Re: [gentoo-security] [GLVP 200403-01] Gentoo Linux Pending Vulnerabilities

[David R. Bergstein]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Tobias Weisserth wrote:

| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
| Gentoo Linux Pending Vulnerabilities                     GLVP 200403-01
| Unofficial Announcement
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|                                                      glvp@×××××××××.org
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
|
| Abstract: This email is a compilation of known but unresolved
| vulnerabilities and security issues in Gentoo Linux. This GLPV email
| will be issued each Saturday as a reminder and warning for Gentoo users
| about unresolved security critical bugs of packages in the Gentoo
| Portage tree. This is an unofficial email, not associated with the
| Gentoo Linux security team. Since I am far from perfect, this mail may
| contain errors. Please report them if you spot them.
|

Tobias,

First of all, I want to thank you for your proactive effort to get these
~ security vulnerabilities addressed within the gentoo community.  In
that light I wanted to let you know about a problem with the first
report that you  posted to gentoo-security.

There seems to be an issue with the way this report is being transmitted
by your mail client (Ximian evolution).  Although your gpg signature is
verifying correctly from my Mozilla 1.6 client, the "id=" portion of the
gentoo bugzilla URLs seem to have extra information that is rendering
the URLs as invalid.  This also appears to be occurring in several other
URLs that have the "=" sign included.

You can see samples of this in the text quoted below from my end.

Regards,

- - David

- --
David R. Bergstein
Systems Engineer and Blues Musician
http://home.comcast.net/~dbergstein
Heart of Blue - bookings on-line at http://www.heartofblue.com
OpenPGP Public Key 0xE1F138CA - For info see http://www.gnupg.org
http://home.comcast.net/~dbergstein/gpg/dbergstein.asc
Key fingerprint = C86E CA2A 4171 AC73 91D7  3DCE 8832 D764 E1F1 38CA

"Beware of bugs in the above code; I have only proved it correct, not
tried it."
		-- Donald Knuth


