Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2006.0620 -- [RedHat] Moderate: kdegraphics security update 29 August 2006 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: kdegraphics (kfax) Publisher: Red Hat Operating System: Red Hat Enterprise Linux AS/ES/WS 3 Red Hat Desktop 3 Red Hat Enterprise Linux AS/ES/WS 2.1 Red Hat Linux Advanced Workstation 2.1 Impact: Execute Arbitrary Code/Commands Denial of Service Access: Remote/Unauthenticated CVE Names: CVE-2006-3465 CVE-2006-3464 CVE-2006-3463 CVE-2006-3462 CVE-2006-3461 CVE-2006-3460 CVE-2006-3459 Ref: ESB-2006.0541 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2006-0648.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: kdegraphics security update Advisory ID: RHSA-2006:0648-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2006-0648.html Issue date: 2006-08-28 Updated on: 2006-08-28 Product: Red Hat Enterprise Linux CVE Names: CVE-2006-3459 CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465 - - --------------------------------------------------------------------- 1. Summary: Updated kdegraphics packages that fix several security flaws in kfax are now available for Red Hat Enterprise Linux 2.1, and 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 3. Problem description: The kdegraphics package contains graphics applications for the K Desktop Environment. Tavis Ormandy of Google discovered a number of flaws in libtiff during a security audit. The kfax application contains a copy of the libtiff code used for parsing TIFF files and is therefore affected by these flaws. An attacker who has the ability to trick a user into opening a malicious TIFF file could cause kfax to crash or possibly execute arbitrary code. (CVE-2006-3459, CVE-2006-3460, CVE-2006-3461, CVE-2006-3462, CVE-2006-3463, CVE-2006-3464, CVE-2006-3465) Red Hat Enterprise Linux 4 is not vulnerable to these issues as kfax uses the shared libtiff library which has been fixed in a previous update. Users of kfax should upgrade to these updated packages, which contain backported patches and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 201313 - CVE-2006-3459 kfax affected by libtiff flaws (CVE-2006-3460 CVE-2006-3461 CVE-2006-3462 CVE-2006-3463 CVE-2006-3464 CVE-2006-3465) 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm ia64: b60111c884c0c11fe38c014fd2aa20a4 kdegraphics-2.2.2-4.4.ia64.rpm 8d3017d74b4c39ca38c6840127134b7d kdegraphics-devel-2.2.2-4.4.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/kdegraphics-2.2.2-4.4.src.rpm 7e02f00c6f0f04f4b2d344a4ec023d8f kdegraphics-2.2.2-4.4.src.rpm i386: 95b171e3e34fb770f40ca342201b8530 kdegraphics-2.2.2-4.4.i386.rpm 92d41638599ce40f99bd4dae53d4557d kdegraphics-devel-2.2.2-4.4.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm ppc: 9f6cdd9650db6608f972c42c76e8a4de kdegraphics-3.1.3-3.10.ppc.rpm 966ce65766809c0839f90bc7ee319f6d kdegraphics-debuginfo-3.1.3-3.10.ppc.rpm b452e2ef7748b702aa75b10dcc33f17c kdegraphics-devel-3.1.3-3.10.ppc.rpm s390: 866768918b02cd3601a304a59d15ad51 kdegraphics-3.1.3-3.10.s390.rpm ce2c5282ee6694998f105b322107489c kdegraphics-debuginfo-3.1.3-3.10.s390.rpm a3055e2cf71f6e7620a9c84a6058be7f kdegraphics-devel-3.1.3-3.10.s390.rpm s390x: 522c7089c601e9ed8d01e478503a795a kdegraphics-3.1.3-3.10.s390x.rpm e6e1f1c463c44748d85e1a073a96c30e kdegraphics-debuginfo-3.1.3-3.10.s390x.rpm 893a3ad832cfdc2e65ec585536717ca0 kdegraphics-devel-3.1.3-3.10.s390x.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/kdegraphics-3.1.3-3.10.src.rpm ef88572cbd568315228054297655ef86 kdegraphics-3.1.3-3.10.src.rpm i386: 854050e9b33c97244bb7d7c9e5448257 kdegraphics-3.1.3-3.10.i386.rpm 5b947fa999294d0458c4f9e28204609d kdegraphics-debuginfo-3.1.3-3.10.i386.rpm 5da00f57f88c1f99308ede725c43c73c kdegraphics-devel-3.1.3-3.10.i386.rpm ia64: 26bd834fd42ee5aeeab12cb1e7255f4f kdegraphics-3.1.3-3.10.ia64.rpm c1de4ef881ce270b2927afd8153b5d8e kdegraphics-debuginfo-3.1.3-3.10.ia64.rpm 7186b1f5ca78824f67b73cf9b83351d7 kdegraphics-devel-3.1.3-3.10.ia64.rpm x86_64: ce51d29598cdc0ac9aa433a669f37d7f kdegraphics-3.1.3-3.10.x86_64.rpm 0e243626db71c4d70fe76055684af12f kdegraphics-debuginfo-3.1.3-3.10.x86_64.rpm f83a0c0a9cedf3728b6cc02f12cac6e6 kdegraphics-devel-3.1.3-3.10.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3459 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3460 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3461 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3462 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3463 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3464 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3465 http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2006 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.1 (GNU/Linux) iD8DBQFE8uTyXlSAg2UNWIIRAqozAJ415P8NQEd17yEn6pvMCW+S2XQDUQCeNGsT aJzT9G/eEPRFHU3SieZ4zFM= =cEPk - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRPOSkih9+71yA2DNAQJxEQP9HQLlabM1RKCZ/ySL+JNP5yptDPzKzkxv HNyX0Pl70wDyr4HY5wKqrVrxMn/zRkvGYKU0M74aGk4cIqyqI2AdePj31WmDkFLE JC+WEwduQ1ZiPsxvIijyaDwCzjV/INS7dkw6Bc85yvYnOXt2QG/gD8bp4eyaapkL 2OM9ohsX5AA= =0gQb -----END PGP SIGNATURE-----