October 2005
Mandriva - Three Security Update Advisories
ID: 00907
Ref: 847/05
Date: 14 October 2005:11:47:37
Version: 1
Title: Mandriva - Three Security Update Advisories
Abstract: 1. Updated curl packages fix NTLM authentication vulnerability [MDKSA-2005:182] , 2. Updated wget packages fix NTLM authentication vulnerability [MDKSA-2005:183] , 3. Updated cfengine packages fix temporary file vulnerabilities [MDKSA-2005:184]
Vendors affected: Mandriva
Operating systems affected: Mandriva
Applications affected: Mandriva
Title
=====
Mandriva - Three Security Update Advisories:
1. Updated curl packages fix NTLM authentication vulnerability [MDKSA-2005:182]
2. Updated wget packages fix NTLM authentication vulnerability [MDKSA-2005:183]
3. Updated cfengine packages fix temporary file vulnerabilities [MDKSA-2005:184]
Detail
======
Security update advisory summaries:
1. A vulnerability in libcurl's NTLM function can overflow a stack-based
buffer if given too long a user name or domain name in NTLM
authentication is enabled and either a) pass a user and domain name to
libcurl that together are longer than 192 bytes or b) allow (lib)curl
to follow HTTP redirects and the new URL contains a URL with a user and
domain name that together are longer than 192 bytes.
2. A vulnerability in libcurl's NTLM function can overflow a stack-based
buffer if given too long a user name or domain name. Wget, as of version
1.10, uses the NTLM code from libcurl and is also vulnerable to this issue.
3. Javier Fernández-Sanguino Peña discovered several insecure temporary
file uses in cfengine <= 1.6.5 and <= 2.1.16. In addition, Javier discovered
the cfmailfilter and cfcron.in files for cfengine <= 1.6.5 allow local users
to overwrite arbitrary files via a symlink attack on temporary files
(CAN-2005-3137).
Security update advisory content follows:
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Update Advisory
_______________________________________________________________________
Package name: curl
Advisory ID: MDKSA-2005:182
Date: October 13th, 2005
Affected versions: 10.1, 10.2, 2006.0, Corporate 3.0,
Multi Network Firewall 2.0
______________________________________________________________________
Problem Description:
A vulnerability in libcurl's NTLM function can overflow a stack-based
buffer if given too long a user name or domain name in NTLM
authentication is enabled and either a) pass a user and domain name to
libcurl that together are longer than 192 bytes or b) allow (lib)curl
to follow HTTP redirects and the new URL contains a URL with a user and
domain name that together are longer than 192 bytes.
The updated packages have been patched to address this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3185
http://curl.haxx.se/mail/lib-2005-10/0061.html
______________________________________________________________________
Updated Packages:
Mandrivalinux 10.1:
f03596cfd096487930950f055113e25e 10.1/RPMS/curl-7.12.1-1.2.101mdk.i586.rpm
888d28bd88686516b965801d4fa73ef5 10.1/RPMS/libcurl3-7.12.1-1.2.101mdk.i586.rpm
14119a5933519cd326eab4b6912f9c89 10.1/RPMS/libcurl3-devel-7.12.1-1.2.101mdk.i586.rpm
95e5c325854b56bcc049ace852aacad9 10.1/SRPMS/curl-7.12.1-1.2.101mdk.src.rpm
Mandrivalinux 10.1/X86_64:
c8672912f86bbb916d12e9e1868230eb x86_64/10.1/RPMS/curl-7.12.1-1.2.101mdk.x86_64.rpm
bd80d2720507b859b8da2df5f67fbf6a x86_64/10.1/RPMS/lib64curl3-7.12.1-1.2.101mdk.x86_64.rpm
62e47838707d23ccf8e55c495458aaa6 x86_64/10.1/RPMS/lib64curl3-devel-7.12.1-1.2.101mdk.x86_64.rpm
95e5c325854b56bcc049ace852aacad9 x86_64/10.1/SRPMS/curl-7.12.1-1.2.101mdk.src.rpm
Mandrivalinux 10.2:
02917ae6640125c7fd60dfe1d4c435af 10.2/RPMS/curl-7.13.1-2.1.102mdk.i586.rpm
2547b81f7043b55a0b346e74817d5664 10.2/RPMS/libcurl3-7.13.1-2.1.102mdk.i586.rpm
b1f52fa823b34b43cb925cef0f4ca554 10.2/RPMS/libcurl3-devel-7.13.1-2.1.102mdk.i586.rpm
853ad6f024fe5247d8e97c081c854476 10.2/SRPMS/curl-7.13.1-2.1.102mdk.src.rpm
Mandrivalinux 10.2/X86_64:
30c2447b5a8066da44547f30e8693aed x86_64/10.2/RPMS/curl-7.13.1-2.1.102mdk.x86_64.rpm
aef8bdd4c0bda5743915c563dea36ee7 x86_64/10.2/RPMS/lib64curl3-7.13.1-2.1.102mdk.x86_64.rpm
9da4ae9331b99a7a2a07acd2d4c2cb5a x86_64/10.2/RPMS/lib64curl3-devel-7.13.1-2.1.102mdk.x86_64.rpm
853ad6f024fe5247d8e97c081c854476 x86_64/10.2/SRPMS/curl-7.13.1-2.1.102mdk.src.rpm
Mandrivalinux 2006.0:
07805740a9f93561d6ac56918a781245 2006.0/RPMS/curl-7.14.0-2.1.20060mdk.i586.rpm
3d97dd7714cbe0b198683163467c0d6f 2006.0/RPMS/libcurl3-7.14.0-2.1.20060mdk.i586.rpm
6a7d8ed065b64e03e3bdd12c60611655 2006.0/RPMS/libcurl3-devel-7.14.0-2.1.20060mdk.i586.rpm
850cab614960f3a8ea2121d5e35457af 2006.0/SRPMS/curl-7.14.0-2.1.20060mdk.src.rpm
Mandrivalinux 2006.0/X86_64:
aa1ccbb76d1f0a706c72c44028d8e4cc x86_64/2006.0/RPMS/curl-7.14.0-2.1.20060mdk.x86_64.rpm
ec71600f685de4c15211c83a399bd04a x86_64/2006.0/RPMS/lib64curl3-7.14.0-2.1.20060mdk.x86_64.rpm
b791d65f418fd714466f07549f8688fd x86_64/2006.0/RPMS/lib64curl3-devel-7.14.0-2.1.20060mdk.x86_64.rpm
850cab614960f3a8ea2121d5e35457af x86_64/2006.0/SRPMS/curl-7.14.0-2.1.20060mdk.src.rpm
Multi Network Firewall 2.0:
791c952a30b42a72f385ece06fdd1f47 mnf/2.0/RPMS/curl-7.11.0-2.2.M20mdk.i586.rpm
717b91b2099ad4132ce54dc8da3cff44 mnf/2.0/RPMS/libcurl2-7.11.0-2.2.M20mdk.i586.rpm
6fdb16af536f1539ce60cecefd2db61b mnf/2.0/SRPMS/curl-7.11.0-2.2.M20mdk.src.rpm
Corporate 3.0:
40231d093f311328f0985db5f71ae7f9 corporate/3.0/RPMS/curl-7.11.0-2.2.C30mdk.i586.rpm
7974dc65bf872a05910a0017383f34a1 corporate/3.0/RPMS/libcurl2-7.11.0-2.2.C30mdk.i586.rpm
70f87a4964fdba5256d475796a6af4d8 corporate/3.0/RPMS/libcurl2-devel-7.11.0-2.2.C30mdk.i586.rpm
a952e90be7922ed1b153fca1c94b0d9b corporate/3.0/SRPMS/curl-7.11.0-2.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
6b34e27cc2729a905359d616ea98677f x86_64/corporate/3.0/RPMS/curl-7.11.0-2.2.C30mdk.x86_64.rpm
36f7fbf58702e2a3d7d49fd384d9ae91 x86_64/corporate/3.0/RPMS/lib64curl2-7.11.0-2.2.C30mdk.x86_64.rpm
03d4b8f01e1b916afeff6d51b7b04581 x86_64/corporate/3.0/RPMS/lib64curl2-devel-7.11.0-2.2.C30mdk.x86_64.rpm
a952e90be7922ed1b153fca1c94b0d9b x86_64/corporate/3.0/SRPMS/curl-7.11.0-2.2.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDTyYPmqjQ0CJFipgRAm7qAJ9JzbVvA8NTm0+cpEwGqw2BJEbJuQCgqD93
2XvbwtU9G5LK6h3Ax0fbD5g=
=hjAK
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Update Advisory
_______________________________________________________________________
Package name: wget
Advisory ID: MDKSA-2005:183
Date: October 13th, 2005
Affected versions: 2006.0
______________________________________________________________________
Problem Description:
A vulnerability in libcurl's NTLM function can overflow a stack-based
buffer if given too long a user name or domain name in NTLM
authentication is enabled and either a) pass a user and domain name to
libcurl that together are longer than 192 bytes or b) allow (lib)curl
to follow HTTP redirects and the new URL contains a URL with a user and
domain name that together are longer than 192 bytes.
