Több biztonsági hibát (stack buffer overflow, NULL deref és off-by-one hiba) találtak az UW IMAP toolkit-ben. A dstat program megadja az aktuális munkakönyvtárat is a python modulok keresési útvonalában, így a támadó kód futtatási lehetőséghez jut. Több kód futtatási hibát is találtak a wireshark csomagban. A támadó a PEAR Net_Traceroute a paramétereinek rossz escape-elése miatt a shell indítást befolyásolhatja, tetszőleges kódot futtathat a rendszeren. Több biztonsági hibát, köztük a TLS renegotiation miatti adatbeszúrást valamint a rég lejárt szavatosságú MD2 algoritmus használatát találták az OpenSSL rutinkönyvtárban. Több biztonsági hibát (többek között SQL injection) is találtak a Ruby on Rails web keretrendszerben. Két ntp daemon (vagy egy saját magával) végtelen ping-pongozásra kényszeríthető hamisított NTP mode 7 (MODE_PRIVATE) csomag segítségével. Több biztonsági hibát is találtak az Adobe Flash Player szoftverben.
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: UW IMAP toolkit: Multiple vulnerabilities Date: November 25, 2009 Bugs: #245425, #252567 ID: 200911-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in the UW IMAP toolkit and the c-client library, the worst of which leading to the execution of arbitrary code. Background ========== The UW IMAP toolkit is a daemon for the IMAP and POP3 network mail protocols. The c-client library provides an API for IMAP, POP3 and other protocols. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/c-client < 2007e >= 2007e 2 net-mail/uw-imap < 2007e >= 2007e ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. ------------------------------------------------------------------- Description =========== Multiple vulnerabilities were found in the UW IMAP toolkit: * Aron Andersson and Jan Sahlin of Bitsec reported boundary errors in the "tmail" and "dmail" utilities when processing overly long mailbox names, leading to stack-based buffer overflows (CVE-2008-5005). * An error in smtp.c in the c-client library was found, leading to a NULL pointer dereference vulnerability (CVE-2008-5006). * Ludwig Nussel reported an off-by-one error in the rfc822_output_char() function in the RFC822BUFFER routines in the c-client library, as used by the UW IMAP toolkit (CVE-2008-5514). Impact ====== A remote attacker could send an e-mail to a destination mailbox name composed of a username and '+' character followed by a long string, possibly leading to the execution of arbitrary code. A local attacker could gain privileges by specifying a long folder extension argument to the tmail or dmail program. Furthermore, a remote attacker could send a specially crafted mail message to the UW IMAP toolkit or another daemon using the c-client library, leading to a Denial of Service. A remote SMTP server could respond to the QUIT command with a close of the TCP connection instead of the expected 221 response code, possibly leading to a Denial of Service. Workaround ========== There is no known workaround at this time. Resolution ========== All c-client library users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/c-client-2007e" All UW IMAP toolkit users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-mail/uw-imap-2007e" References ========== [ 1 ] CVE-2008-5005 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5005 [ 2 ] CVE-2008-5006 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5006 [ 3 ] CVE-2008-5514 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5514 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: This is a digitally signed message part.
--- End Message ---
--- Begin Message ---Due to an oversight on my part, the original email has not been signed. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: dstat: Untrusted search path Date: November 25, 2009 Bugs: #293497 ID: 200911-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An untrusted search path vulnerability in the dstat might result in the execution of arbitrary code. Background ========== dstat is a versatile system resource monitor written in Python. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 sys-apps/dstat < 0.6.9-r1 >= 0.6.9-r1 Description =========== Robert Buchholz of the Gentoo Security Team reported that dstat includes the current working directory and subdirectories in the Python module search path (sys.path) before calling "import". Impact ====== A local attacker could entice a user to run "dstat" from a directory containing a specially crafted Python module, resulting in the execution of arbitrary code with the privileges of the user running the application. Workaround ========== Do not run "dstat" from untrusted working directories. Resolution ========== All dstat users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=sys-apps/dstat-0.6.9-r1" References ========== [ 1 ] CVE-2009-3894 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3894 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-04.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: This is a digitally signed message part.
