-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                   ESB-2007.0201 -- [UNIX/Linux][Debian]
           New nas packages fix multiple remote vulnerabilities
                               28 March 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              nas
Publisher:            Debian
Operating System:     Debian GNU/Linux 3.1
                      UNIX variants (UNIX, Linux, OSX)
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-1547 CVE-2007-1546 CVE-2007-1545
                      CVE-2007-1544 CVE-2007-1543

Original Bulletin:    http://www.debian.org/security/2007/dsa-1273

Comment: This advisory references vulnerabilities in products which run on
         platforms other than Debian. It is recommended that administrators
         running nas check for an updated version of the software for
         their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-1273-1                security@debian.org
http://www.debian.org/security/                         Noah Meyerhans
March 27, 2007
- - ------------------------------------------------------------------------

Package        : nas
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2007-1543 CVE-2007-1544 CVE-2007-1545 CVE-2007-1546 CVE-2007-1547
BugTraq ID     : 23017
Debian Bug     : 416038

Several vulnerabilities have been discovered in nas, the Network Audio
System.

CVE-2007-1543 

A stack-based buffer overflow in the accept_att_local function in
server/os/connection.c in nas allows remote attackers to execute
arbitrary code via a long path slave name in a USL socket connection.

CVE-2007-1544

Integer overflow in the ProcAuWriteElement function in
server/dia/audispatch.c allows remote attackers to cause a denial of
service (crash) and possibly execute arbitrary code via a large
max_samples value.

CVE-2007-1545

The AddResource function in server/dia/resource.c allows remote
attackers to cause a denial of service (server crash) via a
nonexistent client ID.

CVE-2007-1546

Array index error allows remote attackers to cause a denial of service
(crash) via (1) large num_action values in the ProcAuSetElements
function in server/dia/audispatch.c or (2) a large inputNum parameter
to the compileInputs function in server/dia/auutil.c.

CVE-2007-1547

The ReadRequestFromClient function in server/os/io.c allows remote
attackers to cause a denial of service (crash) via multiple
simultaneous connections, which triggers a NULL pointer dereference.


For the stable distribution (sarge), these problems have been fixed in
version 1.7-2sarge1

For the upcoming stable distribution (etch) and the unstable
distribution (sid) these packages have been fixed in version 1.8-4.

We recommend that you upgrade your nas package.

Upgrade instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 3.1 (stable)
- - -------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/n/nas/nas_1.7.orig.tar.gz
    Size/MD5 checksum:  1288569 c9918e9c9c95d587a95b455bbabe3b49
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1.dsc
    Size/MD5 checksum:      693 2f0821d157ae249adfda1ddcf39bf9aa
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1.diff.gz
    Size/MD5 checksum:   124076 b057e678fb808ef95666d766944ce498

Architecture independent packages:

  http://security.debian.org/pool/updates/main/n/nas/nas-doc_1.7-2sarge1_all.deb
    Size/MD5 checksum:   150478 744cbca330f9f8463a36251836514cc4

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_alpha.deb
    Size/MD5 checksum:    82560 ac84bfe7e6f04f0693b787b33c5a1890
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_alpha.deb
    Size/MD5 checksum:  1330046 e8b1709f240ca6ee0c7e893a6d4598ac
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_alpha.deb
    Size/MD5 checksum:   622528 6d14250da6aab5da4737af8d2f3d4930
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_alpha.deb
    Size/MD5 checksum:   120098 2efb7c2fd2c6cfbce699789f7b1e9782

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_amd64.deb
    Size/MD5 checksum:  1291220 019146fc7d079820c088bf1a597a91bf
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_amd64.deb
    Size/MD5 checksum:   102672 40c936bde0db91e5cef3f90c88c03168
  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_amd64.deb
    Size/MD5 checksum:    74620 e8d8d3d5ec14dcfdb8285d6eb5e6b67b
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_amd64.deb
    Size/MD5 checksum:   526904 7cc01f5259953f12f0f82cbd1b6ecc62

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_arm.deb
    Size/MD5 checksum:    70894 b55f037fe9266c92d3a3b9650ae750d7
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_arm.deb
    Size/MD5 checksum:  1201362 99b1f795e47faf04db5a3b9ec8ed3440
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_arm.deb
    Size/MD5 checksum:   473996 863cc92b5e937cc44e6f3e13f023a374
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_arm.deb
    Size/MD5 checksum:    97152 dd196d5474c9e68b9096c44a7d72bf5e

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_hppa.deb
    Size/MD5 checksum:    78114 393d231f6d67274102dff5526043dc57
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_hppa.deb
    Size/MD5 checksum:   107144 da99e90ee80eb1f1e266c85701d26007
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_hppa.deb
    Size/MD5 checksum:  1310940 1c94b9c41c36e8255396c9ffd400aee5
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_hppa.deb
    Size/MD5 checksum:   570894 084753a5ebc4ea153a56cc18fb784904