Wget, as of version 1.10, uses the NTLM code from libcurl and is also
vulnerable to this issue.
The updated packages have been patched to address this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3185
http://curl.haxx.se/mail/lib-2005-10/0061.html
______________________________________________________________________
Updated Packages:
Mandrivalinux 2006.0:
b902b06ea1316dbcdf17796aa548a77e 2006.0/RPMS/wget-1.10-1.1.20060mdk.i586.rpm
08749a1759b1b583b08393411dfced5a 2006.0/SRPMS/wget-1.10-1.1.20060mdk.src.rpm
Mandrivalinux 2006.0/X86_64:
c885bd2f1e463c7753c7ca562fc20942 x86_64/2006.0/RPMS/wget-1.10-1.1.20060mdk.x86_64.rpm
08749a1759b1b583b08393411dfced5a x86_64/2006.0/SRPMS/wget-1.10-1.1.20060mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDTyZ9mqjQ0CJFipgRAsPWAJwNFU9myzCrq1DK78fYvZnEIZ8lIwCg3Fuf
DeWqnJeKb6x3YGE0p8diykg=
=vo8Z
- -----END PGP SIGNATURE-----
3.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Update Advisory
_______________________________________________________________________
Package name: cfengine
Advisory ID: MDKSA-2005:184
Date: October 13th, 2005
Affected versions: 10.1, 10.2, 2006.0, Corporate 3.0,
Corporate Server 2.1
______________________________________________________________________
Problem Description:
Javier Fernández-Sanguino Peña discovered several insecure temporary
file uses in cfengine <= 1.6.5 and <= 2.1.16 which allows local users
to overwrite arbitrary files via a symlink attack on temporary files
used by vicf.in. (CAN-2005-2960)
In addition, Javier discovered the cfmailfilter and cfcron.in files
for cfengine <= 1.6.5 allow local users to overwrite arbitrary files
via a symlink attack on temporary files (CAN-2005-3137)
The updated packages have been patched to address this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2960
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3137
______________________________________________________________________
Updated Packages:
Mandrivalinux 10.1:
acf648169c296d474886d1d98752a763 10.1/RPMS/cfengine-1.6.5-4.3.101mdk.i586.rpm
176cbf5b72aba7c6a2b40daf4ee09c94 10.1/SRPMS/cfengine-1.6.5-4.3.101mdk.src.rpm
Mandrivalinux 10.1/X86_64:
a9bed51735d6762fe3e1d66c8657f65a x86_64/10.1/RPMS/cfengine-1.6.5-4.3.101mdk.x86_64.rpm
176cbf5b72aba7c6a2b40daf4ee09c94 x86_64/10.1/SRPMS/cfengine-1.6.5-4.3.101mdk.src.rpm
Mandrivalinux 10.2:
426fd00421697c85c0e63f527faac7e8 10.2/RPMS/cfengine-2.1.12-7.2.102mdk.i586.rpm
edd39a03e85f5176a0c28667cc91c388 10.2/RPMS/cfengine-cfservd-2.1.12-7.2.102mdk.i586.rpm
