[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 96/04 - Two Debian Security Advisories



- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 96/04 dated 01.03.04  Time: 14:30  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Two Debian Security Advisories:

1.  New Linux 2.4.19 packages fix several local root exploits (mips).

2.  New libapache-mod-python packages fix denial of service.


Detail
====== 

1. Several local root exploits have been discovered recently in the Linux kernel. 
This security advisory updates the mips kernel 2.4.19 for Debian GNU/Linux. 

2. The Apache Software Foundation announced that some versions of mod_python contain a bug which, when processing a request with a
malformed query string, could cause the corresponding Apache child to crash. 



1.

            ESB-2004.0170 -- Debian Security Advisory DSA 450-1
     New Linux 2.4.19 packages fix several local root exploits (mips)
                               01 March 2004


Product:                kernel-source-2.4.19
                        kernel-patch-2.4.19-mips
Publisher:              Debian
Operating System:       Debian GNU/Linux 3.0
                        Linux
Platform:               MIPS
Impact:                 Root Compromise
Access Required:        Existing Account
CVE Names:              CAN-2003-0961 CAN-2003-0985 CAN-2004-0077

Ref:                    ESB-2004.0152

- - --------------------------BEGIN INCLUDED TEXT--------------------

- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - --------------------------------------------------------------------------
Debian Security Advisory DSA 450-1                     security@xxxxxxxxxx
http://www.debian.org/security/                             Martin Schulze
February 27th, 2004                     http://www.debian.org/security/faq
- - - --------------------------------------------------------------------------

Package        : kernel-source-2.4.19, kernel-patch-2.4.19-mips
Vulnerability  : several vulnerabilities
Problem-Type   : local
Debian-specific: no
CVE ID         : CAN-2003-0961 CAN-2003-0985 CAN-2004-0077

Several local root exploits have been discovered recently in the Linux kernel.  This security advisory updates the mips kernel
2.4.19 for Debian GNU/Linux.  The Common Vulnerabilities and Exposures project identifies the following problems that are fixed with
this update:

CAN-2003-0961:

   An integer overflow in brk() system call (do_brk() function) for
   Linux allows a local attacker to gain root privileges.  Fixed
   upstream in Linux 2.4.23.

CAN-2003-0985:

   Paul Starzetz discovered a flaw in bounds checking in mremap() in
   the Linux kernel (present in version 2.4.x and 2.6.x) which may
   allow a local attacker to gain root privileges.  Version 2.2 is not
   affected by this bug.  Fixed upstream in Linux 2.4.24.

CAN-2004-0077:

   Paul Starzetz and Wojciech Purczynski of isec.pl discovered a
   critical security vulnerability in the memory management code of
   Linux inside the mremap(2) system call.  Due to missing function
   return value check of internal functions a local attacker can gain
   root privileges.  Fixed upstream in Linux 2.4.25 and 2.6.3.

For the stable distribution (woody) these problems have been fixed in version 2.4.19-0.020911.1.woody3 of mips images and version
2.4.19-4.woody1 of kernel source.

For the unstable distribution (sid) this problem will be fixed soon with the next upload of a 2.4.19 kernel image and in version
2.4.22-0.030928.3 for 2.4.22.

We recommend that you upgrade your Linux kernel packages immediately.


Upgrade Instructions
- - - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- - - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody1.dsc
      Size/MD5 checksum:      672 7bbdd141827b2a7c6e5d3dc0ec1419aa
    http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody1.diff.gz
      Size/MD5 checksum:    40736 2a4fa2f28b3af1ba4247255cf1cab05d
    http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19.orig.tar.gz
      Size/MD5 checksum: 32000211 237896fbb45ae652cc9c5cecc9b746da

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody3.dsc
      Size/MD5 checksum:      792 767aee163c5c3fccbddf1f917d06488c
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody3.tar.gz
      Size/MD5 checksum:  1020287 80c1f72a99eaf113161c589ec49b06f6

  Architecture independent components:

    http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-doc-2.4.19_2.4.19-4.woody1_all.deb
      Size/MD5 checksum:  1782662 b8ade5f98fcb9f3a5627d688467eddcb
    http://security.debian.org/pool/updates/main/k/kernel-source-2.4.19/kernel-source-2.4.19_2.4.19-4.woody1_all.deb
      Size/MD5 checksum: 25892640 b22804d26e298f7f02e51d48d31da2dc

 
http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody3_all.deb
      Size/MD5 checksum:  1020394 ba072ba9f904251c7327ccbeedaa8f20

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-headers-2.4.19_2.4.19-0.020911.1.woody3_mips.deb
      Size/MD5 checksum:  3918150 d1d65ee7cfabcf71efc5d06ac78f6319
 
http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r4k-ip22_2.4.19-0.020911.1.woody3_mips.d
eb
      Size/MD5 checksum:  2075108 8f41b6344fe92ba16e69a623c8e3a9b7
 
http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r5k-ip22_2.4.19-0.020911.1.woody3_mips.d
eb
      Size/MD5 checksum:  2075486 e53315d4e51e49d809e83191d945a4f8
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/mips-tools_2.4.19-0.020911.1.woody3_mips.deb
      Size/MD5 checksum:    12842 b65ca394f3fe542c68787794ee5a4337


  These files will probably be moved into the stable distribution on
  its next revision.

- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAPul7W5ql+IAeqTIRAiSMAJ9h4j/NewlvN3BL3wEADS1+fOj55QCdFCdO
K5shhmIfkmEEPgBE1dKOyJA=
=ZlVf
- - -----END PGP SIGNATURE-----




2.            ESB-2004.0174 -- Debian Security Advisory DSA 452-1
          New libapache-mod-python packages fix denial of service
                               01 March 2004


Product:                libapache-mod-python
Publisher:              Debian
Operating System:       Debian GNU/Linux 3.0
                        Linux
Impact:                 Denial of Service
Access Required:        Remote
CVE Names:              CAN-2003-0973

Ref:                    ESB-2004.0165

- - --------------------------BEGIN INCLUDED TEXT--------------------

- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - - --------------------------------------------------------------------------
Debian Security Advisory DSA 452-1                     security@xxxxxxxxxx
http://www.debian.org/security/                             Matt Zimmerman
February 29th, 2004                     http://www.debian.org/security/faq
- - - --------------------------------------------------------------------------

Package        : libapache-mod-python
Vulnerability  : denial of service
Problem-Type   : remote
Debian-specific: no
CVE Id         : CAN-2003-0973
Debian bug     : 222828

The Apache Software Foundation announced that some versions of mod_python contain a bug which, when processing a request with a
malformed query string, could cause the corresponding Apache child to crash.  This bug could be exploited by a remote attacker to
cause a denial of service.

For the current stable distribution (woody) this problem has been fixed in version 2:2.7.8-0.0woody2.

For the unstable distribution (sid), this problem has been fixed in version 2:2.7.10-1.

We recommend that you update your libapache-mod-python package.

Upgrade Instructions
- - - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- - - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2.dsc
      Size/MD5 checksum:      715 3f6bd19f154109251e7ee9b8db73ebfb
    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2.diff.gz
      Size/MD5 checksum:     7564 bad7102a98f242d28ff3736e4e971fe5
    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8.orig.tar.gz
      Size/MD5 checksum:   176639 4d5bee8317bfb45a3bb09f02b435e917

  Alpha architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_alpha.deb
      Size/MD5 checksum:   120032 20e1ba89516235ec67df12f8a0236198

  ARM architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_arm.deb
      Size/MD5 checksum:   117906 64b6fbcbe483dc388f5cb4e75fa63610

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_i386.deb
      Size/MD5 checksum:   117296 e2ab69380e7e9451ab454605cb1d3e34

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_ia64.deb
      Size/MD5 checksum:   131076 cea1f9dca578ba7e4cac7a7bc8638829

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_hppa.deb
      Size/MD5 checksum:   119784 fcfe4d4ddbdbf29255a51eee77c10422

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_m68k.deb
      Size/MD5 checksum:   118270 dff9473d327a981959831c9a08a48053

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_mips.deb
      Size/MD5 checksum:   117288 0d51ab71f85b5d93b23f593be4e8e7e6

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_mipsel.deb
      Size/MD5 checksum:   117018 52d9bca3ae178e68ef20b64dfb6b96a9

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_powerpc.deb
      Size/MD5 checksum:   118232 6a42f9f8f923837788b586c711a6fa6b

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_s390.deb
      Size/MD5 checksum:   119002 f13e42b816e93b5c6533df6b8c0aa597

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/liba/libapache-mod-python/libapache-mod-python_2.7.8-0.0woody2_sparc.deb
      Size/MD5 checksum:   118176 23da855358f4b8cff799a9478c8e2d81

  These files will probably be moved into the stable distribution on
  its next revision.

- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)



- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 20 7821 1330 Ext 4511
Fax: +44 (0) 20 7821 1686

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 20 7821 1330 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Debian for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>