January 2005
Four Gentoo Linux Security Advisories
ID: 00081
Ref: 67/2005
Date: 31 January 2005:14:23:01
Version: 1
Title: Four Gentoo Linux Security Advisories
Abstract:
Vendors affected: Gentoo
Operating systems affected: Gentoo
Applications affected: Gentoo
Title
=====
Four Gentoo Linux Security Advisories:
1. GLSA 200501-37 - GraphicsMagick: PSD decoding heap overflow
2. GLSA 200501-38 - Perl: rmtree and DBI tmpfile vulnerabilities
3. GLSA 200501-39 - SquirrelMail: Multiple vulnerabilities
4. GLSA 200501-40 - ngIRCd: Buffer overflow
Detail
======
1. Andrei Nigmatulin discovered that handling a Photoshop Document (PSD)
file with more than 24 layers in ImageMagick could trigger a heap
overflow (GLSA 200501-26). GraphicsMagick is based on the same code
and therefore suffers from the same flaw.
2. Javier Fernandez-Sanguino Pena discovered that the DBI library creates
temporary files in an insecure, predictable way (CAN-2005-0077). Paul
Szabo found out that "File::Path::rmtree" also handles temporary files
insecurely (CAN-2004-0452).
3. SquirrelMail fails to properly sanitize certain strings when decoding
specially-crafted strings, which can lead to PHP file inclusion and XSS.
4. Florian Westphal discovered a buffer overflow caused by an integer
underflow in the Lists_MakeMask() function of lists.c.
1.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: GraphicsMagick: PSD decoding heap overflow
Date: January 26, 2005
Bugs: #79336
ID: 200501-37
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
GraphicsMagick is vulnerable to a heap overflow when decoding Photoshop
Document (PSD) files, which could lead to arbitrary code execution.
Background
==========
GraphicsMagick is a collection of tools to read, write and manipulate
images in many formats. GraphicsMagick is originally derived from
ImageMagick 5.5.2.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 media-gfx/graphicsmagick < 1.1.5 >= 1.1.5
Description
===========
Andrei Nigmatulin discovered that handling a Photoshop Document (PSD)
file with more than 24 layers in ImageMagick could trigger a heap
overflow (GLSA 200501-26). GraphicsMagick is based on the same code
and therefore suffers from the same flaw.
Impact
======
An attacker could potentially design a malicious PSD image file to
cause arbitrary code execution with the permissions of the user
running GraphicsMagick.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All GraphicsMagick users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=media-gfx/graphicsmagick-1.1.5"
References
==========
[ 1 ] CAN-2005-0005
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0005
[ 2 ] GLSA 200501-26
http://www.gentoo.org/security/en/glsa/glsa-200501-26.xml
Availability
============
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200501-37.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
2.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-38
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Perl: rmtree and DBI tmpfile vulnerabilities
Date: January 26, 2005
Bugs: #78634, #75696
ID: 200501-38
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The Perl DBI library and File::Path::rmtree function are vulnerable to
symlink attacks.
Background
==========
Perl is a cross platform programming language. The DBI is the standard
database interface module for Perl.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-perl/dbi <= 1.38 *>= 1.37-r1
>= 1.38-r1
2 dev-lang/perl <= 5.8.6-r1 >= 5.8.6-r2
*>= 5.8.5-r3
*>= 5.8.4-r2
*>= 5.8.2-r2
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Javier Fernandez-Sanguino Pena discovered that the DBI library creates
temporary files in an insecure, predictable way (CAN-2005-0077). Paul
Szabo found out that "File::Path::rmtree" also handles temporary files
insecurely (CAN-2004-0452).
Impact
======
A local attacker could create symbolic links in the temporary files
directory that point to a valid file somewhere on the filesystem. When
the DBI library or File::Path::rmtree is executed, this could be used
to overwrite files with the rights of the user calling these functions.
Workaround
==========
There are no known workarounds at this time.
Resolution
==========
All Perl users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose dev-lang/perl
All DBI library users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose dev-perl/dbi
References
==========
[ 1 ] CAN-2005-0077
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0077
[ 2 ] CAN-2004-0452
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0452
Availability
============
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200501-38.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
3.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-39
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: SquirrelMail: Multiple vulnerabilities
Date: January 28, 2005
Bugs: #78116
ID: 200501-39
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
SquirrelMail fails to properly sanitize user input, which could lead
to arbitrary code execution and compromise webmail accounts.
Background
==========
SquirrelMail is a webmail package written in PHP. It supports IMAP and
SMTP and can optionally be installed with SQL support.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 mail-client/squirrelmail <= 1.4.3a-r2 >= 1.4.4
Description
===========
SquirrelMail fails to properly sanitize certain strings when decoding
specially-crafted strings, which can lead to PHP file inclusion and XSS.
* Insufficient checking of incoming URLs in prefs.php (CAN-2005-0075)
and in webmail.php (CAN-2005-0103).
* Insufficient escaping of integers in webmail.php (CAN-2005-0104).
Impact
======
By sending a specially-crafted URL, an attacker can execute arbitrary
code from the local system with the permissions of the web server.
Furthermore by enticing a user to load a specially-crafted URL, it
is possible to display arbitrary remote web pages in Squirrelmail's
frameset and execute arbitrary scripts running in the context of
the victim's browser. This could lead to a compromise of the user's
webmail account, cookie theft, etc.
Workaround
==========
The arbitrary code execution is only possible with "register_globals"
set to "On". Gentoo ships PHP with "register_globals" set to "Off" by
default. There are no known workarounds for the other issues at this
time.
Resolution
==========
All SquirrelMail users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-client/squirrelmail-1.4.4"
Note: Users with the vhosts USE flag set should manually use
webapp-config to finalize the update.
References
==========
[ 1 ] SquirrelMail Advisory
http://sourceforge.net/mailarchive/message.php?msg_id=10628451
[ 2 ] CAN-2005-0075
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0075
[ 3 ] CAN-2005-0103
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0103
[ 4 ] CAN-2005-0104
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0104
Availability
============
This GLSA and any updates to it are available for viewing at the
Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200501-39.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0
4.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 200501-40
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: ngIRCd: Buffer overflow
Date: January 28, 2005
Bugs: #79705
ID: 200501-40
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
ngIRCd is vulnerable to a buffer overflow that can be used to crash
the daemon and possibly execute arbitrary code.
Background
==========
ngIRCd is a free open source daemon for Internet Relay Chat (IRC).
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-irc/ngircd < 0.8.2 >= 0.8.2
Description
===========
Florian Westphal discovered a buffer overflow caused by an integer
underflow in the Lists_MakeMask() function of lists.c.
Impact
======
A remote attacker can exploit this buffer overflow to crash the ngIRCd
daemon and possibly execute arbitrary code with the rights of the ngIRCd
daemon process.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All ngIRCd users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-irc/ngIRCd-0.8.2"
References
==========
[ 1 ] ngIRCd Release Annoucement
http://arthur.ath.cx/pipermail/ngircd-ml/2005-January/000228.html
Availability
============
This GLSA and any updates to it are available for viewing at the Gentoo
Security Website:
http://security.gentoo.org/glsa/glsa-200501-40.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.0