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Wireshark: Multiple vulnerabilities Date: November 25, 2009 Bugs: #285280, #290710 ID: 200911-05 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in Wireshark, allowing for the remote execution of arbitrary code, or Denial of Service. Background ========== Wireshark is a versatile network protocol analyzer. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-analyzer/wireshark < 1.2.3 >= 1.2.3 Description =========== Multiple vulnerabilities have been discovered in Wireshark: * Ryan Giobbi reported an integer overflow in wiretap/erf.c (CVE-2009-3829). * The vendor reported multiple unspecified vulnerabilities in the Bluetooth L2CAP, RADIUS, and MIOP dissectors (CVE-2009-2560), in the OpcUa dissector (CVE-2009-3241), in packet.c in the GSM A RR dissector (CVE-2009-3242), in the TLS dissector (CVE-2009-3243), in the Paltalk dissector (CVE-2009-3549), in the DCERPC/NT dissector (CVE-2009-3550), and in the dissect_negprot_response() function in packet-smb.c in the SMB dissector (CVE-2009-3551). Impact ====== A remote attacker could entice a user to open a specially crafted "erf" file using Wireshark, possibly resulting in the execution of arbitrary code with the privileges of the user running the application. A remote attacker could furthermore send specially crafted packets on a network being monitored by Wireshark or entice a user to open a malformed packet trace file using Wireshark, possibly resulting in a Denial of Service. Workaround ========== There is no known workaround at this time. Resolution ========== All Wireshark users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-analyzer/wireshark-1.2.3" References ========== [ 1 ] CVE-2009-2560 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2560 [ 2 ] CVE-2009-3241 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3241 [ 3 ] CVE-2009-3242 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3242 [ 4 ] CVE-2009-3243 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3243 [ 5 ] CVE-2009-3549 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3549 [ 6 ] CVE-2009-3550 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3550 [ 7 ] CVE-2009-3551 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3551 [ 8 ] CVE-2009-3829 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3829 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-05.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200911-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: PEAR Net_Traceroute: Command injection Date: November 26, 2009 Bugs: #294264 ID: 200911-06 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== An input sanitation error in PEAR Net_Traceroute might allow remote attackers to execute arbitrary commands. Background ========== PEAR Net_Traceroute is an OS independent wrapper class for executing traceroute calls from PHP. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-php/PEAR-Net_Traceroute < 0.21.2 >= 0.21.2 Description =========== Pasquale Imperato reported that the $host parameter to the traceroute() function in Traceroute.php is not properly sanitized before being passed to exec(). Impact ====== A remote attacker could exploit this vulnerability when user input is passed directly to PEAR Net_Traceroute in a PHP script, possibly resulting in the remote execution of arbitrary shell commands with the privileges of the user running the affected PHP script. Workaround ========== Ensure that all data that is passed to the traceroute() function is properly shell escaped (for instance using the escapeshellcmd() function). Resolution ========== All PEAR Net_Traceroute users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-php/PEAR-Net_Traceroute-0.21.2" References ========== [ 1 ] CVE-2009-4025 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4025 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200911-06.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200912-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: OpenSSL: Multiple vulnerabilities Date: December 01, 2009 Bugs: #270305, #280591, #292022 ID: 200912-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities in OpenSSL might allow remote attackers to conduct multiple attacks, including the injection of arbitrary data into encrypted byte streams. Background ========== OpenSSL is an Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) as well as a general purpose cryptography library. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-libs/openssl < 0.9.8l-r2 >= 0.9.8l-r2 Description =========== Multiple vulnerabilities have been reported in OpenSSL: * Marsh Ray of PhoneFactor and Martin Rex of SAP independently reported that the TLS protocol does not properly handle session renegotiation requests (CVE-2009-3555). * The MD2 hash algorithm is no longer considered to be cryptographically strong, as demonstrated by Dan Kaminsky. Certificates using this algorithm are no longer accepted (CVE-2009-2409). * Daniel Mentz and Robin Seggelmann reported the following vulnerabilities related to DTLS: A use-after-free flaw (CVE-2009-1379) and a NULL pointer dereference (CVE-2009-1387) in the dtls1_retrieve_buffered_fragment() function in src/d1_both.c, multiple memory leaks in the dtls1_process_out_of_seq_message() function in src/d1_both.c (CVE-2009-1378), and a processing error related to a large amount of DTLS records with a future epoch in the dtls1_buffer_record() function in ssl/d1_pkt.c (CVE-2009-1377). Impact ====== A remote unauthenticated attacker, acting as a Man in the Middle, could inject arbitrary plain text into a TLS session, possibly leading to the ability to send requests as if authenticated as the victim. A remote attacker could furthermore send specially crafted DTLS packages to a service using OpenSSL for DTLS support, possibly resulting in a Denial of Service. Also, a remote attacker might be able to create rouge certificates, facilitated by a MD2 collision. NOTE: The amount of computation needed for this attack is still very large. Workaround ========== There is no known workaround at this time. Resolution ========== All OpenSSL users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-libs/openssl-0.9.8l-r2" References ========== [ 1 ] CVE-2009-1377 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1377 [ 2 ] CVE-2009-1378 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1378 [ 3 ] CVE-2009-1379 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1379 [ 4 ] CVE-2009-1387 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1387 [ 5 ] CVE-2009-2409 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409 [ 6 ] CVE-2009-3555 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200912-01.