[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 283/06 - Two Debian Security Advisories:



-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 283/06 dated 18.04.06  Time: 13:25  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Two Debian Security Advisories:

1. DSA 1034-1 - New horde2 packages fix several vulnerabilities

2. DSA 1035-1 - New fcheck packages fix insecure temporary file creation

Detail
====== 

1. Several remote vulnerabilities have been discovered in the Horde web
application framework, which may lead to the execution of arbitrary 
web script code. 

2. Steve Kemp from the Debian Security Audit project discovered that
a cronjob contained in fcheck, a file integrity checker, creates
a temporary file in an insecure fashion.




1.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------------
Debian Security Advisory DSA 1034-1                    security@xxxxxxxxxx
http://www.debian.org/security/                         Moritz Muehlenhoff
April 14th, 2006                        http://www.debian.org/security/faq
- - --------------------------------------------------------------------------

Package        : horde2
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2006-1260 CVE-2006-1491

Several remote vulnerabilities have been discovered in the Horde web
application framework, which may lead to the execution of arbitrary 
web script code. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2006-1260

    Null characters in the URL parameter bypass a sanity check, which
    allowed remote attackers to read arbitrary files, which allowed
    information disclosure.

CVE-2006-1491

    User input in the help viewer was passed unsanitised to the eval()
    function, which allowed injection of arbitrary web code.    


The old stable distribution (woody) doesn't contain horde2 packages.

For the stable distribution (sarge) these problems have been fixed in
version 2.2.8-1sarge2.

The unstable distribution (sid) does no longer contain horde2 packages.

We recommend that you upgrade your horde2 package.


Upgrade Instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/h/horde2/horde2_2.2.8-1sarge2.dsc
      Size/MD5 checksum:      575 acf3f1924f04e2faddfd06ba9b01820e
    http://security.debian.org/pool/updates/main/h/horde2/horde2_2.2.8-1sarge2.diff.gz
      Size/MD5 checksum:    39504 fb338c016b70e69fa4b867fa116b86dc
    http://security.debian.org/pool/updates/main/h/horde2/horde2_2.2.8.orig.tar.gz
      Size/MD5 checksum:   683005 89961af4e4488a908147d7b3a0dc3b44

  Architecture independent components:

    http://security.debian.org/pool/updates/main/h/horde2/horde2_2.2.8-1sarge2_all.deb
      Size/MD5 checksum:   721398 35fa1bf8bf8b4f2be1076501b984367a


  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEP7SJXm3vHE4uyloRAsVVAJ4n9UoO57tJYCw1JePujnjy90XFvACg3DLn
nrfwvObZjSThW+pXcD8NI38=
=BIdm
- -----END PGP SIGNATURE-----



2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------------
Debian Security Advisory DSA 1035-1                    security@xxxxxxxxxx
http://www.debian.org/security/                                 Steve Kemp
April 15th, 2005                        http://www.debian.org/security/faq
- - --------------------------------------------------------------------------

Package        : fcheck
Vulnerability  : insecure temporary file
Problem type   : local
Debian-specific: yes
CVE ID         : CVE-2006-1753

Steve Kemp from the Debian Security Audit project discovered that
a cronjob contained in fcheck, a file integrity checker, creates
a temporary file in an insecure fashion.

The old stable distribution (woody) is not affected by this problem.

For the stable distribution (sarge) this problem has been fixed in
version 2.7.59-7sarge1.

For the unstable distribution (sid) this problem has been fixed in
version 2.7.59-8

We recommend that you upgrade your fcheck package.

Upgrade Instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/f/fcheck/fcheck_2.7.59-7sarge1.dsc
      Size/MD5 checksum:      584 54262b28cbd90e16c251c5bf2b980380
    http://security.debian.org/pool/updates/main/f/fcheck/fcheck_2.7.59-7sarge1.diff.gz
      Size/MD5 checksum:    12765 f58245e36a86b48513042b450c7baf1a
    http://security.debian.org/pool/updates/main/f/fcheck/fcheck_2.7.59.orig.tar.gz
      Size/MD5 checksum:    32864 bdf767b294b4f706742fb96913df37f0

  Architecture independent components:

    http://security.debian.org/pool/updates/main/f/fcheck/fcheck_2.7.59-7sarge1_all.deb
      Size/MD5 checksum:    33622 e89d891255c37bcdf38097b9344312c7


  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)

iD8DBQFEQNBDXm3vHE4uyloRAlUrAJ9Mh/jNzAEnO/qqRcShbRuNCoTLYgCfQit/
1Y2eEB+rPMJuhxJanij0w0k=
=yIKl
- -----END PGP SIGNATURE-----




- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Debian for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the site of the
original source to ensure that you receive the most current information concerning 
that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQCVAwUBRETaF4pao72zK539AQGnoAQAsrxBISur+KpMlke4xVR4HEflCAacP6aB
g0btFyrRLYX4DPJO7REh4qBnFIXhmm2gdmev5xhcyapRxmzRlEVM3GNqEDt/PD90
5FFJ7TcBdufHrJ/TZp3q87F/WdIfcpLkk7+7KRcMbNOAZUArckXUDCFHx5A2J83n
yYmXpqceUdU=
=6w3U
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________