Nabble - Debian Security Announce

[SECURITY] [DSA 1646-2] New squid packages fix array bounds check

2008-10-10T23:46:58Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1646-2 security@...
http://www.debian.org/security/ Devin Carraway
October 11, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : squid
Vulnerability : array bounds check
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2008-1612

In DSA 1646-1, an update was announced for a denial of service
vulnerability in squid, a caching proxy server. Due to an error in
packaging and in testing, the updated packages did not correct the
weakness. An updated release is available which corrects the error.
For reference, the original advisory text follows.

A weakness has been discovered in squid, a caching proxy server. The
flaw was introduced upstream in response to CVE-2007-6239, and
announced by Debian in DSA-1482-1. The flaw involves an
over-aggressive bounds check on an array resize, and could be
exploited by an authorized client to induce a denial of service
condition against squid.

For the stable distribution (etch), these problems have been fixed in
version 2.6.5-6etch4.

We recommend that you upgrade your squid packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4.dsc
Size/MD5 checksum: 669 6e919d707f76cb9d991744834369b876
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5.orig.tar.gz
Size/MD5 checksum: 1636886 26cc918028340dc8ceb9c0c4b988d717
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4.diff.gz
Size/MD5 checksum: 273381 54c814d93e2976176d0389bf22fb216a

Architecture independent packages:

http://security.debian.org/pool/updates/main/s/squid/squid-common_2.6.5-6etch4_all.deb
Size/MD5 checksum: 437254 46d12b52f401fcb70f7d951d66c5dade

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_alpha.deb
Size/MD5 checksum: 119764 28f3499402f9c411df1a2b0eee1769b4
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_alpha.deb
Size/MD5 checksum: 88450 a6df99cdff0c82901d9863223ad35ddb
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_alpha.deb
Size/MD5 checksum: 793634 be22589c1b9d3ba1ab52156bf0a3353a

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_amd64.deb
Size/MD5 checksum: 86346 dafc6a156fc1f80f91a3d11a50183c02
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_amd64.deb
Size/MD5 checksum: 116724 8334a79c13f1865c37f0e0897b7acbaf
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_amd64.deb
Size/MD5 checksum: 709000 5c9d16bfc10bd4fedb2f9eb61c9395ca

arm architecture (ARM)

http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_arm.deb
Size/MD5 checksum: 116122 184d2bd029ff022c9af03755bf72a3f5
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_arm.deb
Size/MD5 checksum: 86244 2fdfae956f99ff1162fbb4bf8441ca15
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_arm.deb
Size/MD5 checksum: 676602 07e3c76d7374ef1e91c20177ab1f4683

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_hppa.deb
Size/MD5 checksum: 748514 6750bc041313f8d8adb4e183555d3581
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_hppa.deb
Size/MD5 checksum: 88064 7dfa55ef0f63725163a1d011275382d4
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_hppa.deb
Size/MD5 checksum: 118700 9d8d75d7858601696c8d7d441e440d19

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_i386.deb
Size/MD5 checksum: 116550 031de91f40686ac7dc38e6de48615cb7
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_i386.deb
Size/MD5 checksum: 655150 eee50212e07c78bedda110fe3bfa566e
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_i386.deb
Size/MD5 checksum: 86152 4a7f52087fcee493d539e014ea21e3c4

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_ia64.deb
Size/MD5 checksum: 1067252 44f4997b71e6f8b0e5570d057715660a
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_ia64.deb
Size/MD5 checksum: 91522 d6fa05f3602bf87b2b3bd01b8cc426ef
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_ia64.deb
Size/MD5 checksum: 124394 2bb271010b2172abcd31c61dfd47e465

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_mips.deb
Size/MD5 checksum: 87494 ac30318c4ffedfad4a6d0801baf15474
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_mips.deb
Size/MD5 checksum: 740002 6bc6ff8558d06873f01032bbd0b36c3f
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_mips.deb
Size/MD5 checksum: 118308 d92424cf93987ebb392798fb6a1339e1

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_mipsel.deb
Size/MD5 checksum: 87434 afa29601429b35bfe722cb7b16fbb084
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_mipsel.deb
Size/MD5 checksum: 747568 da0371a76195861c8cff6d28366da1d6
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_mipsel.deb
Size/MD5 checksum: 117366 2c280932ebee5de58e669145b9ce59cc

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_powerpc.deb
Size/MD5 checksum: 86292 88c32419e15d93511ed6427957d6cdd6
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_powerpc.deb
Size/MD5 checksum: 712560 21e418ca3c982eb12a3d58a556b8682f
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_powerpc.deb
Size/MD5 checksum: 116520 67f7a1adde76c9c93520dbe84f5c9e99

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_s390.deb
Size/MD5 checksum: 116868 078fed27faaaf363efeb0d7f8e9ffc06
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_s390.deb
Size/MD5 checksum: 86738 ca0d927ffc1900e57c083bb59ac266b8
http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_s390.deb
Size/MD5 checksum: 712040 cdf675694f3b01cce10d92d6dbc7f26c

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/s/squid/squid_2.6.5-6etch4_sparc.deb
Size/MD5 checksum: 667416 7a51316d2f9b7029d889a091aea6b309
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.6.5-6etch4_sparc.deb
Size/MD5 checksum: 116086 f10ece4d90708215b40f158ec37b1f28
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.6.5-6etch4_sparc.deb
Size/MD5 checksum: 86472 65e2a79ff0f73c6b40efa3831149852a

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFI8EsOU5XKDemr/NIRAleEAKC15L99mIlvSGbVfvCnS00cJYAF/gCg3d8U
IGKCKkv4BRjj6keRPma6tl8=
=tVF0
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[SECURITY] [DSA 1649-1] New iceweasel packages fix several vulnerabilities

2008-10-08T13:15:55Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1649-1 security@...
http://www.debian.org/security/ Moritz Muehlenhoff
October 08, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : iceweasel
Vulnerability : several
Problem-Type : remote
Debian-specific: no
CVE ID : CVE-2008-0016 CVE-2008-3835 CVE-2008-3836 CVE-2008-3837 CVE-2008-4058 CVE-2008-4059 CVE-2008-4060 CVE-2008-4061 CVE-2008-4062 CVE-2008-4065 CVE-2008-4066 CVE-2008-4067 CVE-2008-4068 CVE-2008-4069

Several remote vulnerabilities have been discovered in the Iceweasel web
browser, an unbranded version of the Firefox browser. The Common
Vulnerabilities and Exposures project identifies the following problems:

CVE-2008-0016

Justin Schuh, Tom Cross and Peter Williams discovered a buffer
overflow in the parser for UTF-8 URLs, which may lead to the
execution of arbitrary code.

CVE-2008-3835

"moz_bug_r_a4" discovered that the same-origin check in
nsXMLDocument::OnChannelRedirect() could by bypassed.

CVE-2008-3836

"moz_bug_r_a4" discovered that several vulnerabilities in
feedWriter could lead to Chrome privilege escalation.

CVE-2008-3837

Paul Nickerson discovered that an attacker could move windows
during a mouse click, resulting in unwanted action triggered by
drag-and-drop.

CVE-2008-4058

"moz_bug_r_a4" discovered a vulnerability which can result in
Chrome privilege escalation through XPCNativeWrappers.

CVE-2008-4059

"moz_bug_r_a4" discovered a vulnerability which can result in
Chrome privilege escalation through XPCNativeWrappers.

CVE-2008-4060

Olli Pettay and "moz_bug_r_a4" discovered a Chrome privilege
escalation vulnerability in XSLT handling.

CVE-2008-4061

Jesse Ruderman discovered a crash in the layout engine, which might
allow the execution of arbitrary code.

CVE-2008-4062

Igor Bukanov, Philip Taylor, Georgi Guninski and Antoine Labour
discovered crashes in the Javascript engine, which might allow the
execution of arbitrary code.

CVE-2008-4065

Dave Reed discovered that some Unicode byte order marks are
stripped from Javascript code before execution, which can result in
code being executed, which were otherwise part of a quoted string.

CVE-2008-4066

Gareth Heyes discovered that some Unicode surrogate characters are
ignored by the HTML parser.

CVE-2008-4067

Boris Zbarsky discovered that resource: URls allow directory
traversal when using URL-encoded slashes.

CVE-2008-4068

Georgi Guninski discovered that resource: URLs could bypass local
access restrictions.

CVE-2008-4069

Billy Hoffman discovered that the XBM decoder could reveal
uninitialised memory.

For the stable distribution (etch), these problems have been fixed in
version 2.0.0.17-0etch1. Packages for hppa will be provided later.

For the unstable distribution (sid), these problems have been fixed in
version 3.0.3 of iceweasel and 1.9.0.3-1 of xulrunner.

