full-disclosure - [SECURITY] [DSA 1694-1] New xterm packages fix remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <874p0hsf0f.fsf@mid.deneb.enyo.de>
Date: Fri, 02 Jan 2009 20:07:44 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 1694-1] New xterm packages fix
	remote code execution

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1694-1                  security@...ian.org
http://www.debian.org/security/                           Florian Weimer
January 02, 2009                      http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : xterm
Vulnerability  : design flaw
Problem type   : local (remote)
Debian-specific: no
CVE Id(s)      : CVE-2008-2383
Debian Bug     : 510030

Paul Szabo discovered that xterm, a terminal emulator for the X Window
System, places arbitrary characters into the input buffer when
displaying certain crafted escape sequences (CVE-2008-2383).

As an additional precaution, this security update also disables font
changing, user-defined keys, and X property changes through escape
sequences.

For the stable distribution (etch), this problem has been fixed in
version 222-1etch3.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your xterm package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.dsc
    Size/MD5 checksum:     1123 3bcc850fe7c9057e5d5d03617cc95195
  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3.diff.gz
    Size/MD5 checksum:    61664 f1e11e4f4c85db1e2ffa67c5d132d2e6
  http://security.debian.org/pool/updates/main/x/xterm/xterm_222.orig.tar.gz
    Size/MD5 checksum:   802986 bb77882a33083632a9c6c9de004a54fb

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_alpha.deb
    Size/MD5 checksum:   437394 2a16b16a6ed79a908987769b9b5a68d8

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_amd64.deb
    Size/MD5 checksum:   416434 46ba9b4430c313464afeaa856d02f09a

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_arm.deb
    Size/MD5 checksum:   412020 9119d878ffedf54c843ec84a98022a3d

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_hppa.deb
    Size/MD5 checksum:   421890 9b3326921fbbd0ba014b3717b20c53fb

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_i386.deb
    Size/MD5 checksum:   403908 f54263828a01af2af86f25c1fedc7aa6

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_ia64.deb
    Size/MD5 checksum:   509374 052861cf2a23d7a414c038d510fc7f01

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mips.deb
    Size/MD5 checksum:   428858 63615939a4de2f4e3ba0cc61adbf0e47

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_mipsel.deb
    Size/MD5 checksum:   425604 9d18da53eea366eb2688dfe629d95e82

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_powerpc.deb
    Size/MD5 checksum:   409986 824e743d4a6a1abeb5c1fdc0a9e7d006

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_s390.deb
    Size/MD5 checksum:   422196 9b78491ef8fb34da8d5e183e91fc6c65

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/x/xterm/xterm_222-1etch3_sparc.deb
    Size/MD5 checksum:   409994 e284b9163d0da06f932f8e243ccaee2b


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJXmW3AAoJEL97/wQC1SS+B88IALCE/5QT8PKOspzA7s4TVrCx
sZfNri9GsBaQv2fOVRT3QkXGDmKkDmoCxnYT2fsvZ7NoulKdrmoPlNtTNtNxi7y+
sK7j2RVcOkAptxv/OVxwwPMh9KNriwbUnoGgds7vDVLDIAm2DrGqHuKgfyCS8ZxH
RxaVDnqMAKrHLvTliGigu3yiiO08Mqbl95Wi5OI86L8NNAQ5KzkhoQyh8IQzIgm2
kdKEDS/hu7oOCpB6TgHNX+FDVShZpSCVVp2SxIUY0WYdrFhHONv4T9aJCZTh5Lvq
FxKq+zrdd0p4fASVc99p1dL1n8blqXgJVVFYXZIn04r8sbXhQ3Xj3zKezVC39MM=
=mXuF
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/