lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 1 Dec 2005 13:37:30 +0100
From: Martin Pitt <martin.pitt@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-220-1] w3c-libwww vulnerability

===========================================================
Ubuntu Security Notice USN-220-1	  December 01, 2005
w3c-libwww vulnerability
CVE-2005-3183
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

libwww0

The problem can be corrected by upgrading the affected package to
version 5.4.0-9ubuntu0.4.10 (for Ubuntu 4.10), 5.4.0-9ubuntu0.5.04
(for Ubuntu 5.04), or 5.4.0-9ubuntu0.5.10 (for Ubuntu 5.10).  In
general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Sam Varshavchik discovered several buffer overflows in the
HTBoundary_put_block() function. By sending specially crafted HTTP
multipart/byteranges MIME messages, a malicious HTTP server could
trigger an out of bounds memory access in the libwww library, which
causes the program that uses the library to crash.


Updated packages for Ubuntu 4.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.4.10.diff.gz
      Size/MD5:   510355 15f9592db51864e0e060fe1f3a6f63f6
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.4.10.dsc
      Size/MD5:      714 637bf331ecefe995ae2ef4b280e2bc2b
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0.orig.tar.gz
      Size/MD5:  1127018 a6073cda765b7f9fa0970eb92757f6bb

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.4.10_amd64.deb
      Size/MD5:   684660 313c59ca507046ff8a2b66ac49d0ac7e
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.4.10_amd64.deb
      Size/MD5:   692530 d06eb91e03a400e23ae94d8466965bc5
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.4.10_amd64.deb
      Size/MD5:   512118 2646446086e15f870cc8930d39fa65ad
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.4.10_amd64.deb
      Size/MD5:   503738 7dffb1bfe8e5215be6840aa9a8f2d2c9

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.4.10_i386.deb
      Size/MD5:   607840 b16565a4a8dfaa8a5b10227f73d0ca5d
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.4.10_i386.deb
      Size/MD5:   614156 01705c593f044c6ef920c3799b8a7cb7
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.4.10_i386.deb
      Size/MD5:   452774 21fe2a50e533a6be012c07ca2e1bca33
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.4.10_i386.deb
      Size/MD5:   444552 098a59839be744797f2c8f9df0fc70ba

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.4.10_powerpc.deb
      Size/MD5:   694934 c4b38eaec0fbff44f0b92e6b8d4c646f
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.4.10_powerpc.deb
      Size/MD5:   704214 98db309dd1b252e6fe1fc7ec3f5e342c
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.4.10_powerpc.deb
      Size/MD5:   507282 96d5f4382a0df15df9a04b72f33350f5
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.4.10_powerpc.deb
      Size/MD5:   498518 f77c5c60228ec7f769281ca4ba690ac1

Updated packages for Ubuntu 5.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.5.04.diff.gz
      Size/MD5:   510353 dfacb49b7bc30b6829a064ed857bad36
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.5.04.dsc
      Size/MD5:      714 6b2128a3be183cbb204645423fa4fb22
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0.orig.tar.gz
      Size/MD5:  1127018 a6073cda765b7f9fa0970eb92757f6bb

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.04_amd64.deb
      Size/MD5:   684646 774b5e3bb24748468fb4417119648b1b
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.04_amd64.deb
      Size/MD5:   692468 bc282e4fc92517bea58d67f8682f4793
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.04_amd64.deb
      Size/MD5:   512176 17bce1afc105e18c7d0a87a2bd1c0e35
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.04_amd64.deb
      Size/MD5:   503836 229e14f16890a3698b7a6c0f643c3a07

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.04_i386.deb
      Size/MD5:   607932 f8d90cd4c1c414fd3be1445452b0f9dc
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.04_i386.deb
      Size/MD5:   614278 7c49d8fb328a1615fbf68df3e31e8874
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.04_i386.deb
      Size/MD5:   452130 8869e99df88b832629d392fb09bd4943
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.04_i386.deb
      Size/MD5:   443922 8fe4ee3f786484817a18269ff5b1bb00

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.04_powerpc.deb
      Size/MD5:   694902 9adb92ce0d06b187804ea4ef3b9b98e0
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.04_powerpc.deb
      Size/MD5:   704190 4ede635cd936116304be4938db47c206
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.04_powerpc.deb
      Size/MD5:   507868 cd6be292a8642f6ba829f20c0d477dcd
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.04_powerpc.deb
      Size/MD5:   498974 d12c45e22e60c084bfe6245884a3c911

Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.5.10.diff.gz
      Size/MD5:   510354 66df7306af726ce9ca9c09e02f773fab
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0-9ubuntu0.5.10.dsc
      Size/MD5:      714 e4c57b709f40d8ecb2d58ea37550b78e
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/w3c-libwww_5.4.0.orig.tar.gz
      Size/MD5:  1127018 a6073cda765b7f9fa0970eb92757f6bb

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.10_amd64.deb
      Size/MD5:   692584 1cdf973add1144853304890300a381de
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.10_amd64.deb
      Size/MD5:   700096 09ce0c2f9e3cf3f8b0a1a79d38379c18
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.10_amd64.deb
      Size/MD5:   520120 b16e4d23b9503b41468d9a8862347b2e
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.10_amd64.deb
      Size/MD5:   511492 11b9667628eb7fcaaec93b53d50a1881

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.10_i386.deb
      Size/MD5:   608218 6702f91d61eb03f7aa76ddecc68e0723
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.10_i386.deb
      Size/MD5:   614374 f057682a4109808438162afe09ca5376
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.10_i386.deb
      Size/MD5:   448164 4e09a8140ee0519a6b4512a442effff7
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.10_i386.deb
      Size/MD5:   441186 33bafbd9b12a56ed2633f3e7a7619e2a

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-dev_5.4.0-9ubuntu0.5.10_powerpc.deb
      Size/MD5:   698766 8ecc3202704293dea4fc9555d7ffc0f1
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl-dev_5.4.0-9ubuntu0.5.10_powerpc.deb
      Size/MD5:   707580 469d6a312828982ce40a5aeb931f24fd
    http://security.ubuntu.com/ubuntu/pool/main/w/w3c-libwww/libwww-ssl0_5.4.0-9ubuntu0.5.10_powerpc.deb
      Size/MD5:   510528 b9fda83cd926e9d926ef5ff16b474487
    http://security.ubuntu.com/ubuntu/pool/universe/w/w3c-libwww/libwww0_5.4.0-9ubuntu0.5.10_powerpc.deb
      Size/MD5:   501542 7e17ff5ee5861d8e7eb2d6fe7e780ec9

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists