lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list] 
Message-Id: <20090704025303.8CA45848353@hannah.localdomain>
Date: Sat,  4 Jul 2009 12:53:03 +1000 (EST)
From: white@...ian.org (Steffen Joeris)
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1826-1] New eggdrop packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1826-1                  security@...ian.org
http://www.debian.org/security/                      Steffen Joeris
July 04, 2009                         http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : eggdrop
Vulnerability  : several
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2007-2807 CVE-2009-1789
Debian Bugs    : 427157 528778

Several vulnerabilities have been discovered in eggdrop, an advanced IRC
robot. The Common Vulnerabilities and Exposures project identifies the
following problems:

CVE-2007-2807

It was discovered that eggdrop is vulnerable to a buffer overflow, which
could result in a remote user executing arbitrary code. The previous DSA
(DSA-1448-1) did not fix the issue correctly.

CVE-2009-1789

It was discovered that eggdrop is vulnerable to a denial of service
attack, that allows remote attackers to cause a crash via a crafted
PRIVMSG.

For the stable distribution (lenny), these problems have been fixed in
version 1.6.19-1.1+lenny1.

For the old stable distribution (etch), these problems have been fixed in
version 1.6.18-1etch2.

For the unstable distribution (sid), this problem has been fixed in
version 1.6.19-1.2


We recommend that you upgrade your eggdrop package.


Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2.dsc
    Size/MD5 checksum:      650 594b4749b9ec89f7d369643895710ad8
  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2.diff.gz
    Size/MD5 checksum:     8016 1a18e0a558c7de704c220e6ed0f14bff
  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18.orig.tar.gz
    Size/MD5 checksum:  1025608 c2734a51926bdf0380d8bb53f5a7b2ee

Architecture independent packages:

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop-data_1.6.18-1etch2_all.deb
    Size/MD5 checksum:   413124 5f8afe289ebefcc7921fc1a9189c7efd

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_alpha.deb
    Size/MD5 checksum:   597062 c79a36069bad2181b84fc8d49b944b16

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_amd64.deb
    Size/MD5 checksum:   537512 9c3244b387ee9ceddb1dda220247a4f1

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_arm.deb
    Size/MD5 checksum:   498890 055e953dcb486f625a15459dc55aab19

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_hppa.deb
    Size/MD5 checksum:   600144 ac69ebc0c01053cd4cbd35eba71546a8

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_i386.deb
    Size/MD5 checksum:   475340 945bb805188e10c0ce96e0b5d2295deb

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_ia64.deb
    Size/MD5 checksum:   755532 724ae130ed456eb5d5a229fa9a9c1669

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_mips.deb
    Size/MD5 checksum:   533850 60232404dbc3aab7be1bbd44f9727cf7

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_mipsel.deb
    Size/MD5 checksum:   537320 40f9df7e42a932ea8c0c91d9c778505d

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_powerpc.deb
    Size/MD5 checksum:   522414 27b819f07a51ef3027bf89e77afbfeea

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_s390.deb
    Size/MD5 checksum:   530102 32d0911a7a50d9de96313ec56d707c09

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.18-1etch2_sparc.deb
    Size/MD5 checksum:   490614 8985bad87328abe986ccd99d5d4a106f


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1.dsc
    Size/MD5 checksum:     1083 0fbb3a99c0027705fd9459ff03fce710
  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19.orig.tar.gz
    Size/MD5 checksum:  1033152 4d89a901e95f0f9937f4ffac783d55d8
  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1.diff.gz
    Size/MD5 checksum:    17603 73742e8b01487405d815296f5fb91a58

Architecture independent packages:

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop-data_1.6.19-1.1+lenny1_all.deb
    Size/MD5 checksum:   412066 7e5a850e026fe53cfade4e6dd43948af

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_alpha.deb
    Size/MD5 checksum:   593730 d791d84436f4ba40ac542afdb5181588

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_amd64.deb
    Size/MD5 checksum:   545870 0bba74f2562866bb282d5ac9c575d042

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_arm.deb
    Size/MD5 checksum:   507040 86269695984245a98e23a2ec3c48259d

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_armel.deb
    Size/MD5 checksum:   523006 14ec7c7ea8de55c77a554c2b8871231a

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_hppa.deb
    Size/MD5 checksum:   591212 9f79dac9962932605a4dc331f201736d

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_i386.deb
    Size/MD5 checksum:   468618 1231dad4cd3f847298efd9c453ec7a67

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_ia64.deb
    Size/MD5 checksum:   750226 a24c908ebc0e6ee68f5d07778527b767

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_mips.deb
    Size/MD5 checksum:   523760 a62db58be23b5a3b2d568344f1d7503d

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_mipsel.deb
    Size/MD5 checksum:   526202 431f1302ef1539336b57887e58317aa5

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_powerpc.deb
    Size/MD5 checksum:   532980 435c9a597ba6a84b2f7fb655fbd06d2b

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_s390.deb
    Size/MD5 checksum:   527910 4b95f23c5e1cd5120d5bfaf0fc4e420f

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/e/eggdrop/eggdrop_1.6.19-1.1+lenny1_sparc.deb
    Size/MD5 checksum:   479812 cabbfb068f710ecba8715a89815fe252


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkpOw2wACgkQ62zWxYk/rQe2VACeKGzfpUAXZEfTvVPOmQqRW9Z5
/5oAnA+PZjuAarXURzc923k2zul0vzag
=R3e5
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