|
| Comments, suggestions and reports about errors are welcome at
| glpv@×××××××××.org
|
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
|
| *****************
| Package: Linux kernel
| Versions: 2.2 up to and including 2.2.25, 2.4 up to to and including
| 2.4.24, 2.6 up to to and including 2.6.2
| Subject: Linux kernel do_mremap VMA limit local privilege escalation
| vulnerability
| Risk: critical
| Date: 01/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42024
| Cross Reference:
| http://isec.pl/vulnerabilities/isec-0014-mremap-unmap.txt
|
| Description:
|
| See the cross reference.
|
| *****************
|
| *****************
| Package: Ethereal
| Versions: 0.8.14 - 0.10.2
| Subject: Multiple (13) Ethereal remote overflows discovered=20
| Risk: critical
| Date: 23/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45543
| Cross Reference: http://security.e-matters.de/advisories/032004.html
|
| Description:
|
| See the cross reference.
|
| *****************
|
| *****************
| Package: xfsdump
| Versions: ?
| Subject: xfsdump creates files insecurely
| Risk: critical
| Date: 10/04/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D19406
| Cross Reference:
| ftp://patches.sgi.com/support/free/security/advisories/20030404-01-P
|
| Description:
|
| xfsdq in xfsdump does not create quota information files securely, which
| allows local users to gain root privileges.
|
| *****************
|
| *****************
| Package: Firebird
| Versions: ?
| Subject: Environment Variable Buffer Overflow Vulnerability
| Risk: critical
| Date: 10/05/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D20837
| Cross Reference: http://securityfocus.com/bid/7546/info/
|
| Description:
|
| Interbase is a database distributed and maintained by Borland. It is
| available for Unix and Linux operating systems. As Firebird is based on
| Borland/Inprise Interbase source code, it is very likely that Interbase
| is prone to this issue also.
|
| A buffer overflow has been discovered in the setuid root program
| gds_inet_server, packaged with Firebird. This problem could allow a
| local user to execute the program with strings of arbitrary length. By
| using a custom crafted string, the attacker could overwrite stack
| memory, including the return address of a function, and potentially
| execute arbitrary code as root.
|
| *****************
|
| *****************
| Package: imagemagick
| Versions: ?
| Subject: insecure temporary file
| Risk: low/medium
| Date: 27/06/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D24001
| Cross Reference: http://www.debian.org/security/2003/dsa-331
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: OpenLDAP
| Versions: ?
| Subject: Denial of Service and other (non-security) fixes=20
| Risk: critical
| Date: 04/07/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D26728
| Cross Reference: http://www.openldap.org/its/index.cgi?findid=3D2390
|
| Description:
|
| A failed password extended operation (password EXOP) can cause openldap
| to, if using the back-ldbm backend, attempt to free memory which was
| never allocated, resulting in a segfault. The back-bdb backend, on the
| other hand, has a memory leak in the same code. Both conditions can be
| triggered remotely.
|
| See the Bugzilla entry for more information.
|
| *****************
|
| *****************
| Package: Gentoo Portage
| Versions: ?
| Subject: emerge security - running as root and digital signatures
| Risk: medium/high
| Date: 08/02/2002
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D5902
| Cross Reference: none
|
| Description:
|
| Running emerge as root is only necessary for the merge step. Unpacking,
| setup and compilation should be done as a normal user (say, "nobody").
| Merging should never overwrite an existing file without user
| authorisation.
|
| At the moment there are a couple of ways to get root from portage:
|
| 1) through a trojaned build process
| 2) through a trojaned source that gets installed and executed by root
|
| Running the build process as a normal user avoids 1). Not overwriting
| exist=
| ing files avoids 2), unless the user is installing some new root
| daemon/program, then they're screwed anyway.
|
| *****************
|
| *****************
| Package: scorched3d
| Versions: 36.2 and ?
| Subject: format string crashes server and client
| Risk: low/medium (denial of service)
| Date: 24/01/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D39302
| Cross Reference: none
|
| Description:
|
| games-strategy/scorched3d-36.2 suffers from a format string problem that
| crashes   clients and servers. If this is used while playing standalone,
| the client will crash. If this is used while playing on a server, the
