MESSAGE
| DATE | 2005-08-19 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [NYLXS - HANGOUT] SuSE 8.2 is gone
|
-----Forwarded Message-----
> From: Marcus Meissner
> To: suse-security-announce-at-suse.com
> Subject: [suse-security-announce] SUSE Security Summary Report SUSE-SR:2005:019
> Date: Fri, 19 Aug 2005 16:24:36 +0200
>
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> ______________________________________________________________________________
>
> SUSE Security Summary Report
>
> Announcement ID: SUSE-SR:2005:019
> Date: Fri, 19 Aug 2005 13:00:00 +0000
> Cross-References: CAN-2005-2102
> CAN-2005-2103
> CAN-2005-1852
> CAN-2004-0519
> CAN-2005-2471
> CAN-2005-1527
> CAN-2005-2301
> CAN-2005-2302
> CAN-2005-2097
> CAN-2005-2215
> CAN-2005-1888
> CAN-2005-2360
> CAN-2005-2361
> CAN-2005-2362
> CAN-2005-2363
> CAN-2005-2364
> CAN-2005-2365
> CAN-2005-2366
> CAN-2005-2367
>
> Content of this advisory:
> 1) Solved Security Vulnerabilities:
> - SUSE Linux 8.2 discontinued.
> - pstopnm use of ghostscript without -dSAFER
> - gaim various security problems
> - kopete gadu denial of service attack
> - squirrelmail various cross site scripting issues
> - awstats remote code execution
> - powerdns denial of service attack
> - gpdf denial of service attack
> - kpdf denial of service attack
> - mediawiki cross site scripting problem
> - wipe left around backup copies
> - ethereal various security issues
> 2) Pending Vulnerabilities, Solutions, and Work-Arounds:
> - acroread plugin buffer overflow
> - various kernel security issues
> - evolution format string problems
> 3) Authenticity Verification and Additional Information
>
> ______________________________________________________________________________
>
> 1) Solved Security Vulnerabilities
>
> To avoid flooding mailing lists with SUSE Security Announcements for minor
> issues, SUSE Security releases weekly summary reports for the low profile
> vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
> or download URLs like the SUSE Security Announcements that are released for
> more severe vulnerabilities.
>
> Fixed packages for the following incidents are already available on our FTP
> server and via the YaST Online Update.
>
> - SUSE Linux 8.2 discontinued
>
> As previously announced we have discontinued support of SUSE Linux 8.2
> on the 31rd of July.
>
> Begin of next week we will now move away the directories for the
> YaST Online Update to free disk space on the mirrors.
>
> The YOU patches and fixed RPMs will remain on:
> ftp://ftp.suse.com/pub/suse/discontinued/i386/8.2/
>
>
> - pstopnm use of ghostscript without -dSAFER
>
> pstopnm in netpbm does not properly use the "-dSAFER" option when
> calling Ghostscript to convert convert a Postscript file into a (1)
> PBM, (2) PGM, or (3) PNM file, which allows external user-complicit
> attackers to execute arbitrary commands.
>
> This is tracked by the Mitre CVE ID CAN-2005-2471.
>
> This problem affects all SUSE Linux based products.
>
> - gaim various security problems
>
> Various memory corruption bugs within the GNOME instant messenger
> client gaim have been fixed:
>
> - An AIM/ICQ malformed filename crash. Mitre CVE ID: CAN-2005-2102 -
> - An AIM/ICQ away-message buffer overflow. Mitre CVE ID: CAN-2005-2103
>
> For the SUSE Linux 9.3 and 9.2 distributions a memory alignment
> bug within libgadu has been fixed too, tracked by the Mitre CVE
> ID CAN-2005-1852.
>
> All SUSE Linux versions including gaim are affected.
>
> - kopete gadu denial of service attack
>
> The KDE instant messenging program 'kopete' was affected by a
> problem within the "gadu" protocol handling. A specially crafted
> 'gadu' message could crash the program.
>
> This is tracked by the Mitre CVE ID CAN-2005-1852. Only SUSE Linux
> 9.3 contained the vulnerable code, no other versions were affected.
