[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 581/05 - Gentoo - Three Security Advisories



 
-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 581/05 dated 27.07.05  Time: 10:55  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Gentoo - Three Security Advisories:
     1.  Mozilla Suite: Multiple vulnerabilities   [GLSA 200507-24] 
     2.  Clam AntiVirus: Integer overflows         [GLSA 200507-25]
     3.  GNU Gadu, CenterICQ, Kadu, EKG, libgadu: 
         Remote  code execution in Gadu library    [GLSA 200507-26]


Detail
====== 

Security advisory summaries:

     1.  Several vulnerabilities in the Mozilla Suite allow attacks ranging from
         the execution of javascript code with elevated privileges to
         information leakage.

     2.  Clam AntiVirus is vulnerable to integer overflows when handling several
         file formats, potentially resulting in the execution of arbitrary code. 

     3.  GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer
         overflow which could potentially lead to the execution of arbitrary
         code or a Denial of Service.


Security advisory content follows:


1.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200507-24
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Mozilla Suite: Multiple vulnerabilities
      Date: July 26, 2005
      Bugs: #98846
        ID: 200507-24

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Several vulnerabilities in the Mozilla Suite allow attacks ranging from
the execution of javascript code with elevated privileges to
information leakage.

Background
==========

The Mozilla Suite is an all-in-one Internet application suite including
a web browser, an advanced e-mail and newsgroup client, IRC client and
HTML editor.

Affected packages
=================

    -------------------------------------------------------------------
     Package                 /  Vulnerable  /               Unaffected
    -------------------------------------------------------------------
  1  www-client/mozilla          < 1.7.10                    >= 1.7.10
  2  www-client/mozilla-bin      < 1.7.10                    >= 1.7.10
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

The following vulnerabilities were found and fixed in the Mozilla
Suite:

* "moz_bug_r_a4" and "shutdown" discovered that the Mozilla Suite was
  improperly cloning base objects (MFSA 2005-56).

* "moz_bug_r_a4" reported that the suite failed to validate XHTML DOM
  nodes properly (MFSA 2005-55).

* Secunia reported that alerts and prompts scripts are presented with
  the generic title [JavaScript Application] which could lead to
  tricking a user (MFSA 2005-54).

* Andreas Sandblad of Secunia reported that top.focus() can be called
  in the context of a child frame even if the framing page comes from a
  different origin and has overridden the focus() routine (MFSA
  2005-52).

* Secunia reported that a frame-injection spoofing bug which was
  fixed in earlier versions, was accidently bypassed in Mozilla Suite
  1.7.7 (MFSA 2005-51).

* "shutdown" reported that InstallVersion.compareTo() might be
  exploitable. When it gets an object rather than a string, the browser
  would generally crash with an access violation (MFSA 2005-50).

* Matthew Mastracci reported that by forcing a page navigation
  immediately after calling the install method can end up running in
  the context of the new page selected by the attacker (MFSA 2005-48).

* "moz_bug_r_a4" reported that XBL scripts run even when Javascript
  is disabled (MFSA 2005-46).

* Omar Khan, Jochen, "shutdown" and Matthew Mastracci reported that
  the Mozilla Suite incorrectly distinguished between true events like
  mouse clicks or keystrokes and synthetic events generated by a web
  content (MFSA 2005-45).

Impact
======

A remote attacker could craft malicious web pages that would leverage
these issues to inject and execute arbitrary javascript code with
elevated privileges, steal cookies or other information from web pages,
or spoof content.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Mozilla Suite users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-1.7.10"

All Mozilla Suite binary users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=www-client/mozilla-bin-1.7.10"

References
==========

  [ 1 ] Mozilla Foundation Security Advisories
        http://www.mozilla.org/projects/security/known-vulnerabilities.html#Mozilla

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200507-24.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0




2.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200507-25
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: Clam AntiVirus: Integer overflows
      Date: July 26, 2005
      Bugs: #100178
        ID: 200507-25

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Clam AntiVirus is vulnerable to integer overflows when handling several
file formats, potentially resulting in the execution of arbitrary code.

Background
==========

Clam AntiVirus is a GPL anti-virus toolkit, designed for integration
with mail servers to perform attachment scanning. Clam AntiVirus also
provides a command line scanner and a tool for fetching updates of the
virus database.

Affected packages
=================

    -------------------------------------------------------------------
     Package               /  Vulnerable  /                 Unaffected
    -------------------------------------------------------------------
  1  app-antivirus/clamav      < 0.86.2                      >= 0.86.2

Description
===========

Neel Mehta and Alex Wheeler discovered that Clam AntiVirus is
vulnerable to integer overflows when handling the TNEF, CHM and FSG
file formats.

Impact
======

By sending a specially-crafted file an attacker could execute arbitrary
code with the permissions of the user running Clam AntiVirus.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Clam AntiVirus users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.86.2"

References
==========

  [ 1 ] BugTraq Announcement
        http://www.securityfocus.com/archive/1/406377/30/
  [ 2 ] Clam AntiVirus: Release Notes
        http://sourceforge.net/project/shownotes.php?release_id=344514

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200507-25.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0




3.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200507-26
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: GNU Gadu, CenterICQ, Kadu, EKG, libgadu: Remote code
            execution in Gadu library
      Date: July 27, 2005
      Bugs: #99816, #99890, #99583
        ID: 200507-26

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer
overflow which could potentially lead to the execution of arbitrary
code or a Denial of Service.

Background
==========

GNU Gadu, CenterICQ, Kadu and EKG are instant messaging applications
created to support Gadu Gadu instant messaging protocol. libgadu is a
library that implements the client side of the Gadu-Gadu protocol.

Affected packages
=================

    -------------------------------------------------------------------
     Package           /   Vulnerable   /                   Unaffected
    -------------------------------------------------------------------
  1  net-im/gnugadu        < 2.2.6-r1                      >= 2.2.6-r1
  2  net-im/centericq      < 4.20.0-r3                    >= 4.20.0-r3
  3  net-im/kadu             < 0.4.1                          >= 0.4.1
  4  net-im/ekg             < 1.6_rc3                       >= 1.6_rc3
  5  net-libs/libgadu      < 20050719                      >= 20050719
    -------------------------------------------------------------------
     5 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

GNU Gadu, CenterICQ, Kadu, EKG and libgadu are vulnerable to an integer
overflow.

Impact
======

A remote attacker could exploit the integer overflow to execute
arbitrary code or cause a Denial of Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All GNU Gadu users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-im/gnugadu-2.2.6-r1"

All Kadu users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-im/kadu-0.4.1"

All EKG users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-im/ekg-1.6_rc3"

All libgadu users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-libs/libgadu-20050719"

All CenterICQ users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-im/centericq-4.20.0-r3"

CenterICQ is no longer distributed with Gadu Gadu support, affected
users are encouraged to migrate to an alternative package.

References
==========

  [ 1 ] CAN-2005-1852
        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1852
  [ 2 ] BugTraq Announcement
        http://www.securityfocus.com/archive/1/406026/30/

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200507-26.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Gentoo for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the canonical site 
to ensure that you receive the most current information concerning that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQCVAwUBQudaNopao72zK539AQGldgP/YvCnV53IyAwNqmRXkqAxRiMsPDH46Jik
75cMmcSQAZsO+3ylD8vEykPDORHKZHLte8vxlNicGQKoMJKm+c0Uoqv7Lh/a9EMW
3fnKgN423y5ybPYKc97mFTNzgHZLYyrBFkl24hAnyb5RWZyUg7tZMlS85ofqtlyQ
wln9onuBuC0=
=BwqN
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________