December 2005
Gentoo - Security Advisories
ID: 01139
Ref: 1071/2005
Date: 28 December 2005:22:02:30
Version: 1
Title: Gentoo - Security Advisories
Abstract: Details of Gentoo advisories concerning Dropbear, NBD Tools, rssh and OpenMotif
Vendors affected: Gentoo
Operating systems affected: Gentoo
Applications affected: Gentoo
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200512-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: Dropbear: Privilege escalation
Date: December 23, 2005
Bugs: #116006
ID: 200512-13
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
A buffer overflow in Dropbear could allow authenticated users to
execute arbitrary code as the root user.
Background
==========
Dropbear is an SSH server and client with a small memory footprint.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-misc/dropbear < 0.47 >= 0.47
Description
===========
Under certain conditions Dropbear could fail to allocate a sufficient
amount of memory, possibly resulting in a buffer overflow.
Impact
======
By sending specially crafted data to the server, authenticated users
could exploit this vulnerability to execute arbitrary code with the
permissions of the SSH server user, which is the root user by default.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Dropbear users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-misc/dropbear-0.47"
References
==========
[ 1 ] CVE-2005-4178
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4178
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200512-13.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200512-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: NBD Tools: Buffer overflow in NBD server
Date: December 23, 2005
Bugs: #116314
ID: 200512-14
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The NBD server is vulnerable to a buffer overflow that may result in
the execution of arbitrary code.
Background
==========
The NBD Tools are the Network Block Device utilities allowing one to
use remote block devices over a TCP/IP network. It includes a userland
NBD server.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 sys-block/nbd < 2.8.2-r1 >= 2.8.2-r1
Description
===========
Kurt Fitzner discovered that the NBD server allocates a request buffer
that fails to take into account the size of the reply header.
Impact
======
A remote attacker could send a malicious request that can result in the
execution of arbitrary code with the rights of the NBD server.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All NBD Tools users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-block/nbd-2.8.2-r1"
References
==========
[ 1 ] CVE-2005-3534
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3534
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200512-14.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200512-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: rssh: Privilege escalation
Date: December 27, 2005
Bugs: #115082
ID: 200512-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Local users could gain root privileges by chrooting into arbitrary
directories.
Background
==========
rssh is a restricted shell, allowing only a few commands like scp or
sftp. It is often used as a complement to OpenSSH to provide limited
access to users.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-shells/rssh < 2.3.0 >= 2.3.0
Description
===========
Max Vozeler discovered that the rssh_chroot_helper command allows local
users to chroot into arbitrary directories.
Impact
======
A local attacker could exploit this vulnerability to gain root
privileges by chrooting into arbitrary directories.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All rssh users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-shells/rssh-2.3.0"
References
==========
[ 1 ] CVE-2005-3345
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3345
[ 2 ] rssh security announcement
http://www.pizzashack.org/rssh/security.shtml
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200512-15.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200512-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Low
Title: OpenMotif, AMD64 x86 emulation X libraries: Buffer overflows
in libUil library
Date: December 28, 2005
Bugs: #114234, #116481
ID: 200512-16
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Two buffer overflows have been discovered in libUil, part of the
OpenMotif toolkit, that can potentially lead to the execution of
arbitrary code.
Background
==========
OpenMotif provides a free version of the Motif toolkit for open source
applications. The OpenMotif libraries are included in the AMD64 x86
emulation X libraries, which emulate the x86 (32-bit) architecture on
the AMD64 (64-bit) architecture.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 openmotif < 2.2.3-r8 >= 2.2.3-r8
*>= 2.1.30-r13
2 emul-linux-x86-xlibs < 2.2.1 >= 2.2.1
-------------------------------------------------------------------
# Package 2 [app-emulation/emul-linux-x86-xlibs] only applies to
AMD64 users.
NOTE: Any packages listed without architecture tags apply to all
architectures...
-------------------------------------------------------------------
2 affected packages
-------------------------------------------------------------------
Description
===========
xfocus discovered two potential buffer overflows in the libUil library,
in the diag_issue_diagnostic and open_source_file functions.
Impact
======
Remotely-accessible or SUID applications making use of the affected
functions might be exploited to execute arbitrary code with the
privileges of the user running the application.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All OpenMotif users should upgrade to an unaffected version:
# emerge --sync
# emerge --ask --oneshot --verbose x11-libs/openmotif
All AMD64 x86 emulation X libraries users should upgrade to the latest
version:
# emerge --sync
# emerge --ask --oneshot --verbose app-emulation/emul-linux-x86-xlibs
References
==========
[ 1 ] CVE-2005-3964
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3964
[ 2 ] xfocus SD-051202 Original Advisory
http://archives.neohapsis.com/archives/fulldisclosure/2005-12/0047.html
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200512-16.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0