| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20070718200950.GA5438@steve.org.uk>
Date: Wed, 18 Jul 2007 21:09:50 +0100
From: Steve Kemp <skx@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1333-1] New libcurl3-gnutls packages fix certificate handling
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1333 security@...ian.org
http://www.debian.org/security/ Steve Kemp
July 18th, 2007
- ------------------------------------------------------------------------
Package : libcurl3-gnutls
Vulnerability : input validation
Problem type : local and remote
Debian-specific: no
CVE Id(s) : CVE-2007-3564
It has been discovered that the GnuTLS certificate verification methods
implemented in libcurl-gnutls, a solid, usable, and portable multi-protocol
file transfer library, did not check for expired or invalid dates.
For the stable distribution (etch), this problem has been fixed in
version 7.15.5-1etch1.
We recommend that you upgrade your libcurl3-gnutls package.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- --------------------------------
Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
Source archives:
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.dsc
Size/MD5 checksum: 948 1eacdb0c127ad12b860033f743563df8
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5.orig.tar.gz
Size/MD5 checksum: 1897973 61997c0d852d38c3a85b445f4fc02892
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.diff.gz
Size/MD5 checksum: 19029 cbd30d40f3026e020182e665a7f5d5be
Architecture independent packages:
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15.5-1etch1_all.deb
Size/MD5 checksum: 22198 b6b9a429b9ae513c5e0c8472c6509907
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 811542 dbc6cd819cff1b717c46e11caa1dd331
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 815608 03e1eb1961a7e58e82e4ac2380aa8c8a
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 181660 30c703c8b17a42b63d2fbe575bafe562
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 823850 23eb2600b1da596a04bfd5043effc13d
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 166814 7a9f90444bd58d38c9452a44ff71ea98
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_alpha.deb
Size/MD5 checksum: 175316 0167fc5805b8f8c363165dff64dafe98
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 772978 675235b32ac91f3b91f86ee28e70d1e2
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 824246 a0547976a45ee4d4be2c43b179459404
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 767648 4852d415582c564eb50cb9f8cbc677f7
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 170008 ff8b0b14022f291265324243579abf2d
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 164638 ae44174a768af4786637cb6292800b21
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_amd64.deb
Size/MD5 checksum: 163440 c7410d7b8efc16abf1e138c1bb7a5712
arm architecture (ARM)
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 162094 001980ca743312ca37513877ad7d19f6
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 164634 436490a717543532135cfaafb4fb4a99
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 757356 3a74f9c27504a758b95dfb6ba5fb96a3
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 782328 40e1890d559f3efb927af1d0bc0c8c6e
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 750218 82456f7c8a985993fd50eb482f715a70
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_arm.deb
Size/MD5 checksum: 159216 183adf1413dc30aab0e80c96e8b07d69
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 164460 cb4b604568f5f67d219f42423a3871e5
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 183728 04b0a53a277f70ca365662ea80956012
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 177964 4e5610dee599cff8118ee190db9a632d
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 792842 1bdbcbc1a90f533c7a4937c61eb07097
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 811428 5028f1eb54b2eae003f97f38b06ee31e
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_hppa.deb
Size/MD5 checksum: 786392 41a0d16e111efa9b7693b2ff4b49aae2
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 759318 e028af09b03561cf80fba28e667619cc
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 797370 61890674b4ca3d63025aec44330d018a
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 163196 c4826f28c035963ba7c78bbf02e598fc
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 765284 dbb49ba6646ccf3b0545246d221727f6
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 162952 13ee79189c41390d6123d9f2eceb43d6
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_i386.deb
Size/MD5 checksum: 168268 abfd5346cf785ff3c3575e0ff5f45fd3
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 217322 60b9e2ed439e2d25efd0a938fed85631
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 174406 3b2820551a8f73b6d0d2fd618611aa8d
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 847688 3067d35de833b8fc16bcbac066105fab
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 225286 33446e0073372cbf66d2478d931b4c20
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 811428 29c7c73f506b810299b99ec4aa546d23
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_ia64.deb
Size/MD5 checksum: 837622 0539dc6328d28d866c60aabcc9a54c77
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 809808 74fb469f9dede8bc34e48a4a539e4358
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 163986 df1acd593c0eeed9a18c3ed8a8a0549e
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 791042 3608d4164968ecf0eb5761ccfa981efb
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 783344 5f6956f17a95ffa849c83847ca68125a
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 165370 2ff41d7e7856497bb33aaf1c42d0cc20
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_mipsel.deb
Size/MD5 checksum: 170278 8d0e09a0bdaf30cd225e59d381c6966a
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 165070 a2a95f8b931dd24659e6c17ae6de57e0
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 840286 670575e9107d1665d0123d5b034b09c3
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 780710 f63c169d7ac0a594415ce06fc554d03a
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 173628 2ef64672347d6ec0f710bfc3c68fb188
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 168912 2b05b6937b6c6bb567e9d77dc1d13ea2
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_powerpc.deb
Size/MD5 checksum: 773612 4292b8d1c968c17817ccd36149ddbc20
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 835496 199f0660bb88bf2b5f8572209c4bbcaa
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 163122 4c84c66f773accf9da6e6585edcedcc7
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 773100 10a17910d3a30b7de38a138fd6c3e299
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 179504 e83ac479b8e9c5011e28db1f4d58fa14
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 768068 67cbdd360ed1dbb80824bb6738787c95
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_s390.deb
Size/MD5 checksum: 172214 c187f5108f5a977f08abf0b4e37471e0
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 165032 18e35286ceb1129fbbe7fa1be094c59d
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 758474 e5f75c8f4491dd628fa9005e4dfc5cbb
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 159890 69c90d7c3aaa79021cfa2ee5ca0c8ca7
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 162360 de5df99405d29124dcd4b70e3aa60bf7
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 765156 963dd337e581b69c4663ade85a44755d
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_sparc.deb
Size/MD5 checksum: 787450 2ed6fb01f7babf43d9bf04aac8ed79d5
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFGnnLYwM/Gs81MDZ0RAqEMAJ9SVwtkRq4InvjE1WxoZhNuNuBBMwCfTYFF
UsgKwdu++50iJM4A+60bNxs=
=ncFi
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists