[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 314/06 - Three Gentoo Linux Security Advisories:



-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 314/06 dated 28.04.06  Time: 14:15  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Three Gentoo Linux Security Advisories:

1. GLSA 200604-15 - xine-ui: Format string vulnerabilities

2. GLSA 200604-16 - xine-lib: Buffer overflow vulnerabilit

3. GLSA 200604-17 - Ethereal: Multiple vulnerabilities in protocol dissectors

Detail
====== 

1. Ludwig Nussel discovered that xine-ui incorrectly implements formatted
printing.

2. Federico L. Bossi Bonin discovered that when handling MPEG streams
xine-lib fails to make a proper boundary check of the input data
supplied by the user before copying it to an insufficiently sized
memory buffer.

3. Coverity discovered numerous vulnerabilities in versions of Ethereal
prior to 0.99.0.




1.



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200604-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: xine-ui: Format string vulnerabilities
      Date: April 26, 2006
      Bugs: #130801
        ID: 200604-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Format string vulnerabilities in xine-ui may lead to the execution of
arbitrary code.

Background
==========

xine-ui is a skin-based user interface for xine. xine is a free
multimedia player. It plays CDs, DVDs, and VCDs, and can also decode
other common multimedia formats.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /   Vulnerable   /                Unaffected
    -------------------------------------------------------------------
  1  media-video/xine-ui      < 0.99.4-r5                 >= 0.99.4-r5

Description
===========

Ludwig Nussel discovered that xine-ui incorrectly implements formatted
printing.

Impact
======

By constructing a malicious playlist file, a remote attacker could
exploit these vulnerabilities to execute arbitrary code with the rights
of the user running the application.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All xine-ui users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-video/xine-ui-0.99.4-r5"

References
==========

  [ 1 ] CVE-2006-1905
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1905

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200604-15.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0



2.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200604-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: xine-lib: Buffer overflow vulnerability
      Date: April 26, 2006
      Bugs: #128838
        ID: 200604-16

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

xine-lib contains a buffer overflow vulnerability which may lead to the
execution of arbitrary code.

Background
==========

xine-lib is the xine core engine. xine is a free multimedia player. It
plays CDs, DVDs, and VCDs, and can also decode other common multimedia
formats.

Affected packages
=================

    -------------------------------------------------------------------
     Package   /        Vulnerable        /                 Unaffected
    -------------------------------------------------------------------
  1  xine-lib     < 1.1.2_pre20060328-r1       >= 1.1.2_pre20060328-r1

Description
===========

Federico L. Bossi Bonin discovered that when handling MPEG streams
xine-lib fails to make a proper boundary check of the input data
supplied by the user before copying it to an insufficiently sized
memory buffer.

Impact
======

A remote attacker could entice a user to play a specially-crafted MPEG
file, resulting in the execution of arbitrary code with the permissions
of the user running the application.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All xine-lib users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=media-libs/xine-lib-1.1.2_pre20060328-r1"

References
==========

  [ 1 ] CVE-2006-1664
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1664

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200604-16.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


3.


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200604-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: High
     Title: Ethereal: Multiple vulnerabilities in protocol dissectors
      Date: April 27, 2006
      Bugs: #130505
        ID: 200604-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Ethereal is vulnerable to numerous vulnerabilities, potentially
resulting in the execution of arbitrary code.

Background
==========

Ethereal is a feature-rich network protocol analyzer.

Affected packages
=================

    -------------------------------------------------------------------
     Package                /  Vulnerable  /                Unaffected
    -------------------------------------------------------------------
  1  net-analyzer/ethereal      < 0.99.0                     >= 0.99.0

Description
===========

Coverity discovered numerous vulnerabilities in versions of Ethereal
prior to 0.99.0, including:

* buffer overflows in the ALCAP (CVE-2006-1934), COPS (CVE-2006-1935)
  and telnet (CVE-2006-1936) dissectors.

* buffer overflows in the NetXray/Windows Sniffer and Network
  Instruments file code (CVE-2006-1934).

For further details please consult the references below.

Impact
======

An attacker might be able to exploit these vulnerabilities to crash
Ethereal or execute arbitrary code with the permissions of the user
running Ethereal, which could be the root user.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All Ethereal users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-analyzer/ethereal-0.99.0"

References
==========

  [ 1 ] CVE-2006-1932
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1932
  [ 2 ] CVE-2006-1933
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1933
  [ 3 ] CVE-2006-1934
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1934
  [ 4 ] CVE-2006-1935
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1935
  [ 5 ] CVE-2006-1936
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1936
  [ 6 ] CVE-2006-1937
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1937
  [ 7 ] CVE-2006-1938
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1938
  [ 8 ] CVE-2006-1939
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1939
  [ 9 ] CVE-2006-1940
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1940
  [ 10 ] Ethereal enpa-sa-00023
         http://www.ethereal.com/appnotes/enpa-sa-00023.html

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200604-17.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@xxxxxxxxxx or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0


- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Gentoo for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the site of the
original source to ensure that you receive the most current information concerning 
that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQCVAwUBRFIVe4pao72zK539AQEoRgP+MtPcPUi/FERn6amU843RCc+R6HKAo+rA
U0H1Qh+h73InV82awSapoZ/UDGXTBmOmGMKoJfX2gJoLEkWkqg6aqqn9yE0R/Izd
yxbsQ4s+9F+KMWiWvQHpWPEF8ICTq83hocFq3/Jl03WMLOUP3kqu46FtpKHv2cLR
Fly1bw/fzgs=
=DDXc
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________