lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20030607015142.GD31465__27965.5677303255$1055009819@alcor.net>
Date: Fri, 6 Jun 2003 21:51:42 -0400
From: Matt Zimmerman <mdz@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA-308-1] New gzip packages fix insecure temporary file creation


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 308-1                     security@...ian.org
http://www.debian.org/security/                             Matt Zimmerman
June 6th, 2003                          http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : gzip
Vulnerability  : insecure temporary files
Problem-Type   : local
Debian-specific: no
CVE Ids        : CVE-1999-1332, CAN-2003-0367

Paul Szabo discovered that znew, a script included in the gzip
package, creates its temporary files without taking precautions to
avoid a symlink attack (CAN-2003-0367).

The gzexe script has a similar vulnerability which was patched in an
earlier release but inadvertently reverted.

For the stable distribution (woody) both problems have been fixed in
version 1.3.2-3woody1.

For the old stable distribution (potato) CAN-2003-0367 has been fixed
in version 1.2.4-33.2.  This version is not vulnerable to
CVE-1999-1332 due to an earlier patch.

For the unstable distribution (sid) this problem will be fixed soon.

We recommend that you update your gzip package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.dsc
      Size/MD5 checksum:      577 affc0d3b073378cd2dc13c2a6772810a
    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1.diff.gz
      Size/MD5 checksum:     5554 abd3dee3183d8c20f58c792206cec6e5
    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2.orig.tar.gz
      Size/MD5 checksum:   311011 57bff96b6b4bcbb060566bdbed29485d

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_alpha.deb
      Size/MD5 checksum:    76240 8b1022a3708b29162831ae85307cb4de

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_arm.deb
      Size/MD5 checksum:    68538 8f640e909866da6602c2854375fa3b70

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_i386.deb
      Size/MD5 checksum:    61868 a224c831e1a801e980801b63fde5a031

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_ia64.deb
      Size/MD5 checksum:    86622 67e08c2b9b1011544b8303376f920df7

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_hppa.deb
      Size/MD5 checksum:    72366 334d7a9b874026c95ea4a3b37b693691

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_m68k.deb
      Size/MD5 checksum:    61134 0e8cc087cfb00ec478c48c6f0b177ea1

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_mips.deb
      Size/MD5 checksum:    71524 acc8077c42714b77a73e55ae77a6493f

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_mipsel.deb
      Size/MD5 checksum:    71388 c81151864b2453826712ac969e73535c

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_powerpc.deb
      Size/MD5 checksum:    69062 91de386eef5133dbd777934a3ff6668f

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_s390.deb
      Size/MD5 checksum:    66508 391497f880223b95fbf2b6b3d72160eb

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody1_sparc.deb
      Size/MD5 checksum:    70058 3c9c0854327fec243b228108ec29f4b8

Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.dsc
      Size/MD5 checksum:      542 0c5d9c072d3b99c09cf139799b1c1031
    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2.diff.gz
      Size/MD5 checksum:    10142 0cec25832d0eaff865a27489f0757d8b
    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4.orig.tar.gz
      Size/MD5 checksum:   220976 b94b3e07797e0cbf3622bb2fe5682f0b

  Alpha architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_alpha.deb
      Size/MD5 checksum:    78936 a17b1e7130835c9f08bec9b0ff715bb1

  ARM architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_arm.deb
      Size/MD5 checksum:    68906 9f0730655e6b5011a0b69800cc032e89

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_i386.deb
      Size/MD5 checksum:    62820 77377a288598140ab73d58952c8f2ea4

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_m68k.deb
      Size/MD5 checksum:    62110 27c2275eb1b2331b6b2444fec1e0cc7b

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_powerpc.deb
      Size/MD5 checksum:    69882 5b91a3a96fb4bc6efb0d98402f55c4a6

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/g/gzip/gzip_1.2.4-33.2_sparc.deb
      Size/MD5 checksum:    71404 4e404ee1024af95725b99abe05bbecf5


These files will probably be moved into the stable distribution on its
next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD4DBQE+4UUeArxCt0PiXR4RAr0nAKCNvUjvSVDmZp8CctOtiRN/8E8utgCXaKJP
y+Yf7FWSYWBipOTvdQElQA==
=gvlA
-----END PGP SIGNATURE-----



Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