>
> gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
>
> - Package authenticity verification:
>
> SUSE update packages are available on many mirror FTP servers all over the
> world. While this service is considered valuable and important to the free
> and open source software community, the authenticity and integrity of a
> package needs to be verified to ensure that it has not been tampered with.
>
> The internal RPM package signatures provide an easy way to verify the
> authenticity of an RPM package. Use the command
>
> rpm -v --checksig
>
> to verify the signature of the package, replacing with the
> file name of the RPM package downloaded. The package is unmodified if it
> contains a valid signature from build-at-suse.de with the key ID 9C800ACA.
>
> This key is automatically imported into the RPM database (on RPMv4-based
> distributions) and the gpg key ring of 'root' during installation. You can
> also find it on the first installation CD and included at the end of this
> announcement.
>
> - SUSE runs two security mailing lists to which any interested party may
> subscribe:
>
> suse-security-at-suse.com
> - General Linux and SUSE security discussion.
> All SUSE security announcements are sent to this list.
> To subscribe, send an e-mail to
> .
>
> suse-security-announce-at-suse.com
> - SUSE's announce-only mailing list.
> Only SUSE's security announcements are sent to this list.
> To subscribe, send an e-mail to
> .
>
> For general information or the frequently asked questions (FAQ)
> send mail to or
> .
>
> =====================================================================
> SUSE's security contact is or .
> The public key is listed below.
> =====================================================================
> ______________________________________________________________________________
>
> The information in this advisory may be distributed or reproduced,
> provided that the advisory is not modified in any way. In particular, the
> clear text signature should show proof of the authenticity of the text.
>
> SUSE Linux Products GmbH provides no warranties of any kind whatsoever
> with respect to the information contained in this security advisory.
>
> Type Bits/KeyID Date User ID
> pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team
> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key
>
> - -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff
> 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d
> M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO
> QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK
> XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE
> D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd
> G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM
> CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE
> myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr
> YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD
> wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d
> NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe
> QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe
> LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t
> XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU
> D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3
> 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot
> 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW
> cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E
> ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f
> AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E
> Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/
> HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h
> t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT
> tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM
> 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q
> 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8
> QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw
> JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ
> 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH
> ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1
> wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY
> EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol
> 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK
> CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co
> SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo
> omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt
> A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J
> /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE
> GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf
> ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT
> ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8
> RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ
> 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb
> B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X
> 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA
> 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj
> qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p
> WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL
> hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG
> BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+
> AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi
> RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0
> zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM
> /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7
> whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl
> D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz
> dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI
> RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI
> DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE=
> =LRKC
> - -----END PGP PUBLIC KEY BLOCK-----
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (GNU/Linux)
>
> iQEVAwUBQqWiWXey5gA9JdPZAQKqjwf/ezE84z1MiX0T5b/LDed3mvYZLfDGQ5V9
> iuVQqp6P8UEQujvWGn4CNMBTvBL+ba8va5Y76GxaCPw6YStKfClAcqyZcn0VmrvH
> C5VXlb2rc51TG9hjelm1Qv1MMCO9lEK/NHJ/yVx8st2ea/hLGqgQvY+e5x674T0q
> u6S4Or4SwDlssEZ+JHIDj6xMGm3Z8ImVhiIWqrBG+RIdOL+Uq6p3kS9kdATRjzgH
> +YaCY6d4QNAI4Dg6FKlmZQdXlnSlzre2WhIjjxhwl+QU9ikrp4SRvgfu+FO6xmg3
> jv490pxOzaq1IKtkuyS54Bees6+IgSpyWpW+LdQ1Al9p+Z07grF1Hw==
> =McNV
> -----END PGP SIGNATURE-----
|
|