>
> - squirrelmail various cross site scripting issues
>
> The web mailer squirrelmail had several more cross site scripting
> problems which were fixed upstream. This patch integrates them into
> our packages.
>
> This is tracked by the Mitre CVE ID CAN-2004-0519.
>
> This issue affects SUSE Linux Professional 9.0 up to 9.3.
>
> - awstats remote code execution
>
> The web statistics program 'awstats' contains an invalid usage
> of the eval() function within the awstats perl script. This
> vulnerability can be used by remote attackers to execute arbitrary
> code.
>
> This issue is tracked by the Mitre CVE ID CAN-2005-1527 and affects
> SUSE Linux 9.0 up to 9.3.
>
> - powerdns denial of service attack
>
> The PowerDNS nameserver was updated to fix the following security
> issues:
>
> - The LDAP backend could fail and not respond anymore.
> This is tracked by the Mitre CVE ID CAN-2005-2301.
>
> - Recursive Queries of unauthorized clients could temporarily block
> queries of authorized clients.
> This is tracked by the Mitre CVE ID CAN-2005-2302.
>
> Only SUSE Linux 9.3 contains the pdns package and is affected.
>
> - gpdf and kpdf denial of service attack
>
> Broken as well as specially crafted PDF files can cause the GNOME
> PDF viewer gpdf and the KDE PDF viewer PDF to create large files
> in /tmp until the filesystem runs out of space.
>
> This is tracked by the Mitre CVE ID CAN-2005-2097.
>
> Only gpdf and kpdf in SUSE Linux 9.3 are affected by this problem.
>
> - MediaWiki cross site scripting problem
>
> Several cross site scripting (XSS) bugs were found and fixed in
> MediaWiki.
>
> - in the page move template, tracked by the Mitre CVE ID
> CAN-2005-2215.
>
> - with HTML attributes In page templates, tracked by the Mitre CVE
> ID CAN-2005-1888.
>
> Only SUSE Linux 9.3 includes MediaWiki and is affected by this
> problem.
>
> - wipe left around backup copies
>
> Due to bad path handling the secure file deletion tool 'wipe' in
> some cases leaves around a copy of the original file.
>
> This problem affects SUSE Linux 9.1 up to 9.3.
>
> - ethereal various security issues
>
> This update upgrades ethereal to version 0.10.12 which has all
> known security bugs fixed. Bugs fixed are tracked by the Mitre CVE
> IDs CAN-2005-2360, CAN-2005-2361, CAN-2005-2362, CAN-2005-2363,
> CAN-2005-2364, CAN-2005-2365, CAN-2005-2366, and CAN-2005-2367.
>
> A detailed list of bugs fixed can be found at:
> http://ethereal.com/appnotes/enpa-sa-00020.html
>
> All SUSE Linux versions were affected by this problem.
> ______________________________________________________________________________
>
> 2) Pending Vulnerabilities, Solutions, and Work-Arounds
>
> - acroread plugin buffer overflow
>
> A buffer overflow was reported in the Acrobat Reader plugin, allowing
> remote attackers to potentially execute code as the viewing user.
>
> This is tracked by the Mitre CVE ID CAN-2005-2470, we are
> currently testing updates.
>
> - various kernel security issues
>
> We are currently preparing a security kernel update for
> the 2.6 lines of kernels fixing currently known issues.
>
> We expect it to be released end of next week.
>
> - evolution format string problems
>
> Format string problems were reported in the evolution mail client.
>
> We are preparing updates for this issue.
> ______________________________________________________________________________
>
> 3) Authenticity Verification and Additional Information
>
> - Announcement authenticity verification:
>
> SUSE security announcements are published via mailing lists and on Web
> sites. The authenticity and integrity of a SUSE security announcement is
> guaranteed by a cryptographic signature in each announcement. All SUSE
> security announcements are published with a valid signature.
>
> To verify the signature of the announcement, save it as text into a file
> and run the command
>
> gpg --verify
>
> replacing with the name of the file containing the announcement.