| server will crash, and all clients will be disconnected.
|
| *****************
|
| *****************
| Package: 8139too driver
| Versions: ?
| Subject: 8139too driver icmp leak
| Risk: high
| Date: 01/06/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D24661
| Cross Reference:
| http://www.atstake.com/research/advisories/2003/a010603-1.txt
|
| Description:
|
| Multiple platform ethernet Network Interface Card (NIC) device
| drivers incorrectly handle frame padding, allowing an attacker to view
| slices of previously transmitted packets or portions of kernel memory.
| This vulnerability is the result of incorrect implementations of RFC
| requirements and poor programming practices, the combination
| of which results in several variations of this information leakage
| vulnerability.
|
| *****************
|
| *****************
| Package: pam
| Versions: ?
| Subject: pam_console setup broken
| Risk: critical
| Date: 23/10/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D31877
| Cross Reference: none
|
| Description:
|
| Reproducible: Always
| Steps to Reproduce:
| 1. login in on on a virtual terminal as normal user
| 2. check permissions on pam_console managed devices
|    for example:
|    ls -l /dev/floppy/0
| 3. press <Ctrl><Alt><Del>
| 4. wait for comp to reboot
| 5. login on on any virtual terminal as root
| 6. repeat step 2
|
| Actual Results:
| /dev/floppy/0 is still owned by the last logged in user!
| same problem with serial ports!
| same problem with cdroms/zips/usb-storage devices/...
| same prob with all devices managed by pam_console!!!
|
| Expected Results:
| devices should have ownership from devfsd.conf or root:root!
|
| *****************
|
| *****************
| Package: FreeRadius
| Versions: <=3D 0.9.3
| Subject: rlm_smb module stack overflow vulnerability
| Risk: critical
| Date: 26/11/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D34424
| Cross Reference: http://www.s-quadra.com/advisories/Adv-20031126.txt
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: irssi
| Versions: 0.8.9 and ?, x86 not affected
| Subject: remotely crash another user's irssi client
| Risk: low/medium
| Date: 11/12/2203
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D35614
| Cross Reference: none
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| *****************
| Package: nscd
| Versions: ?
| Subject: nscd dns spoof attack
| Risk: critical
| Date: 01/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40067
| Cross Reference: none
|
| Description:
|
| nscd will reverse an IP address and later use the forward of it for
| lookups allowing for spoof attack which can be used to gather passwords
| and other data.
|
| *****************
|
| *****************
| Package: xscreensaver
| Versions: 4.14 and ?
| Subject: file in /tmp, symlink attack
| Risk: high/critical
| Date: 11/02/2204
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D41253
| Cross Reference: none
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| *****************
| Package: metamail
| Versions: 2.2, 2.4, 2.5, 2.6, 2.7, possibly others
| Subject: format string bugs and buffer overflows
| Risk: critical
| Date: 18/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42133
| Cross Reference:
|
http://lists.netsys.com/pipermail/full-disclosure/2004-February/017539.html
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: msyslog
| Versions: !=3D 1.09d or 1.08f
| Subject: buffer overflows
| Risk: critical
| Date: 10/04/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42963
| Cross Reference:
| http://sourceforge.net/forum/forum.php?forum_id=3D267918
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| *****************
| Package: monit
| Versions: < 4.1.1
| Subject: remote vulnerability
| Risk: critical
| Date: 07/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D43967
| Cross Reference: http://www.tildeslash.com/monit/
|
| Description:
|
| No description available.
|
| *****************
|
| *****************
| Package: Unreal engine
| Versions: ?
| Subject: Format string bug in EpicGames Unreal engine
| Risk: critical
| Date: 10/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D44351
| Cross Reference:
| http://www.securityfocus.com/archive/1/356904/2004-03-08/2004-03-14/0
|
| Description:
|
| The problem is a format string bug in the Classes management.
| Each time a client connects to a server it sends the names of the
| objects it uses (called classes).
|
| If an attacker uses a class name containing format parameters (as %n,
| %s and so on) he will be able to crash or also to execute malicious
| code on the remote server.
|
| *****************
|
| *****************
| Package: clamav
| Versions: < 0.70-rc
| Subject: RAR DOS vulnerability
| Risk: critical
| Date: 22/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45357
| Cross Reference: http://secunia.com/advisories/11177/
|
| Description:
|
| A vulnerability has been discovered in Clam AntiVirus, which can be
| exploited by malicious people to cause a DoS (Denial-of-Service).
|
| An unspecified error within the processing of certain RAR archives (e.g.
| some of those generated by the Bagle virus) may cause a crash.
|
| *****************
|
| *****************
| Package: GNU Automake
| Versions: < 1.8.3
| Subject: Insecure Temporary Directory Creation Symbolic Link
| Vulnerability
| Risk: high/critical
| Date: 08/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45646
| Cross Reference: http://www.securityfocus.com/bid/9816/info/
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: apache, mod_cgi
| Versions: 2.0.47
| Subject: Apache 2.0.47 & mod_cgi: denial of service
| Risk: critical
| Date: 31/07/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D29893
| Cross Reference:
| http://nagoya.apache.org/bugzilla/show_bug.cgi?id=3D22030
|
| Description:
|
| If a cgi script under mod_cgi outputs more than 4096 bytes of stderr
| before it finishes writing to and closing its stdout, the write() in the
| cgi script containing the 4097th byte of stderr will hang indefinitely,
| hanging the script's execution.
|
| This appears to be cause by the fact that mod_cgi reads all stdout
| output first, and then begins reading stderr output.  APR's file_io
| which is handling the streams will only buffer 4096 characters before
| further writes by the script to stderr will hang, waiting for mod_cgi to
| read some of the data from the stream via APR file_io.
|
| *****************
|
| *****************
| Package: courier-imap
| Versions: see cross reference
| Subject: Multiple Remote Buffer Overflow Vulnerabilities
| Risk: critical
| Date: 11/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45584
| Cross Reference: http://www.securityfocus.com/bid/9845/info/
|
| Description:
|
| Multiple buffer overflow vulnerabilities have been identified in Courier
| MTA, Courier SqWebMail, and Courier-IMAP. These vulnerabilities may
| allow a remote attacker to execute arbitrary code on a vulnerable system
| in order to gain unauthorized access.
|
| *****************
|
| *****************
| Package: Mozilla
| Versions: < 1.6
| Subject: Cross-domain exploit on zombie document with event handlers
| Risk: critical
| Date: 25/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D43072
| Cross Reference: http://www.securityfocus.com/archive/1/355233
|
| Description:
|
| When linking to a new page it is still possible to interact with the old
| page before the new page has been successfully loaded (zombie document).
| Any javascript events fired will be invoked in the context of the new
| page, making cross site scripting possible if the pages belong to
| different domains.
|
| *****************
|
| *****************
| Package: fetchmail
| Versions: <=3D 6.2.4
| Subject: email denial of service
| Risk: low/medium
| Date: 16/10/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D37717
| Cross Reference: http://xforce.iss.net/xforce/xfdb/13450
|
| Description:
|
| Fetchmail is a full-featured remote mail-retrieval and forwarding
| utility for Unix that uses the POP3 and IMAP protocols. Fetchmail
| version 6.2.4 is vulnerable to a denial of service attack. By sending a
| specially-crafted email, a remote attacker can cause the program to
| crash.
|
| *****************
|
| *****************
| Package: RealOne Player and RealPlayer 8
| Versions: ?
| Subject: arbitrary code execution
| Risk: critical
| Date: 04/02/2004?
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40469
| Cross Reference:
| http://www.service.real.com/help/faq/security/040123_player/EN/
|
| Description:
|
| RealNetworks, Inc. has recently been made aware of security
| vulnerabilities that could potentially allow an attacker to run
| arbitrary code on a user's machine.
|
| The specific exploits were:
|
|       * Exploit 1: To operate remote Javascript from the domain of the
|         URL opened by a SMIL file or other file.
|       * Exploit 2: To fashion RMP files which allow an attacker to
|         download and execute arbitrary code on a user's machine.
|       * Exploit 3: To fashion media files to create Buffer Overrun
| errors.
|
| While we have not received reports of anyone actually being attacked
| with this exploit, all security vulnerabilities are taken very seriously
| by RealNetworks. RealNetworks has found and fixed the problem.
|
| *****************
|
| *****************
| Package: mpg123
| Versions: ?
| Subject: heap overflow, arbitrary code execution
| Risk: high
| Date: 06/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D40631
| Cross Reference: http://www.debian.org/security/2004/dsa-435
|
| Description:
|
| A vulnerability was discovered in mpg123, a command-line mp3 player,
| whereby a response from a remote HTTP server could overflow a buffer
| allocated on the heap, potentially permitting execution of arbitrary
| code with the privileges of the user invoking mpg123.  In order for
| this vulnerability to be exploited, mpg321 would need to request an
| mp3 stream from a malicious remote server via HTTP.
|
| *****************
|
| *****************
| Package: Samba, Linux kernel
| Versions: Samba 3.x, Linux kernel 2.6.x
| Subject: Samba 3.x + kernel 2.6.x local root vulnerability
| Risk: high
| Date: 09/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D41800
| Cross Reference: http://www.securityfocus.com/archive/1/353217
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: uudeview
| Versions: < 0.5.20
| Subject: buffer overflow vulnerabilities, remote arbitrary code
| execution
| Risk: high
| Date: 02/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D44859
| Cross Reference:
| http://www.securitytracker.com/alerts/2004/Mar/1009291.html
|
| Description:
|
| It is reported that a remote user can create a malicious MIME file
| (.mim, .uue, .uu, .b64, .bhx, .hqx, and .xxe extensions) that, when
| processed by a target user, will cause UUDeview to crash or execute
| arbitrary code. The code will run with the privileges of the target user
| or application.
|
| *****************
|
| *****************
| Package: MySQl
| Versions: all
| Subject: Symlink bug / tmpfile bug
| Risk: low/medium
| Date: 24/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45727
| Cross Reference: http://nettwerked.mg2.org/advisories/mysqlbug
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: pwlib
| Versions: < 1.6.0
| Subject: multiple vulnerabilities allow remote DoS attacks and possibly
| execution of arbitrary code
| Risk: high
| Date: 13/01/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45846
| Cross Reference:
| http://www.postincrement.com/openh323/nissc_vulnerabilty.html
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: iproute
| Versions: ?
| Subject: local denial of service attack
| Risk: medium/high
| Date: 24/11/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D34294
| Cross Reference: http://rhn.redhat.com/errata/RHSA-2003-316.html
|
| Description:
|
| Herbert Xu reported that iproute can accept spoofed messages sent on the
| kernel netlink interface by other users on the local machine. This could
| lead to a local denial of service attack. The Common Vulnerabilities and
| Exposures project (cve.mitre.org) has assigned the name CAN-2003-0856 to
| this issue.
|
| *****************
|
| *****************
| Package: openhbci-plugin-ddvcard
| Versions: ?
| Subject: openhbci-plugin-ddvcard can destroy hbci-cards
| Risk: critical
| Date: 13/01/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38201
| Cross Reference:
| http://sourceforge.net/mailarchive/forum.php?thread_id=3D3743892&forum_id=
| =3D926
|
| Description:
|
| See cross reference (German) and Bugzilla entry.
|
| *****************
|
| *****************
| Package: tcpdump
| Versions: ?
| Subject: denial of service, or possibly execute arbitrary
| code as the 'pcap' user
| Risk: medium/high
| Date: 14/01/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38206
| Cross Reference: none
|
| Description:
|
| Tcpdump is a command-line tool for monitoring network traffic.
|
| George Bakos discovered flaws in the ISAKMP decoding routines of tcpdump
| versions prior to 3.8.1.  The Common Vulnerabilities and Exposures
| project
| (cve.mitre.org) has assigned the name CAN-2003-0989 to this issue.
|
| Jonathan Heusser discovered two additional flaws in the ISAKMP decoding
| routines of tcpdump versions up to and including 3.8.1.
|
| Remote attackers could potentially exploit these issues by sending
| carefully-crafted packets to a victim.  If the victim uses tcpdump,
| these
| pakets could result in a denial of service, or possibly execute
| arbitrary
| code as the 'pcap' user.
|
| Users of tcpdump are advised to upgrade to these erratum packages, which
| contain backported security patches and are not vulnerable to these
| issues.
|
| *****************
|
| *****************
| Package: kdepim
| Versions: from KDE 3.1.0 to 3.1.4
| Subject: buffer overflow in the file information reader of VCF files
| Risk: high/critical
| Date: 14/01/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D38256
| Cross Reference:
| http://www.kde.org/info/security/advisory-20040114-1.txt
|
| Description:
