----- Original Message ----- From: "FreeBSD Security Advisories" <[EMAIL PROTECTED]> To: "FreeBSD Security Advisories" <[EMAIL PROTECTED]> Sent: Wednesday, August 28, 2002 9:44 AM Subject: FreeBSD Security Notice FreeBSD-SN-02:05 > -----BEGIN PGP SIGNED MESSAGE----- > > ============================================================================ = > FreeBSD-SN-02:05 Security Notice > The FreeBSD Project > > Topic: security issues in ports > Announced: 2002-08-28 > > I. Introduction > > Several ports in the FreeBSD Ports Collection are affected by security > issues. These are listed below with references and affected versions. > All versions given refer to the FreeBSD port/package version numbers. > The listed vulnerabilities are not specific to FreeBSD unless > otherwise noted. > > These ports are not installed by default, nor are they ``part of > FreeBSD'' as such. The FreeBSD Ports Collection contains thousands of > third-party applications in a ready-to-install format. FreeBSD makes > no claim about the security of these third-party applications. See > <URL:http://www.freebsd.org/ports/> for more information about the > FreeBSD Ports Collection. > > II. Ports > > +------------------------------------------------------------------------+ > Port name: acroread5 > Affected: versions < acroread-5.06 > Status: Fixed > Insecure temporary file handling. The acrobatviewer, acroread4, > ghostscript, gv, mgv and xpdf ports can also display PDF files. > <URL:http://online.securityfocus.com/archive/1/278984> > <URL:http://online.securityfocus.com/archive/1/284263> > +------------------------------------------------------------------------+ > Port name: aide > Affected: versions < aide-0.7_1 > Status: Fixed > The default aide.conf silently fails to check subdirectories, even > though it appears to be configured to do so. > +------------------------------------------------------------------------+ > Port name: apache+mod_ssl > Affected: versions < 1.3.26+2.8.10 > Status: Fixed > A child process of the Apache server can crash if it receives a > request for the contents of a directory in which a maliciously > constructed .htaccess file has been placed. In the default > configuration, another child will be spawned, and the crash will > be logged. Therefore the bug should be insignificant for most > users. > <URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102477330617604&w=2> > +------------------------------------------------------------------------+ > Port name: bugzilla > Affected: versions < bugzilla-2.14.2 > Status: Fixed > "Various security issues of varying importance." > <URL:http://online.securityfocus.com/archive/1/276031> > +------------------------------------------------------------------------+ > Port name: Canna > Affected: versions < ja-Canna-3.5b2_3 > Status: Fixed > A remotely exploitable buffer overflow exists in the cannaserver > daemon. Although previously corrected, the patch containing the > correction was inadvertently removed from the port skeleton. > <URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00%3A31.ca nna.asc.v1.1> > <URL:http://www.shadowpenguin.org/sc_advisories/advisory038.html> > <URL:http://online.securityfocus.com/bid/1445/info/> > +------------------------------------------------------------------------+ > Port name: ethereal > Affected: versions < ethereal-0.9.6 > Status: Fixed > Buffer overflows in BGP, IS-IS, and WCP dissectors. > <URL:http://www.ethereal.com/appnotes/enpa-sa-00005.html> > <URL:http://www.ethereal.com/appnotes/enpa-sa-00006.html> > +------------------------------------------------------------------------+ > Port name: fam > Affected: versions < fam-2.6.8 > Status: Fixed > "Unprivileged users can potentially learn names of files that only > users in root's group should be able to view." > <URL:ftp://oss.sgi.com/projects/fam/download/ChangeLog> > <URL:http://www.debian.org/security/2002/dsa-154> > +------------------------------------------------------------------------+ > Port name: isakmpd > Affected: versions < isakmpd-20020403_1 > Status: Fixed > ``Receiving IKE payloads out of sequence can cause isakmpd(8) to > crash.'' > <URL:http://www.openbsd.org/errata.html#isakmpd> > <URL:http://www.kb.cert.org/vuls/id/287771> > +------------------------------------------------------------------------+ > Port name: irssi > Affected: versions < irssi-0.8.5 > Status: Fixed > Maliciously long topic can crash program remotely. > <URL:http://online.securityfocus.com/bid/5055> > +------------------------------------------------------------------------+ > Port name: kdelibs2 and kdelibs3 > Affected: versions < kdelibs2-2.2.2_1 > versions < kdelibs3-3.0.2_4 > Status: Fixed > A man-in-the-middle attack is possible against Konqueror and other > KDE applications which use SSL. > <URL:http://www.kde.org/info/security/advisory-20020818-1.txt> > +------------------------------------------------------------------------+ > Port name: krb5 > Affected: versions < krb5-1.2.5_2 > Status: Fixed > Contains an overflow in Sun RPC XDR decoder. > <URL:http://online.securityfocus.com/archive/1/285308> > <URL:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823 > > <URL:http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-001-xdr.txt> > +------------------------------------------------------------------------+ > Port name: linux-netscape6, netscape7, linux-mozilla, and mozilla > Affected: versions < mozilla-1.0_1,1 (mozilla) > versions < linux-mozilla-1.1 (linux-mozilla) > All versions (others) > Status: Fixed (linux-mozilla and mozilla) > Not fixed (others) > Malicious Web pages or files can cause loss of X session. > When the X server receives a request to display an enormously large > scalable font, the server exits abruptly, killing all its clients. > This has been confirmed only with XFree86 4.2.0, but there is > evidence that XFree86 3.3.6, the X font server, and Xvnc behave the > same way. Unpatched Netscape (major version 6 or 7) and Mozilla > browsers do not limit the size of fonts which Web pages or files > can specify, thus triggering the bug. > Scalable fonts may be disabled as a workaround. > <URL:http://bugzilla.mozilla.org/show_bug.cgi?id=150339> > +------------------------------------------------------------------------+ > Port name: mm > Affected: versions < mm-1.2.0 > Status: Fixed > May allow the local Apache user to gain privileges via temporary files. > <URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0658> > +------------------------------------------------------------------------+ > Port name: mpack > Affected: versions < mpack-1.5_2 > Status: Fixed > Buffer overflow which might be triggered when mpack is used to process > data from a remote source (email, news, and so on). > <URL:http://www.linuxsecurity.com/advisories/debian_advisory-2241.html> > +------------------------------------------------------------------------+ > Port name: mozilla, linux-mozilla > Affected: versions < mozilla-1.0.rc1_2,1 (mozilla) > versions < linux-mozilla-1.0_1 (linux-mozilla) > Status: Not fixed > An overflow exists in the Chatzilla IRC client. It can cause Mozilla > to crash even if the demonstration page does not cause the crash. > According to Robert Ginda, the bug does not allow execution of > malicious code. > <URL:http://jscript.dk/2002/4/moz1rc1tests/ircbufferoverrun.html> > <URL:http://bugzilla.mozilla.org/show_bug.cgi?id=163588> > <URL:http://bugzilla.mozilla.org/show_bug.cgi?id=94448> > +------------------------------------------------------------------------+ > Port name: newsx > Affected: versions < newsx-1.4.8 > Status: Fixed > Format string bug reported by Niels Heinen <[EMAIL PROTECTED]>. > +------------------------------------------------------------------------+ > Port name: openssh, openssh-portable > Affected: versions < openssh-3.4 (openssh) > versions < openssh-3.4p1 (openssh-portable) > Status: Fixed > Buffer overflow can lead to denial of service or root compromise. > <URL:http://www.openssh.com/txt/preauth.adv> > +------------------------------------------------------------------------+ > Port name: php > Affected: versions mod_php4-4.2.0 and mod_php4-4.2.1 > versions php4-4.2.0 and php4-4.2.1 > Status: Fixed > On i386 architecture, may be remotely crashed; on other architectures, > may allow execution of arbitrary code with the privileges of the > Web server by anyone who can send HTTP POST requests. > <http://security.e-matters.de/advisories/022002.html> > <http://www.php.net/release_4_2_2.php> > +------------------------------------------------------------------------+ > Port name: linux-png and png > Affected: versions < linux-png-1.0.14 > versions < png-1.2.4 > Status: Fixed > Malformed images (for example, in Web pages) can cause applications > to crash. Execution of malicious code may be possible. > <URL:ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207> > <URL:http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=9 8528> > <URL:http://rhn.redhat.com/errata/RHSA-2002-151.html> > <URL:http://rhn.redhat.com/errata/RHSA-2002-152.html> > <URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0660> > <URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0728> > +------------------------------------------------------------------------+ > Port name: postgresql7 > Affected: versions < postgresql7-7.2.2 > Status: Fixed > Multiple buffer overruns may allow execution of malicious code. > Remote attack is possible only when the server is configured to > accept TCP/IP connections, which is not the default. > <URL:http://www3.us.postgresql.org/news.html> > <URL:http://online.securityfocus.com/archive/1/288998/2002-08-23/2002-08-29/ 0> > <URL:http://online.securityfocus.com/archive/1/288334/2002-08-16/2002-08-22/ 0> > <URL:http://online.securityfocus.com/archive/1/288305/2002-08-16/2002-08-22/ 0> > +------------------------------------------------------------------------+ > Port name: samba > Affected: versions < samba-2.2.5 > Status: Fixed > Possible buffer overflow. > <URL:http://lists.samba.org/pipermail/samba-technical/2002-June/037400.html> > +------------------------------------------------------------------------+ > Port name: squid24 > Affected: versions < squid-2.4_10 > Status: Fixed > Buffer overflows may allow remote execution of code. > <URL:http://www.squid-cache.org/Advisories/SQUID-2002_3.txt> > +------------------------------------------------------------------------+ > Port name: super > Affected: versions < super-3.20.0 > Status: Fixed > Local root exploit. > <URL:http://online.securityfocus.com/archive/1/285241> > +------------------------------------------------------------------------+ > Port name: webmin > Affected: versions < webmin-0.990_3 > Status: Fixed > "If a webmin user is able to view print jobs, he can execute any > command as root." > <URL:http://www.webmin.com/updates.html> > +------------------------------------------------------------------------+ > Port name: zmailer > Affected: versions < zmailer-2.99.51_1 > Status: Fixed > When using IPv6, a remote buffer overflow during the processing of > the HELO command is possible. > Reported by 3APA3A <[EMAIL PROTECTED]>. > +------------------------------------------------------------------------+ > > III. Upgrading Ports/Packages > > To upgrade a fixed port/package, perform one of the following: > > 1) Upgrade your Ports Collection and rebuild and reinstall the port. > Several tools are available in the Ports Collection to make this > easier. See: > /usr/ports/devel/portcheckout > /usr/ports/misc/porteasy > /usr/ports/sysutils/portupgrade > > 2) Deinstall the old package and install a new package obtained from > > [i386] > ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/All/ > > Packages are not automatically generated for other architectures at > this time. > > > +------------------------------------------------------------------------+ > FreeBSD Security Notices are communications from the Security Officer > intended to inform the user community about potential security issues, > such as bugs in the third-party applications found in the Ports > Collection, which will not be addressed in a FreeBSD Security > Advisory. > > Feedback on Security Notices is welcome at <[EMAIL PROTECTED]>. > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.0.7 (FreeBSD) > > iQCVAwUBPWz8glUuHi5z0oilAQGD3wP/XLvIayMoXfSUuuw4VVr84c3vqVk0t0rL > qZmLe+GaQ6Z5Fu/DfEta3HXhAPrlZx6dMWQfAbhjSyLfW8RpVkBlhbKR2ZImiddz > t2vz9LaADnWIdyRkI+4zpd9xIgpzB3MQwrkh6ZnnE3pqQ12S4TwfAKqwGm7DSShg > Ymz4mxfkiug= > =J67P > -----END PGP SIGNATURE----- > > To Unsubscribe: send mail to [EMAIL PROTECTED] > with "unsubscribe freebsd-security" in the body of the message > > __________________________________________________________ Send 'unsubscribe rofug' to [EMAIL PROTECTED] to unsubscribe
