Published:
29 August 2002
Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2002.475 -- FreeBSD Security Notice FreeBSD-SN-02:05
Security Issues in Ports
29 August 2002
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: acroread5
aide
apache+mod_ssl
bugzilla
Canna
ethereal
fam
isakmpd
irssi
kdelibs2
kdelibs3
linux-netscape6
netscape7
linux-mozilla
mozilla
mm
mpack
newsx
openssh
openssh-portable
php
linux-png
png
postgresql7
samba
squid24
super
webmin
zmailer
Operating System: FreeBSD
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
=============================================================================
FreeBSD-SN-02:05 Security Notice
The FreeBSD Project
Topic: security issues in ports
Announced: 2002-08-28
I. Introduction
Several ports in the FreeBSD Ports Collection are affected by security
issues. These are listed below with references and affected versions.
All versions given refer to the FreeBSD port/package version numbers.
The listed vulnerabilities are not specific to FreeBSD unless
otherwise noted.
These ports are not installed by default, nor are they ``part of
FreeBSD'' as such. The FreeBSD Ports Collection contains thousands of
third-party applications in a ready-to-install format. FreeBSD makes
no claim about the security of these third-party applications. See
<URL:http://www.freebsd.org/ports/> for more information about the
FreeBSD Ports Collection.
II. Ports
+------------------------------------------------------------------------+
Port name: acroread5
Affected: versions < acroread-5.06
Status: Fixed
Insecure temporary file handling. The acrobatviewer, acroread4,
ghostscript, gv, mgv and xpdf ports can also display PDF files.
<URL:http://online.securityfocus.com/archive/1/278984>
<URL:http://online.securityfocus.com/archive/1/284263>
+------------------------------------------------------------------------+
Port name: aide
Affected: versions < aide-0.7_1
Status: Fixed
The default aide.conf silently fails to check subdirectories, even
though it appears to be configured to do so.
+------------------------------------------------------------------------+
Port name: apache+mod_ssl
Affected: versions < 1.3.26+2.8.10
Status: Fixed
A child process of the Apache server can crash if it receives a
request for the contents of a directory in which a maliciously
constructed .htaccess file has been placed. In the default
configuration, another child will be spawned, and the crash will
be logged. Therefore the bug should be insignificant for most
users.
<URL:http://marc.theaimsgroup.com/?l=vuln-dev&m=102477330617604&w=2>
+------------------------------------------------------------------------+
Port name: bugzilla
Affected: versions < bugzilla-2.14.2
Status: Fixed
"Various security issues of varying importance."
<URL:http://online.securityfocus.com/archive/1/276031>
+------------------------------------------------------------------------+
Port name: Canna
Affected: versions < ja-Canna-3.5b2_3
Status: Fixed
A remotely exploitable buffer overflow exists in the cannaserver
daemon. Although previously corrected, the patch containing the
correction was inadvertently removed from the port skeleton.
<URL:ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00%3A31.canna.asc.v1.1>
<URL:http://www.shadowpenguin.org/sc_advisories/advisory038.html>
<URL:http://online.securityfocus.com/bid/1445/info/>
+------------------------------------------------------------------------+
Port name: ethereal
Affected: versions < ethereal-0.9.6
Status: Fixed
Buffer overflows in BGP, IS-IS, and WCP dissectors.
<URL:http://www.ethereal.com/appnotes/enpa-sa-00005.html>
<URL:http://www.ethereal.com/appnotes/enpa-sa-00006.html>
+------------------------------------------------------------------------+
Port name: fam
Affected: versions < fam-2.6.8
Status: Fixed
"Unprivileged users can potentially learn names of files that only
users in root's group should be able to view."
<URL:ftp://oss.sgi.com/projects/fam/download/ChangeLog>
<URL:http://www.debian.org/security/2002/dsa-154>
+------------------------------------------------------------------------+
Port name: isakmpd
Affected: versions < isakmpd-20020403_1
Status: Fixed
``Receiving IKE payloads out of sequence can cause isakmpd(8) to
crash.''
<URL:http://www.openbsd.org/errata.html#isakmpd>
<URL:http://www.kb.cert.org/vuls/id/287771>
+------------------------------------------------------------------------+
Port name: irssi
Affected: versions < irssi-0.8.5
Status: Fixed
Maliciously long topic can crash program remotely.
<URL:http://online.securityfocus.com/bid/5055>
+------------------------------------------------------------------------+
Port name: kdelibs2 and kdelibs3
Affected: versions < kdelibs2-2.2.2_1
versions < kdelibs3-3.0.2_4
Status: Fixed
A man-in-the-middle attack is possible against Konqueror and other
KDE applications which use SSL.
<URL:http://www.kde.org/info/security/advisory-20020818-1.txt>
+------------------------------------------------------------------------+
Port name: krb5
Affected: versions < krb5-1.2.5_2
Status: Fixed
Contains an overflow in Sun RPC XDR decoder.
<URL:http://online.securityfocus.com/archive/1/285308>
<URL:http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=20823>
<URL:http://web.mit.edu/kerberos/www/advisories/MITKRB5-SA-2002-001-xdr.txt>
+------------------------------------------------------------------------+
Port name: linux-netscape6, netscape7, linux-mozilla, and mozilla
Affected: versions < mozilla-1.0_1,1 (mozilla)
versions < linux-mozilla-1.1 (linux-mozilla)
All versions (others)
Status: Fixed (linux-mozilla and mozilla)
Not fixed (others)
Malicious Web pages or files can cause loss of X session.
When the X server receives a request to display an enormously large
scalable font, the server exits abruptly, killing all its clients.
This has been confirmed only with XFree86 4.2.0, but there is
evidence that XFree86 3.3.6, the X font server, and Xvnc behave the
same way. Unpatched Netscape (major version 6 or 7) and Mozilla
browsers do not limit the size of fonts which Web pages or files
can specify, thus triggering the bug.
Scalable fonts may be disabled as a workaround.
<URL:http://bugzilla.mozilla.org/show_bug.cgi?id=150339>
+------------------------------------------------------------------------+
Port name: mm
Affected: versions < mm-1.2.0
Status: Fixed
May allow the local Apache user to gain privileges via temporary files.
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0658>
+------------------------------------------------------------------------+
Port name: mpack
Affected: versions < mpack-1.5_2
Status: Fixed
Buffer overflow which might be triggered when mpack is used to process
data from a remote source (email, news, and so on).
<URL:http://www.linuxsecurity.com/advisories/debian_advisory-2241.html>
+------------------------------------------------------------------------+
Port name: mozilla, linux-mozilla
Affected: versions < mozilla-1.0.rc1_2,1 (mozilla)
versions < linux-mozilla-1.0_1 (linux-mozilla)
Status: Not fixed
An overflow exists in the Chatzilla IRC client. It can cause Mozilla
to crash even if the demonstration page does not cause the crash.
According to Robert Ginda, the bug does not allow execution of
malicious code.
<URL:http://jscript.dk/2002/4/moz1rc1tests/ircbufferoverrun.html>
<URL:http://bugzilla.mozilla.org/show_bug.cgi?id=163588>
<URL:http://bugzilla.mozilla.org/show_bug.cgi?id=94448>
+------------------------------------------------------------------------+
Port name: newsx
Affected: versions < newsx-1.4.8
Status: Fixed
Format string bug reported by Niels Heinen <niels.heinen@ubizen.com>.
+------------------------------------------------------------------------+
Port name: openssh, openssh-portable
Affected: versions < openssh-3.4 (openssh)
versions < openssh-3.4p1 (openssh-portable)
Status: Fixed
Buffer overflow can lead to denial of service or root compromise.
<URL:http://www.openssh.com/txt/preauth.adv>
+------------------------------------------------------------------------+
Port name: php
Affected: versions mod_php4-4.2.0 and mod_php4-4.2.1
versions php4-4.2.0 and php4-4.2.1
Status: Fixed
On i386 architecture, may be remotely crashed; on other architectures,
may allow execution of arbitrary code with the privileges of the
Web server by anyone who can send HTTP POST requests.
<http://security.e-matters.de/advisories/022002.html>
<http://www.php.net/release_4_2_2.php>
+------------------------------------------------------------------------+
Port name: linux-png and png
Affected: versions < linux-png-1.0.14
versions < png-1.2.4
Status: Fixed
Malformed images (for example, in Web pages) can cause applications
to crash. Execution of malicious code may be possible.
<URL:ftp://swrinde.nde.swri.edu/pub/png-group/archives/png-list.200207>
<URL:http://sourceforge.net/project/shownotes.php?group_id=5624&release_id=98528>
<URL:http://rhn.redhat.com/errata/RHSA-2002-151.html>
<URL:http://rhn.redhat.com/errata/RHSA-2002-152.html>
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0660>
<URL:http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0728>
+------------------------------------------------------------------------+
Port name: postgresql7
Affected: versions < postgresql7-7.2.2
Status: Fixed
Multiple buffer overruns may allow execution of malicious code.
Remote attack is possible only when the server is configured to
accept TCP/IP connections, which is not the default.
<URL:http://www3.us.postgresql.org/news.html>
<URL:http://online.securityfocus.com/archive/1/288998/2002-08-23/2002-08-29/0>
<URL:http://online.securityfocus.com/archive/1/288334/2002-08-16/2002-08-22/0>
<URL:http://online.securityfocus.com/archive/1/288305/2002-08-16/2002-08-22/0>
+------------------------------------------------------------------------+
Port name: samba
Affected: versions < samba-2.2.5
Status: Fixed
Possible buffer overflow.
<URL:http://lists.samba.org/pipermail/samba-technical/2002-June/037400.html>
+------------------------------------------------------------------------+
Port name: squid24
Affected: versions < squid-2.4_10
Status: Fixed
Buffer overflows may allow remote execution of code.
<URL:http://www.squid-cache.org/Advisories/SQUID-2002_3.txt>
+------------------------------------------------------------------------+
Port name: super
Affected: versions < super-3.20.0
Status: Fixed
Local root exploit.
<URL:http://online.securityfocus.com/archive/1/285241>
+------------------------------------------------------------------------+
Port name: webmin
Affected: versions < webmin-0.990_3
Status: Fixed
"If a webmin user is able to view print jobs, he can execute any
command as root."
<URL:http://www.webmin.com/updates.html>
+------------------------------------------------------------------------+
Port name: zmailer
Affected: versions < zmailer-2.99.51_1
Status: Fixed
When using IPv6, a remote buffer overflow during the processing of
the HELO command is possible.
Reported by 3APA3A <3APA3A@SECURITY.NNOV.RU>.
+------------------------------------------------------------------------+
III. Upgrading Ports/Packages
To upgrade a fixed port/package, perform one of the following:
1) Upgrade your Ports Collection and rebuild and reinstall the port.
Several tools are available in the Ports Collection to make this
easier. See:
/usr/ports/devel/portcheckout
/usr/ports/misc/porteasy
/usr/ports/sysutils/portupgrade
2) Deinstall the old package and install a new package obtained from
[i386]
ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/All/
Packages are not automatically generated for other architectures at
this time.
+------------------------------------------------------------------------+
FreeBSD Security Notices are communications from the Security Officer
intended to inform the user community about potential security issues,
such as bugs in the third-party applications found in the Ports
Collection, which will not be addressed in a FreeBSD Security
Advisory.
Feedback on Security Notices is welcome at <security-officer@FreeBSD.org>.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (FreeBSD)
iQCVAwUBPWz8glUuHi5z0oilAQGD3wP/XLvIayMoXfSUuuw4VVr84c3vqVk0t0rL
qZmLe+GaQ6Z5Fu/DfEta3HXhAPrlZx6dMWQfAbhjSyLfW8RpVkBlhbKR2ZImiddz
t2vz9LaADnWIdyRkI+4zpd9xIgpzB3MQwrkh6ZnnE3pqQ12S4TwfAKqwGm7DSShg
Ymz4mxfkiug=
=J67P
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to use any or all of this information is
the responsibility of each user or organisation, and should be done so in
accordance with site policies and procedures.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the original authors to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/Information/advisories.html
If you believe that your system has been compromised, contact AusCERT or
your representative in FIRST (Forum of Incident Response and Security
Teams).
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business
hours which are GMT+10:00 (AEST). On call after hours
for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key
iQCVAwUBPW5G7Ch9+71yA2DNAQGQPQP/RMNvKsKSsuXOsP+OvZ8Iq1Vvn5TRgFDS
FbZGZr4Mtkc2YoVXQ5+Pm8iAzHwdgXRZxWGvfubdd5zIe/QmkQ/UXzHFC/I1Ga3j
4kgx6CvjnTuk1+GQegRs98RMi9Vgq2HI6oWVd3NKHzD7q0r3NpH0lK7t+1wg6OEf
kAt701up9Bg=
=cZ+W
-----END PGP SIGNATURE-----