5c9a0c525c45a802f5d89686123e751c 10.2/SRPMS/cfengine-2.1.12-7.2.102mdk.src.rpm
Mandrivalinux 10.2/X86_64:
e75f232aa540e80fb9a12558d0c1f105 x86_64/10.2/RPMS/cfengine-2.1.12-7.2.102mdk.x86_64.rpm
3680ec121accdf0cdf1830b374d804ee x86_64/10.2/RPMS/cfengine-cfservd-2.1.12-7.2.102mdk.x86_64.rpm
5c9a0c525c45a802f5d89686123e751c x86_64/10.2/SRPMS/cfengine-2.1.12-7.2.102mdk.src.rpm
Mandrivalinux 2006.0:
61f3c7fe9cf1a69e889cfa4d476473af 2006.0/RPMS/cfengine-base-2.1.15-2.2.20060mdk.i586.rpm
5a7d6087787de6a9f98288c415562ced 2006.0/RPMS/cfengine-cfagent-2.1.15-2.2.20060mdk.i586.rpm
0cd9ecbccf2a0b4e775d6629b1b7416f 2006.0/RPMS/cfengine-cfenvd-2.1.15-2.2.20060mdk.i586.rpm
5c10e7371d807d4f42f2524f24809a92 2006.0/RPMS/cfengine-cfexecd-2.1.15-2.2.20060mdk.i586.rpm
0bd54480c32575625f3d42badf59d690 2006.0/RPMS/cfengine-cfservd-2.1.15-2.2.20060mdk.i586.rpm
1b3213afe77bd75af306a63f746994cd 2006.0/SRPMS/cfengine-2.1.15-2.2.20060mdk.src.rpm
Mandrivalinux 2006.0/X86_64:
e81ea72b0431a8cc40753a6dee7037d2 x86_64/2006.0/RPMS/cfengine-base-2.1.15-2.2.20060mdk.x86_64.rpm
f997658d8fa1dea25353906141443ba9 x86_64/2006.0/RPMS/cfengine-cfagent-2.1.15-2.2.20060mdk.x86_64.rpm
bc560e64dc5de8046b9d14be43621a10 x86_64/2006.0/RPMS/cfengine-cfenvd-2.1.15-2.2.20060mdk.x86_64.rpm
1d3cb518f0266f57c182712350935fb8 x86_64/2006.0/RPMS/cfengine-cfexecd-2.1.15-2.2.20060mdk.x86_64.rpm
db890abf046c63d91fc5fb60c6b796a8 x86_64/2006.0/RPMS/cfengine-cfservd-2.1.15-2.2.20060mdk.x86_64.rpm
1b3213afe77bd75af306a63f746994cd x86_64/2006.0/SRPMS/cfengine-2.1.15-2.2.20060mdk.src.rpm
Corporate Server 2.1:
12057e0591bdb14e49b74d5c1c268196 corporate/2.1/RPMS/cfengine-1.6.3-8.3.C21mdk.i586.rpm
4026484a33d7d324da1dce56fd697842 corporate/2.1/SRPMS/cfengine-1.6.3-8.3.C21mdk.src.rpm
Corporate Server 2.1/X86_64:
4dc4d9a367d056f053af80118cee8886 x86_64/corporate/2.1/RPMS/cfengine-1.6.3-8.3.C21mdk.x86_64.rpm
4026484a33d7d324da1dce56fd697842 x86_64/corporate/2.1/SRPMS/cfengine-1.6.3-8.3.C21mdk.src.rpm
Corporate 3.0:
0c82f22f7ef0f6db35eb5f19caba9d2d corporate/3.0/RPMS/cfengine-1.6.5-3.3.C30mdk.i586.rpm
ac84162471431da5f5afae45d48ca5c8 corporate/3.0/SRPMS/cfengine-1.6.5-3.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
bb704e30c6f6c0edb0b03d6a6d6c62d3 x86_64/corporate/3.0/RPMS/cfengine-1.6.5-3.3.C30mdk.x86_64.rpm
ac84162471431da5f5afae45d48ca5c8 x86_64/corporate/3.0/SRPMS/cfengine-1.6.5-3.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFDTybimqjQ0CJFipgRAnAGAKCwLA12aj2WBEZPLtGTHajy6/2QggCcCkA5
FWV/Ex2QdPdLfLAJjl/YiME=
=RgFb
- -----END PGP SIGNATURE-----