|
| A carefully crafted .VCF file potentially enables local attackers to
| compromise the privacy of a victim's data or execute arbitrary commands
| with the victim's privileges.
|
| By default, file information reading is disabled for remote files.
| However, if previews are enabled for remote files, remote attackers may
| be able to compromise the victim's account.
|
| *****************
|
| *****************
| Package: dcron
| Versions: 2.9
| Subject: dcron installs init script suid 4755
| Risk: medium
| Date: 25/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42908
| Cross Reference: http://dev.gentoo.org/~solar/misc/dcron-2.9-r2.diff
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| *****************
| Package: xine
| Versions: ?
| Subject: Symlink bug / tmpfile bug in xine-check and xine-bugreport
| Risk: low/medium
| Date: 19/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45448
| Cross Reference: http://nettwerked.mg2.org/advisories/xinebug
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: phpBB
| Versions: ?
| Subject: Multiple vulnerabilities
| Risk: critical
| Date: 13/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45482
| Cross Reference: http://www.securityfocus.com/bid/9865
|
| Description:
|
| See Bugzilla entry and cross reference.
|
| *****************
|
| *****************
| Package: SquidGuard
| Versions: <=3D 1.2.0
| Subject: NULL URL Character Unauthorized Access Vulnerability
| Risk: critical
| Date: 19/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45491
| Cross Reference: http://www.securityfocus.com/bid/9919/info/
|
| Description:
|
| Reportedly SquidGaurd is prone to a remote NULL URL character
| unauthorized access vulnerability. This issue is due to a failure of the
| application to properly filter out invalid URIs.
|
| Successful exploitation of this issue may allow a remote attacker to
| bypass access controls resulting in unauthorized access to
| attacker-specified resources. This may allow the attacker to gain
| unauthorized access to sensitive resources.
|
| *****************
|
| *****************
| Package: Jetty
| Versions: < 4.2.19
| Subject: Unspecified Denial Of Service Vulnerability
| Risk: high/critical
| Date: 18/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45552
| Cross Reference: http://www.securityfocus.com/bid/9917
|
| Description:
|
| See cross reference.
|
| *****************
|
| *****************
| Package: oftpd
| Versions: 0.3.6 and possibly others
| Subject: remote DoS vulnerability
| Risk: medium/high
| Date: 04/03/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D45738
| Cross Reference: http://www.time-travellers.org/oftpd/oftpd-dos.html
|
| Description:
|
| Denial of service. An ftp server can be taken offline with a simple
| telnet connection.
|
| *****************
|
| *****************
| Package: libxml2
| Versions: 2.6.x
| Subject: URI Parsing Buffer Overflow Vulnerabilities
| Risk: high/critical
| Date: 24/02/2004
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D42735
| Cross Reference: http://secunia.com/advisories/10958/
|
| Description:
|
| Yuuichi Teranishi has discovered some vulnerabilities in libxml2, which
| potentially can be exploited by malicious people to compromise a
| vulnerable system.
|
| The vulnerabilities are caused due to boundary errors in nanohttp and
| nanoftp when parsing overly long URIs. This can be exploited to cause a
| buffer overflow by supplying an overly long URI (about 4096 bytes).
|
| Successful exploitation may potentially allow execution of arbitrary
| code.
|
| *****************
|
| *****************
| Package: inn
| Versions: < 2.4.1?
| Subject: ?
| Risk: ?
| Date: 17/09/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D29020
| Cross Reference: none
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| *****************
| Package: mplayer
| Versions: ?
| Subject: /dev/misc/rtc permissions change & sysctl.conf addition
| Risk: low/medium?
| Date: 11/09/2003
| Gentoo Bugzilla: http://bugs.gentoo.org/show_bug.cgi?id=3D28486
| Cross Reference: none
|
| Description:
|
| See Bugzilla entry.
|
| *****************
|
| If you spotted any errors or you're aware of additional
| references/information, please drop me a note at glpv@×××××××××.org.
|
| This list is far from complete. As of today it only contains entries
| from Bugzilla that haven't been fixed yet. There are probably many
| issues that haven't found their way into Bugzilla at all.
|
|
| kind regards,
| Tobias Weisserth
|
|

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFAZbK2iDLXZOHxOMoRAsd3AKDXu236o59vYgZ5gov9l2KzrVQnPwCeOzUD
XxwXgrRDnnRorCwfgYyx5YI=
=R8S5
-----END PGP SIGNATURE-----

--
gentoo-security@g.o mailing list