Message-ID: <20061227223330.GA15059@galadriel.inutil.org>
Date: Wed, 27 Dec 2006 23:33:30 +0100
From: Moritz Muehlenhoff <jmm@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1242-1] New elog packages fix arbitrary code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1242-1                    security@...ian.org
http://www.debian.org/security/                         Moritz Muehlenhoff
December 27th, 2006                     http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : elog
Vulnerability  : several
Problem-Type   : remote
Debian-specific: no
CVE ID         : CVE-2006-5063 CVE-2006-5790 CVE-2006-5791 CVE-2006-6318

Several remote vulnerabilities have been discovered in elog, a web-based
electronic logbook, which may lead to the execution of arbitrary code.
The Common Vulnerabilities and Exposures project identifies the following
problems:

CVE-2006-5063

    Tilman Koschnick discovered that log entry editing in HTML is vulnerable
    to cross-site scripting. This update disables the vulnerable code.

CVE-2006-5790

    Ulf Harnhammar of the Debian Security Audit Project discovered several
    format string vulnerabilities in elog, which may lead to execution of
    arbitrary code.

CVE-2006-5791

    Ulf Harnhammar of the Debian Security Audit Project discovered 
    cross-site scripting vulnerabilities in the creation of new logbook
    entries.

CVE-2006-6318

    Jayesh KS and Arun Kethipelly of OS2A discovered that elog performs
    insufficient error handling in config file parsing, which may lead to
    denial of service through a NULL pointer dereference.

For the stable distribution (sarge) these problems have been fixed in
version 2.5.7+r1558-4+sarge3.

The upcoming stable distribution (etch) will no longer include elog.

For the unstable distribution (sid) these problems have been fixed in
version 2.6.2+r1754-1.

We recommend that you upgrade your elog package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3.dsc
      Size/MD5 checksum:      581 c072e867caa0058ac44cbd69c6afff51
    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3.diff.gz
      Size/MD5 checksum:    23758 0718302e60a98844f27cd6eab336c5ce
    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558.orig.tar.gz
      Size/MD5 checksum:   538216 e05c9fdaa02692ce20c70a5fd2748fe3

  Alpha architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_alpha.deb
      Size/MD5 checksum:   556190 081bd3b98bea9516c26b487024d6140f

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_amd64.deb
      Size/MD5 checksum:   512510 48ee1c675cefa6a0b0af01f7cbb9f079

  ARM architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_arm.deb
      Size/MD5 checksum:   517072 5e4a4dc726a8a0bf75f05de3fe17e07c

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_hppa.deb
      Size/MD5 checksum:   544448 5f5c83341837c6dd18211b4164bbd1dc

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_i386.deb
      Size/MD5 checksum:   514786 c14108b91d171ac38b0104ae769cfc96

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_ia64.deb
      Size/MD5 checksum:   598224 df22b05edfb9dfab43cc69233f2d88e4

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_m68k.deb
      Size/MD5 checksum:   482826 254d8a1f1cae62719a9f6f2a461cffd8

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_mips.deb
      Size/MD5 checksum:   522074 909b22df0ac8302bd7b00b8338511198

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_mipsel.deb
      Size/MD5 checksum:   525164 278bc7397817c8f6a8a44d2879f0682c

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_powerpc.deb
      Size/MD5 checksum:   524304 37438b8fff9c0b162aa6870fd5c7ba31

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_s390.deb
      Size/MD5 checksum:   515148 32cf397b104321646de736141a90354d

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/e/elog/elog_2.5.7+r1558-4+sarge3_sparc.deb
      Size/MD5 checksum:   519788 b532c963d03d66f4e32861531adefe4e


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFkvSHXm3vHE4uyloRAk+DAJ49IGlpV6HUrg2/EWlIRrFONVx80gCgu22h
5xHJ1Ia+bLJKBAUBWvd019Y=
=8iOu
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists