[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
UNIRAS Brief - 537/04 - 2 Debian Security Bulletins - New getmail packages fix root compromise/New sendmail packages fix potential open relay.
-----BEGIN PGP SIGNED MESSAGE-----
- ----------------------------------------------------------------------------------
UNIRAS (UK Govt CERT) Briefing Notice - 537/04 dated 28.09.04 Time: 14:40
UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ----------------------------------------------------------------------------------
UNIRAS material is also available from its website at www.uniras.gov.uk and
Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------
Title
=====
Debian Security Bulletins:
1. New getmail packages fix root compromise.
2. New sendmail packages fix potential open relay.
Detail
======
1. A security problem has been discovered in getmail, a POP3 and APOP mail
gatherer and forwarder. An attacker with a shell account on the victims
host could utilise getmail to overwrite arbitrary files when it is running
as root.
2. Hugo Espuny discovered a problem in sendmail, a commonly used program to
deliver electronic mail. When installing "sasl-bin" to use sasl in connection
with sendmail, the sendmail configuration script use fixed user/pass information
to initialise the sasl database. Any spammer with Debian systems knowledge could
utilise such a sendmail installation to relay spam.
- ----------------------------------------------------------------------------------
1.
- ---------------------------------------------------------------------------
Debian Security Advisory DSA 553-1 security@xxxxxxxxxx
http://www.debian.org/security/ Martin Schulze
September 27th, 2004 http://www.debian.org/security/faq
- ---------------------------------------------------------------------------
Package : getmail
Vulnerability : symlink vulnerability
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-0880 CAN-2004-0881
Debian Bug : 272561
A security problem has been discovered in getmail, a POP3 and APOP mail gatherer and
forwarder. An attacker with a shell account on the victims host could utilise getmail
to overwrite arbitrary files when it is running as root.
For the stable distribution (woody) this problem has been fixed in version 2.3.7-2.
For the unstable distribution (sid) this problem has been fixed in version 3.2.5-1.
We recommend that you upgrade your getmail package.
Upgrade Instructions
- - - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given
below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the proper
configuration.
Debian GNU/Linux 3.0 alias woody
- - - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/g/getmail/getmail_2.3.7-2.dsc
Size/MD5 checksum: 583 6263f8d2d75ec3eb21dd302e0b9d6729
http://security.debian.org/pool/updates/main/g/getmail/getmail_2.3.7-2.diff.gz
Size/MD5 checksum: 2645 ff40d8f72744bfec8a963ece950e0bcd
http://security.debian.org/pool/updates/main/g/getmail/getmail_2.3.7.orig.tar.gz
Size/MD5 checksum: 70944 4eef6be77a4cbe1a86eef75affd31b05
Architecture independent components:
http://security.debian.org/pool/updates/main/g/getmail/getmail_2.3.7-2_all.deb
Size/MD5 checksum: 74388 f2b9e79b1ddd8ef8bf719d4e1894f051
These files will probably be moved into the stable distribution on
its next update.
- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -------------------------------------------------------------------------------------
2.
- ---------------------------------------------------------------------------
Debian Security Advisory DSA 554-1 security@xxxxxxxxxx
http://www.debian.org/security/ Martin Schulze
September 27th, 2004 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : sendmail
Vulnerability : pre-set password
Problem-Type : remote
Debian-specific: yes
CVE ID : CAN-2004-0833
Hugo Espuny discovered a problem in sendmail, a commonly used program to deliver electronic
mail. When installing "sasl-bin" to use sasl in connection with sendmail, the sendmail
configuration script use fixed user/pass information to initialise the sasl database.
Any spammer with Debian systems knowledge could utilise such a sendmail installation to
relay spam.
For the stable distribution (woody) this problem has been fixed in version 8.12.3-7.1.
For the unstable distribution (sid) this problem has been fixed in version 8.13.1-13.
We recommend that you upgrade your sendmail package.
Upgrade Instructions
- - - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the proper
configuration.