> The output for a valid signature looks like:
>
> gpg: Signature made using RSA key ID 3D25D3D9
> gpg: Good signature from "SuSE Security Team "
>
> where is replaced by the date the document was signed.
>
> If the security team's key is not contained in your key ring, you can
> import it from the first installation CD. To import the key, use the
> command
>
> gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc
>
> - Package authenticity verification:
>
> SUSE update packages are available on many mirror FTP servers all over the
> world. While this service is considered valuable and important to the free
> and open source software community, the authenticity and integrity of a
> package needs to be verified to ensure that it has not been tampered with.
>
> The internal RPM package signatures provide an easy way to verify the
> authenticity of an RPM package. Use the command
>
> rpm -v --checksig
>
> to verify the signature of the package, replacing with the
> filename of the RPM package downloaded. The package is unmodified if it
> contains a valid signature from build-at-suse.de with the key ID 9C800ACA.
>
> This key is automatically imported into the RPM database (on RPMv4-based
> distributions) and the gpg key ring of 'root' during installation. You can
> also find it on the first installation CD and included at the end of this
> announcement.
>
> - SUSE runs two security mailing lists to which any interested party may
> subscribe:
>
> suse-security-at-suse.com
> - General Linux and SUSE security discussion.
> All SUSE security announcements are sent to this list.
> To subscribe, send an e-mail to
> .
>
> suse-security-announce-at-suse.com
> - SUSE's announce-only mailing list.
> Only SUSE's security announcements are sent to this list.
> To subscribe, send an e-mail to
> .
>
> For general information or the frequently asked questions (FAQ)
> send mail to or
> .
>
> =====================================================================
> SUSE's security contact is or .
> The public key is listed below.
> =====================================================================
> ______________________________________________________________________________
>
> The information in this advisory may be distributed or reproduced,
> provided that the advisory is not modified in any way. In particular, the
> clear text signature should show proof of the authenticity of the text.
>
> SUSE Linux Products GmbH provides no warranties of any kind whatsoever
> with respect to the information contained in this security advisory.
>
> Type Bits/KeyID Date User ID
> pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team
> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key
>
> - -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff
> 4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d
> M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO
> QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK
> XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE
> D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd
> G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM
> CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE
> myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr
> YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD
> wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d
> NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe
> QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe
> LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t
> XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU
> D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3
> 0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot
> 1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW
> cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E
> ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f
> AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E
> Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/
> HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h
> t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT
> tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM
> 523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q
> 2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8
> QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw
> JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ
> 1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH
> ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1
> wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY
> EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol
> 0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK
> CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co
> SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo
> omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt
> A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J
> /LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE
> GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf
> ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT
> ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8
> RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ
> 8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb
> B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X
> 11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA
> 8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj
> qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p
> WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL
> hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG
> BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+
> AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi
> RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0
> zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM
> /3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7
> whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl
> D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz
> dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI
> RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI
> DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE=
> =LRKC
> - -----END PGP PUBLIC KEY BLOCK-----
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
>
> iQEVAwUBQwXq8Xey5gA9JdPZAQKw8wf/diJKq2F/OF8jobHIIhGOJSHJ9UpOJQ0o
> S1iiZaZ5uRYV7TtFA++DXzTSVn68hA7OE2TV89oz9S7dMUzf1i8xb8fhOGla8cAa
> Y6te2qe/cfY/PiyRl6H9n6O3RJrf8WBhiSJ6GNUOPdt6mPOSHpfQNfoYNuyKvyPw
> nS76BWPc42i2CxO7vGS/ITf62L6Mz1sgvYsrqZg4LxHzMXfdtVkddbiFV/HmcZz1
> NUlUEK/m3Tz0dcNjU+IRSO2DkKb2N9EvOY3k3r1s4HRW1DecrSRxv+TPJjGt7nuS
> zqBaqGgoSkH+QQHZNSE5D9vnXNQU/0w9QZVgwVkZf2SlpCpsN9IaRQ==
> =3+tK
> -----END PGP SIGNATURE-----
|
|