We recommend that you upgrade your iceweasel package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Stable updates are available for alpha, amd64, arm, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17.orig.tar.gz
Size/MD5 checksum: 47264462 caa85228cc0f4d309e85d6991cb95305
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1.dsc
Size/MD5 checksum: 1289 84dfa301f786f84a1d64baf4ed3db782
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1.diff.gz
Size/MD5 checksum: 186694 8e6e9a55fde52af390122189070fca57

Architecture independent packages:

http://security.debian.org/pool/updates/main/i/iceweasel/firefox_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 54634 b2fd3414c31cebfcf9a1433dcc1d2e93
http://security.debian.org/pool/updates/main/i/iceweasel/firefox-dom-inspector_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 54530 fc5fb66d2eaf4027d945dd0a28b2d846
http://security.debian.org/pool/updates/main/i/iceweasel/mozilla-firefox-dom-inspector_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 54384 21762949b8e2fd39ac79476fa24b03d1
http://security.debian.org/pool/updates/main/i/iceweasel/mozilla-firefox-gnome-support_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 54384 9df9c09b5351c290fee72c24b47a331d
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dom-inspector_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 239720 644c28cc69b5ffa408b0c57b92152ec3
http://security.debian.org/pool/updates/main/i/iceweasel/mozilla-firefox_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 55170 5d191251cab8743fdd8537c757e39abc
http://security.debian.org/pool/updates/main/i/iceweasel/firefox-gnome-support_2.0.0.17-0etch1_all.deb
Size/MD5 checksum: 54494 bf8060f4a48856e3221988210417ebd6

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_alpha.deb
Size/MD5 checksum: 11578586 a8c71f32151faca4674a1a09e3b66545
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_alpha.deb
Size/MD5 checksum: 51173558 6361a1e6926eb32d5ede6c74671d86f1
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_alpha.deb
Size/MD5 checksum: 90252 569480998f4eac60ba8c0f6e62cb275e

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_amd64.deb
Size/MD5 checksum: 87924 70015d9a4e458e26ff6b65a2674ff56a
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_amd64.deb
Size/MD5 checksum: 10206146 ec62c84f919bda242b9d65390d9143be
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_amd64.deb
Size/MD5 checksum: 50165526 8b083d926eb7e6da63c0be882af1642f

arm architecture (ARM)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_arm.deb
Size/MD5 checksum: 49257448 89f6c8c0b51255038eee5d13416fcadb
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_arm.deb
Size/MD5 checksum: 81618 59dba0eee92b991d069f883c19680d75
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_arm.deb
Size/MD5 checksum: 9256358 4fd0774c50d76457152d406ed19ea367

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_i386.deb
Size/MD5 checksum: 49570130 6a6b0cb233e73d4baef8ddbd33029b98
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_i386.deb
Size/MD5 checksum: 82056 91a67db26a7c51ae185d39dedaaf94cb
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_i386.deb
Size/MD5 checksum: 9122164 5b4e1dfeb171be9542572fc9e490b818

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_ia64.deb
Size/MD5 checksum: 14156490 2607bd2156b38eebeb2ecdde49acea53
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_ia64.deb
Size/MD5 checksum: 100252 1e28dda1215d01e2cfe35403a52a0fcc
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_ia64.deb
Size/MD5 checksum: 50513628 0db2edd5ef28c04f8c1d5331e92e100d

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_mips.deb
Size/MD5 checksum: 11063822 d78bb2a163ec303a618ea88e005f0116
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_mips.deb
Size/MD5 checksum: 83196 ef3e17948ca57bebb18890d5ce89e0f8
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_mips.deb
Size/MD5 checksum: 53969964 f42e61e36c60c76b24e1bf34600479da

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_mipsel.deb
Size/MD5 checksum: 83224 be3cb4e303ad8544dd274447451228c6
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_mipsel.deb
Size/MD5 checksum: 10761380 077af6ef650d85ed023acb5d936318c3
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_mipsel.deb
Size/MD5 checksum: 52518328 de36b16feb4052325ed975d9d75a6625

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_powerpc.deb
Size/MD5 checksum: 9937490 9ef7bdd022ec317efaefbfcd5e0b0aa0
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_powerpc.deb
Size/MD5 checksum: 51973444 ee5cb6165d1cda06c158df93f393b833
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_powerpc.deb
Size/MD5 checksum: 83786 56ad8684dc229e605f7285e48bb10389

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_s390.deb
Size/MD5 checksum: 10366602 06f0cc6f4fab228756f7b088eee305d3
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_s390.deb
Size/MD5 checksum: 50839114 fa42c55974b0beece5184341e5ca4340
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_s390.deb
Size/MD5 checksum: 88198 6ebd745cc96c2c6c80cb7f2987138364

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-dbg_2.0.0.17-0etch1_sparc.deb
Size/MD5 checksum: 49179416 00c2781b99157e0f0970b01d1d2e70ed
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel-gnome-support_2.0.0.17-0etch1_sparc.deb
Size/MD5 checksum: 82000 e74866cfbd6a70b1e7e7b5eb737dc8a8
http://security.debian.org/pool/updates/main/i/iceweasel/iceweasel_2.0.0.17-0etch1_sparc.deb
Size/MD5 checksum: 9199076 95cacd55b0dc6415d62f30394517048a

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkjtFMkACgkQXm3vHE4uylqphACfbx5D3jDzupsroSEboLeO/WGX
5IEAoM4BsN9D7WY+uWtxp5gxku4p/h5f
=r/Sa
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[SECURITY] [DSA 1648-1] New mon packages fix insecure temporary files

2008-10-08T12:34:19Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1648-1 security@...
http://www.debian.org/security/ Thijs Kinkhorst
October 08, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : mon
Vulnerability : insecure temporary files
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2008-4477
Debian Bug : 496398

Dmitry E. Oboukhov discovered that the test.alert script used in one of the
alert functions in mon, a system to monitor hosts or services and alert
about problems, creates temporary files insecurely, which may lead to a local
denial of service through symlink attacks.

For the stable distribution (etch), this problem has been fixed in
version 0.99.2-9+etch2.

For the testing (lenny) and unstable distribution (sid), this problem has
been fixed in version 0.99.2-13.

We recommend that you upgrade your mon package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2.dsc
Size/MD5 checksum: 660 777a64c7f02bb12ed424f0cc2ca74b09
http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2.diff.gz
Size/MD5 checksum: 17561 21156aea6f48d98eaab3b43e42a062b1
http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2.orig.tar.gz
Size/MD5 checksum: 166255 2a0d34cd493abc10042bf05d2271a55b

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_alpha.deb
Size/MD5 checksum: 181564 98676f30cb451402908bb933c7996a23

amd64 architecture (AMD x86_64 (AMD64))

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_amd64.deb
Size/MD5 checksum: 178732 5d1332ad8f248b39ccdebc1b78d6d3d8

arm architecture (ARM)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_arm.deb
Size/MD5 checksum: 177878 8c6d31fb6423e0f7850add19c15c412a

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_hppa.deb
Size/MD5 checksum: 179802 9f3758a0f88fc8022f2d2b255e5e5e0f

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_i386.deb
Size/MD5 checksum: 178842 96745e69e7720b72d50f35f60a837e9b

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_ia64.deb
Size/MD5 checksum: 179774 b1c5d9ef86303add929ef02b7ba75db5

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_mips.deb
Size/MD5 checksum: 178722 1b12a60e19b32271a38ea16175465166

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_mipsel.deb
Size/MD5 checksum: 178396 55e3e042f8490c0ffe563fe84394940f

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_powerpc.deb
Size/MD5 checksum: 178204 71f4e1fe9623e4bd235a3cbbad9eb7b1

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_s390.deb
Size/MD5 checksum: 178180 cc178896b1cb25a50401ef6f713e0a4b

sparc architecture (Sun SPARC/UltraSPARC)

http://security.debian.org/pool/updates/main/m/mon/mon_0.99.2-9+etch2_sparc.deb
Size/MD5 checksum: 179196 ceb4cc733f22bdeefefe6d695c77c774

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iQEVAwUBSO0LJ2z0hbPcukPfAQJSbAgApJ5RYoQqlPAe0uT1e3ecHsYa/xJjM/x/
Z6smCVN4HQD7vj+SgaDYh9gzWIT9aAaXzdhJYeU8ry8r2luJjM3XSHEUy2bhHCOw
yKEZhvdKt5AY2cOJRSBMtTJ1++ftOicz3RLE4T5mJrtmx2dAEZinmfbLSP+UnnJu
fupZEPt2tKULzvXtRegUZQf10lS+AruQWv1aowUotwa6rHH+RjX9To5ZD2caS+4h
QXcJVK7x5gZlK82AXylLsn+fsnWreeHc+CGKMIXyZrgkQvLVLyS8jmtK8jSaDgA6
iXNOe+NEerfZaFwgPiFASLgY57cVFMGvCX764AZ0tWq2kEPIas2aGQ==
=NByV
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...