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200912-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Ruby on Rails: Multiple vulnerabilities Date: December 20, 2009 Bugs: #200159, #237385, #247549, #276279, #283396, #294797 ID: 200912-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in Rails, the worst of which leading to the execution of arbitrary SQL statements. Background ========== Ruby on Rails is a web-application and persistence framework. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/rails < 2.2.2 >= 2.3.5 *>= 2.2.3-r1 Description =========== The following vulnerabilities were discovered: * sameer reported that lib/action_controller/cgi_process.rb removes the :cookie_only attribute from the default session options (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA 200711-17). * Tobias Schlottke reported that the :limit and :offset parameters of ActiveRecord::Base.find() are not properly sanitized before being processed (CVE-2008-4094). * Steve from Coderrr reported that the CRSF protection in protect_from_forgery() does not parse the text/plain MIME format (CVE-2008-7248). * Nate reported a documentation error that leads to the assumption that a block returning nil passed to authenticate_or_request_with_http_digest() would deny access to the requested resource (CVE-2009-2422). * Brian Mastenbrook reported an input sanitation flaw, related to multibyte characters (CVE-2009-3009). * Gabe da Silveira reported an input sanitation flaw in the strip_tags() function (CVE-2009-4214). * Coda Hale reported an information disclosure vulnerability related to HMAC digests (CVE-2009-3086). Impact ====== A remote attacker could send specially crafted requests to a vulnerable application, possibly leading to the execution of arbitrary SQL statements or a circumvention of access control. A remote attacker could also conduct session fixation attacks to hijack a user's session or bypass the CSRF protection mechanism, or furthermore conduct Cross-Site Scripting attacks or forge a digest via multiple attempts. Workaround ========== There is no known workaround at this time. Resolution ========== All Ruby on Rails 2.3.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-2.3.5" All Ruby on Rails 2.2.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "=dev-ruby/rails-2.2.3-r1" NOTE: All applications using Ruby on Rails should also be configured to use the latest version available by running "rake rails:update" inside the application directory. References ========== [ 1 ] CVE-2007-5380 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5380 [ 2 ] CVE-2007-6077 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6077 [ 3 ] CVE-2008-4094 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4094 [ 4 ] CVE-2008-7248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248 [ 5 ] CVE-2009-2422 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2422 [ 6 ] CVE-2009-3009 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009 [ 7 ] CVE-2009-3086 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086 [ 8 ] CVE-2009-4214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4214 [ 9 ] GLSA 200711-17 http://www.gentoo.org/security/en/glsa/glsa-200711-17.xml Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200912-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: PGP signature
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201001-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: NTP: Denial of Service Date: January 03, 2010 Bugs: #290881 ID: 201001-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== A Denial of Service condition in ntpd can cause excessive CPU or bandwidth consumption. Background ========== NTP is a set of the Network Time Protocol programs. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-misc/ntp < 4.2.4_p7-r1 >= 4.2.4_p7-r1 Description =========== Robin Park and Dmitri Vinokurov discovered that ntp_request.c in ntpd does not handle MODE_PRIVATE packets correctly, causing a continuous exchange of MODE_PRIVATE error responses between two NTP daemons or causing high CPU load on a single host. Impact ====== A remote, unauthenticated attacker could send a specially crafted MODE_PRIVATE packet, allowing for a Denial of Service condition (CPU and bandwidth consumption). Workaround ========== There is no known workaround at this time. Resolution ========== All NTP users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-misc/ntp-4.2.4_p7-r1" References ========== [ 1 ] CVE-2009-3563 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3563 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201001-01.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: OpenPGP digital signature
--- End Message ---
--- Begin Message ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201001-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Adobe Flash Player: Multiple vulnerabilities Date: January 03, 2010 Bugs: #296407 ID: 201001-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities in Adobe Flash Player might allow remote attackers to execute arbitrary code or cause a Denial of Service. Background ========== The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 www-plugins/adobe-flash < 10.0.42.34 >= 10.0.42.34 Description =========== Multiple vulnerabilities have been discovered in Adobe Flash Player: * An anonymous researcher working with the Zero Day Initiative reported that Adobe Flash Player does not properly process JPEG files (CVE-2009-3794). * Jim Cheng of EffectiveUI reported an unspecified data injection vulnerability (CVE-2009-3796). * Bing Liu of Fortinet's FortiGuard Labs reported multiple unspecified memory corruption vulnerabilities (CVE-2009-3797, CVE-2009-3798). * Damian Put reported an integer overflow in the Verifier::parseExceptionHandlers() function (CVE-2009-3799). * Will Dormann of CERT reported multiple unspecified Denial of Service vulnerabilities (CVE-2009-3800). Impact ====== A remote attacker could entice a user to open a specially crafted SWF file, possibly resulting in the remote execution of arbitrary code with the privileges of the user running the application, or a Denial of Service via unknown vectors. Workaround ========== There is no known workaround at this time. Resolution ========== All Adobe Flash Player users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=www-plugins/adobe-flash-10.0.42.34" References ========== [ 1 ] CVE-2009-3794 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3794 [ 2 ] CVE-2009-3796 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3796 [ 3 ] CVE-2009-3797 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3797 [ 4 ] CVE-2009-3798 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3798 [ 5 ] CVE-2009-3799 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3799 [ 6 ] CVE-2009-3800 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3800 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201001-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2010 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5Attachment: signature.asc
Description: PGP signature
--- End Message ---