ID: 00053
Ref: 49/2005
Date: 21 January 2005:14:23:44
Version: 1
Title: Two Debian Security Advisories: 1. DSA 649-1 - New xtrlock packages fix authentication bypass 2. DSA 651-1 - New squid packages fix denial of service
Abstract:
Vendors affected: Debian
Operating systems affected: Debian
Applications affected: Debian
Title
=====
Two Debian Security Advisories:
1. DSA 649-1 - New xtrlock packages fix authentication bypass
2. DSA 651-1 - New squid packages fix denial of service
Detail
======
1. A buffer overflow has been discovered in xtrlock, a minimal X display lock
program which can be exploited by a malicious local attacker to crash the
lock program and take over the desktop session.
2. Several vulnerabilities have been discovered in Squid, the internet object
cache, the popular WWW proxy cache.
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
ESB-2005.0068 -- Debian Security Advisory DSA 649-1
New xtrlock packages fix authentication bypass
21 January 2005
===========================================================================
Product: xtrlock
Publisher: Debian
Operating System: Debian GNU/Linux 3.0
Linux variants
Impact: Inappropriate Access
Access: Console/Physical
CVE Names: CAN-2005-0079
Original Bulletin: http://www.debian.org/security/2005/dsa-649
- - --------------------------BEGIN INCLUDED TEXT--------------------
- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - - --------------------------------------------------------------------------
Debian Security Advisory DSA 649-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
January 20th, 2005 http://www.debian.org/security/faq
- - - --------------------------------------------------------------------------
Package : xtrlock
Vulnerability : buffer overflow
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2005-0079
Debian Bug : 278190 278191
A buffer overflow has been discovered in xtrlock, a minimal X display lock
program which can be exploited by a malicious local attacker to crash the
lock program and take over the desktop session.
For the stable distribution (woody) this problem has been fixed in version
2.0-6woody2.
For the unstable distribution (sid) this problem has been fixed in version 2.0-9.
We recommend that you upgrade your xtrlock package.
Upgrade Instructions
- - - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list
as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to
the proper configuration.
Debian GNU/Linux 3.0 alias woody
- - - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2.dsc
Size/MD5 checksum: 500 d39ea1ae4ee66338786d018406065022
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2.tar.gz
Size/MD5 checksum: 6977 6e6cfc0627bb74bd5014b550c2ea7a5f
Alpha architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_alpha.deb
Size/MD5 checksum: 9604 d05e56b7856e770b1b43daaf43a0dc3d
ARM architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_arm.deb
Size/MD5 checksum: 8604 f0d46d569f47ecb8a138c9f91be6cdc6
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_i386.deb
Size/MD5 checksum: 8730 63b6233b95553ffa59de4811c06a6502
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_ia64.deb
Size/MD5 checksum: 10104 ab12fc340b57cb3cbd58cbb0e6e1c188
HP Precision architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_hppa.deb
Size/MD5 checksum: 8988 cd59712f225ec6d790ad608a8c0dac3a
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_m68k.deb
Size/MD5 checksum: 8606 abac92671aefe845c7fd609668a9f367
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_mips.deb
Size/MD5 checksum: 8830 1a09a3a4e99e8c5f94a555ad8f9fc0c0
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_mipsel.deb
Size/MD5 checksum: 8828 7f56d17dd068abe7cb99a47f2e328fc9
PowerPC architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_powerpc.deb
Size/MD5 checksum: 8636 cd7dfdba990035bc942e1c16844eefcd
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_s390.deb
Size/MD5 checksum: 9128 f85ab602c4160b29bdb98170114b2368
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/x/xtrlock/xtrlock_2.0-6woody2_sparc.deb
Size/MD5 checksum: 11340 c5b11b174068e3b0ebc61aa5f6cf9412
These files will probably be moved into the stable distribution on
its next update.
- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list:
debian-security-announce@lists.debian.org
Package info: `apt-cache show
' and http://packages.debian.org/
- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB74S0W5ql+IAeqTIRApNNAJ90ul19QanusFjVAGWC0SAozK0DvgCffYYF
/oPUNRKDjXVfZv1kwhd326U=
=86PR
- - -----END PGP SIGNATURE-----
- - --------------------------END INCLUDED TEXT--------------------
iQCVAwUBQfBc0Sh9+71yA2DNAQJHdwP/Se0M8xqWd086cewbb4zm82XJKSzeQN8q
ktWeEH/wOs3Qn7F+h/b91oHcrZFg0fJX5phmHIh+eXi/CmxqA0SP7SZTqd1yAAuy
/hiWEQamUyrozQEwsSvPWTr6BcghpeNXJOPYiTVqhPGBp8fslAoa+Mc1EccOt63r
4Wj3CK4AaRA=
=HZhP
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
ESB-2005.0069 -- Debian Security Advisory DSA 651-1
New squid packages fix denial of service
21 January 2005
===========================================================================
Product: Squid 2.5.STABLE7 and prior
Publisher: Debian
Operating System: Debian GNU/Linux 3.0
Linux variants
Impact: Denial of Service
CVE Names: CAN-2005-0095 CAN-2005-0094
Original Bulletin: http://www.debian.org/security/2005/dsa-651
- - --------------------------BEGIN INCLUDED TEXT--------------------
- - -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - - --------------------------------------------------------------------------
Debian Security Advisory DSA 651-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
January 20th, 2005 http://www.debian.org/security/faq
- - - --------------------------------------------------------------------------
Package : squid
Vulnerability : buffer overflow, integer overflow
Problem-Type : remote
Debian-specific: no
CVE ID : CAN-2005-0094 CAN-2005-0095
Several vulnerabilities have been discovered in Squid, the internet object
cache, the popular WWW proxy cache. The Common Vulnerabilities and Exposures
Project identifies the following vulnerabilities:
CAN-2005-0094
"infamous41md" discovered a buffer overflow in the parser for
Gopher responses which will lead to memory corruption and usually
crash Squid.
