bugtraq - [SECURITY] [DSA-333-1] New acm packages fix integer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20030629014427.GY3922__1958.66921353645$1057001689@alcor.net>
Date: Sat, 28 Jun 2003 21:44:27 -0400
From: Matt Zimmerman <mdz@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA-333-1] New acm packages fix integer overflow


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 333-1                     security@...ian.org
http://www.debian.org/security/                             Matt Zimmerman
June 27th, 2003                         http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : acm
Vulnerability  : integer overflow
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CVE-2002-0391

acm, a multi-player aerial combat simulation, uses a network protocol
based on the same RPC implementation used in many C libraries.  This
implementation was found to contain an integer overflow vulnerability
which could be exploited to execute arbitrary code.

For the stable distribution (woody) this problem has been fixed in
version 5.0-3.woody.1.

For the unstable distribution (sid) this problem has been fixed in
version 5.0-10.

We recommend that you update your acm package.

Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1.dsc
      Size/MD5 checksum:      593 7b97e94d274f4042c7092c677a399d1a
    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1.diff.gz
      Size/MD5 checksum:    14248 42f110d62edb95c352bb068d97833057
    http://security.debian.org/pool/updates/main/a/acm/acm_5.0.orig.tar.gz
      Size/MD5 checksum:  1239047 c0768937733989eb4b10708a782eaf6a

  Alpha architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_alpha.deb
      Size/MD5 checksum:   583226 32bc02220b0e335d079854f1ff1fbb8b

  ARM architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_arm.deb
      Size/MD5 checksum:   544240 3b0947f07c5fc24b33ed7af591021e1f

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_i386.deb
      Size/MD5 checksum:   525616 a3a6a0285fb698d2032a36ab87fd6a1f

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_ia64.deb
      Size/MD5 checksum:   648708 2959fba6dccaa512dc831f2b150fe293

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_hppa.deb
      Size/MD5 checksum:   570940 9e003ccf3112edd2c349086ac9e7b05a

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_m68k.deb
      Size/MD5 checksum:   515596 b618564e2e94ca304372084dc58753cc

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_mips.deb
      Size/MD5 checksum:   581384 af7e8c6e422f5ff0701baefe2e567891

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_mipsel.deb
      Size/MD5 checksum:   581420 a711924b81bf95dd7d8c1577bfe90589

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_powerpc.deb
      Size/MD5 checksum:   549898 36dd4c082f90af46f2252b32cf0cd733

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_s390.deb
      Size/MD5 checksum:   531922 936b063457eca68d5a54a638d32a0134

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/a/acm/acm_5.0-3.woody.1_sparc.deb
      Size/MD5 checksum:   547274 adaaee0cdbfd7eaf552dec2de2f16f9b

  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQE+/cWKArxCt0PiXR4RAv8tAJ0bPBy/Ghv99CQMFAK1lI/0ptC9lACfYXAx
+zGta+e9PAjrAthUX+7evd8=
=dOMd
-----END PGP SIGNATURE-----