Debian GNU/Linux 3.0 alias woody
- - - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1.dsc
Size/MD5 checksum: 751 f87d51444a4f2e04a59fafeb7f097bbc
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1.diff.gz
Size/MD5 checksum: 258790 c2f8dcc37edf99eada5fb65b26bb9e72
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3.orig.tar.gz
Size/MD5 checksum: 1840401 b198b346b10b3b5afc8cb4e12c07ff4d
Architecture independent components:
http://security.debian.org/pool/updates/main/s/sendmail/sendmail-doc_8.12.3-7.1_all.deb
Size/MD5 checksum: 747880 2ae5775f103472f8f7941e0662786930
Alpha architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_alpha.deb
Size/MD5 checksum: 267968 69dab41dfc47d348ec7ee5603971c68b
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_alpha.deb
Size/MD5 checksum: 1109604 9f64220f46ac154f7426450478f101dc
ARM architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_arm.deb
Size/MD5 checksum: 247700 6bb4396b026113ec4e12026377a18d17
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_arm.deb
Size/MD5 checksum: 979550 718d6fb7066f753dcba7c71aa7d76ed0
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_i386.deb
Size/MD5 checksum: 237456 111a0ee4b50eafdfdf89845dc633aa1b
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_i386.deb
Size/MD5 checksum: 918104 ad5cc37cb435ed63022ab3a16ae01f6e
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_ia64.deb
Size/MD5 checksum: 282146 360db5037b71cb5eab9015ae8292aca3
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_ia64.deb
Size/MD5 checksum: 1332930 f25bedb4ac5beb5372a704a99dc4d2ac
HP Precision architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_hppa.deb
Size/MD5 checksum: 261806 5aebadbfa1f4c5b63a97034a5bdd3b5a
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_hppa.deb
Size/MD5 checksum: 1081296 1fc96f0e94f384c4f8007358243a4e5e
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_m68k.deb
Size/MD5 checksum: 231282 8d498605748163c67d9ff0f467e01966
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_m68k.deb
Size/MD5 checksum: 866108 b41e130ed77f5224f80178375f25664c
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_mips.deb
Size/MD5 checksum: 255334 699b5f21580f659cd22311150bf0ba5c
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_mips.deb
Size/MD5 checksum: 1022342 2b627d3fdc4c7c9841c6d150b33c1c2a
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_mipsel.deb
Size/MD5 checksum: 255012 d2a7cf6d78b43bf701b836d0224c3b09
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_mipsel.deb
Size/MD5 checksum: 1022760 9376daf26c909df8cfd6017861c9a423
PowerPC architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_powerpc.deb
Size/MD5 checksum: 257484 698ab817f07d5f0d2c4acce2953f1a47
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_powerpc.deb
Size/MD5 checksum: 978892 b6ee12aaa79ac88ba86c082e76292222
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_s390.deb
Size/MD5 checksum: 242818 62ee8100f00289f61c741152055b6547
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_s390.deb
Size/MD5 checksum: 966586 7c1eadeda33234516b07f8241cb88b9d
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/s/sendmail/libmilter-dev_8.12.3-7.1_sparc.deb
Size/MD5 checksum: 245470 17ff10779b02a0d5d278e2ba4221b6c6
http://security.debian.org/pool/updates/main/s/sendmail/sendmail_8.12.3-7.1_sparc.deb
Size/MD5 checksum: 982828 f791b2399d1b7dba4ec770ab08a68e0b
These files will probably be moved into the stable distribution on
its next update.
- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- ----------------------------------------------------------------------------------
For additional information or assistance, please contact the HELP Desk by
telephone or Not Protectively Marked information may be sent via
EMail to: uniras@xxxxxxxxxxxx
Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749
Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts
- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Debian for the information
contained in this Briefing.
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some
of the information may have changed since it was released. If the vulnerability
affects you, it may be prudent to retrieve the advisory from the canonical site
to ensure that you receive the most current information concerning that problem.
Reference to any specific commercial product, process, or service by trade
name, trademark manufacturer, or otherwise, does not constitute or imply
its endorsement, recommendation, or favouring by UNIRAS or NISCC. The views
and opinions of authors expressed within this notice shall not be used for
advertising or product endorsement purposes.
Neither UNIRAS or NISCC shall also accept responsibility for any errors
or omissions contained within this briefing notice. In particular, they shall
not be liable for any loss or damage whatsoever, arising from or in connection
with the usage of information contained within this notice.
UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST)
and has contacts with other international Incident Response Teams (IRTs) in
order to foster cooperation and coordination in incident prevention, to prompt
rapid reaction to incidents, and to promote information sharing amongst its
members and the community at large.
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>
-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0
iQCVAwUBQVlv0Ipao72zK539AQH2OwQApWXk7z/Ok1EUWmoqMki3IcaJIJxbOlZU
v5zZDPpS0JhPg332HBef5Hi24Z1Tzwp1QbPLphiCX2jSK67vHPYGX5B+8CYFUNmg
HOX/iUUAoW4kxXeU/tILBv+pSSOAczYLL2D852tNOxgfRqLLlF37sbnaPfL4uoQp
9/m8avz6NAY=
=AHB0
-----END PGP SIGNATURE-----