CAN-2005-0095
"infamous41md" discovered an integer overflow in the receiver of
WCCP (Web Cache Communication Protocol) messages. An attacker
could send a specially crafted UDP datagram that will cause Squid
to crash.
For the stable distribution (woody) these problems have been fixed in version
2.4.6-2woody5.
For the unstable distribution (sid) these problems have been fixed in version
2.5.7-4.
We recommend that you upgrade your squid package.
Upgrade Instructions
- - - --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for sources.list
as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the footer to the
proper configuration.
Debian GNU/Linux 3.0 alias woody
- - - --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5.dsc
Size/MD5 checksum: 612 69bd41324bb88cc4a76fcacba1f6cb9b
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5.diff.gz
Size/MD5 checksum: 227846 52f6d82e486f23dba4240260dc64ea57
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6.orig.tar.gz
Size/MD5 checksum: 1081920 59ce2c58da189626d77e27b9702ca228
Alpha architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 814804 684a7a602a7dce53d3e2d5ea526cdfeb
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 75340 061412b8ca998b1ae5a7c576eac51425
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_alpha.deb
Size/MD5 checksum: 60094 8ecf3345226d4023c661cb5950929d5c
ARM architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 725286 b9103ba40dfcc47200b971a0ad123bb9
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 73116 fe083c2e4e65e0bcff82b42c292f9c69
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_arm.deb
Size/MD5 checksum: 58444 225728ea1d83a4f999cbcd1cbc918471
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 684376 bd4f50309316282ffdf9012e6a051349
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 72850 f0f790e828a53ae94406c68d8c386ac7
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_i386.deb
Size/MD5 checksum: 58014 9f2e5d189aa0df9d01d47c6870ca25f9
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 953366 146cb3cfadbb09b473289462fcb85c4e
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 79224 6a83889272e28d86602d86358929196b
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_ia64.deb
Size/MD5 checksum: 62766 6b48ca53c8bc2f0972a1b4653d04fa54
HP Precision architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 779204 684c9f7e7b7bd4abda5eda0890974951
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 74562 861f28d3d058c56d620ce557b488780f
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_hppa.deb
Size/MD5 checksum: 59574 16d03b269cb3d067cd6129b9bf1eccdc
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 665532 da4701e4506c91a7297ebe41314d88cd
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 72460 3ad96b1dc107bbaafd67592f8477bab4
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_m68k.deb
Size/MD5 checksum: 57678 0202dafa52ea24eb34c3d477459ad287
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 764854 c97c148f54c9d80e9d3d6c127894813b
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 74028 d49e9634ed353d8b713f4d80de731b61
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_mips.deb
Size/MD5 checksum: 58730 762b4bb651f8531208db4cd941a06560
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 764702 d134fdcf4916a521147f94837e2e544e
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 74118 9bdfc6bc5e7f752df213cdffb197f877
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_mipsel.deb
Size/MD5 checksum: 58838 edc757de19a59274fcb2a3d32791dcc0
PowerPC architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 722068 9c18747e4a7e6b15c05ab547efc59993
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 73100 7af618b2b8b1e225af2631a07da615d8
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_powerpc.deb
Size/MD5 checksum: 58322 23f79cf266df794a375ba75b2a973026
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 711584 f750ce9dd12460574b2c69031d3933bf
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 73442 e9a485219baaec097b7d432ba4ea8a26
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_s390.deb
Size/MD5 checksum: 58876 4ab64ae10b353e69facfcc59fa6fa0ab
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/s/squid/squid_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 724314 d4af1a337ee603d7b1039f132996b0bf
http://security.debian.org/pool/updates/main/s/squid/squid-cgi_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 75728 9974f32b84edb4969c9216742e9c9f73
http://security.debian.org/pool/updates/main/s/squid/squidclient_2.4.6-2woody5_sparc.deb
Size/MD5 checksum: 60762 a7aad73eabef840dd648ef058dc852d5
These files will probably be moved into the stable distribution on
its next update.
- - - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp:
ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list:
debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/
- - -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB7+UcW5ql+IAeqTIRAo+aAJwKdAQ/YxftQ5ERX3Du8dM3T364KQCfcSQH
blvaz7fbg6rkM9Hj0TopuLM=
=Kbp2
- - -----END PGP SIGNATURE-----
- - --------------------------END INCLUDED TEXT--------------------
iQCVAwUBQfBgZSh9+71yA2DNAQIAyAP8D4Tcs9qPKSbg1bH8/vTtd+C8OczhUChi
uR4HiNMImggnba3jXIPVycAQXVZVUfYTdlZ+c+D2Xtcoegl5jAtM2WH1IRgUY677
oeE+Ot6dguW1YwmlvtYHA8b03l5DlajZ5PnEALMmqNJO2aL3t1ZQdWmTTLnVsaYE
W3+FHgBTwO8=
=qb8J
- -----END PGP SIGNATURE-----