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_i386.deb
    Size/MD5 checksum:    95234 edcc7d8210a2acac10c84547cfa3d2c2
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_i386.deb
    Size/MD5 checksum:  1189584 20f53c488e517d53e6aa517fd4a2076a
  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_i386.deb
    Size/MD5 checksum:    71866 df4b413ad699008cfe5b96b46aab5d0b
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_i386.deb
    Size/MD5 checksum:   495476 2571d898d1921adeafa543a1709d0e2a

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_ia64.deb
    Size/MD5 checksum:   746720 d9a7f324f9d4c562c197fd93b24cd3ab
  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_ia64.deb
    Size/MD5 checksum:    95382 cf266077d4f01eadb95f27ecdad79c3a
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_ia64.deb
    Size/MD5 checksum:  1325658 3cb330c6a614a2aba983b5a06bc0e70b
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_ia64.deb
    Size/MD5 checksum:   133454 a4b8eb9bf242d0c5e92da9996099a3c0

m68k architecture (Motorola Mc680x0)

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_m68k.deb
    Size/MD5 checksum:    67186 5b214ce898aa6f629f31eb0efacae4e6
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_m68k.deb
    Size/MD5 checksum:  1260302 a0132b9f2fa66dd587a39e6bfbca6622
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_m68k.deb
    Size/MD5 checksum:    88438 f24d7a213264eff51574b4b51dc1e0bc
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_m68k.deb
    Size/MD5 checksum:   418440 6f0f7e8c7f7b0b948f6efafa84547905

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_mips.deb
    Size/MD5 checksum:  1289470 adeb481ca91d7671a549687ad1b39c5a
  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_mips.deb
    Size/MD5 checksum:    72522 6da040afd23c865e6c9e7e6d945d2457
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_mips.deb
    Size/MD5 checksum:   550000 b97c0b1c75e957549d20c7c2c9b6be59
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_mips.deb
    Size/MD5 checksum:   108754 feefdb5bedf589515f2a5ed3b2a0a2a3

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_mipsel.deb
    Size/MD5 checksum:    72440 6e2a76e66b1d68798f1fc5aeac325a6d
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_mipsel.deb
    Size/MD5 checksum:  1239994 c1628d859aee3dd011e9c1b380f12ddc
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_mipsel.deb
    Size/MD5 checksum:   550010 4e3be289e9fd903feca4bbdd99bf0996
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_mipsel.deb
    Size/MD5 checksum:   108672 2baa553b2134c1a5274f210fc5d74502

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_powerpc.deb
    Size/MD5 checksum:   100542 607cdd05f11daf5d000840f831a0537c
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_powerpc.deb
    Size/MD5 checksum:   531068 ef8f43c27a398a651a3cff195ef603a3
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_powerpc.deb
    Size/MD5 checksum:  1439084 cf1e5f85964ed34733cb31532269e543
  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_powerpc.deb
    Size/MD5 checksum:    74744 fd09f58e22639db4e074cff228c98a37

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/n/nas/libaudio2_1.7-2sarge1_sparc.deb
    Size/MD5 checksum:    70474 d527e90baffd8d2829ab4e877344eef0
  http://security.debian.org/pool/updates/main/n/nas/nas_1.7-2sarge1_sparc.deb
    Size/MD5 checksum:    96474 2af98815309ed2d313e029dc6676c670
  http://security.debian.org/pool/updates/main/n/nas/libaudio-dev_1.7-2sarge1_sparc.deb
    Size/MD5 checksum:  1295200 23a1e3a875f841023f456dd7e8f8429d
  http://security.debian.org/pool/updates/main/n/nas/nas-bin_1.7-2sarge1_sparc.deb
    Size/MD5 checksum:   473026 6494ad53d51495b309f5f6b7d122c585


  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGCVmPYrVLjBFATsMRAqXvAJwPemwuLAFmZFoNU5gablYio1BFngCdGF0T
6z9uonEqwbYyavaweo3Jq9M=
=VPhs
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRgnHhyh9+71yA2DNAQLHxgP/W+5FpfIlkTmyb0xPyPe0+Axcd5qbZnGN
pyjuox7+g8qpDERcF2MB0hJDvh4Uat1MpecpKewerkIYmSND6uZg36HBwsOayhRg
RgbTv+/LJN3eJ3DWKyHTTDh7h5baLgNzgsliHbrO4n8sCDjbt517GIRKelHWJL8b
vFAcr1ZmHWc=
=uL63
-----END PGP SIGNATURE-----