Date: Fri, 19 Aug 2005 16:24:36 +0200
From: Marcus Meissner <meissner@suse.de>
To: suse-security-announce@suse.com
Subject: [suse-security-announce] SUSE Security Summary Report SUSE-SR:2005:019


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SUSE Security Summary Report

        Announcement ID:        SUSE-SR:2005:019
        Date:                   Fri, 19 Aug 2005 13:00:00 +0000
        Cross-References:       CAN-2005-2102
                                CAN-2005-2103
                                CAN-2005-1852
                                CAN-2004-0519
                                CAN-2005-2471
                                CAN-2005-1527
                                CAN-2005-2301
                                CAN-2005-2302
                                CAN-2005-2097
                                CAN-2005-2215
                                CAN-2005-1888
                                CAN-2005-2360
                                CAN-2005-2361
                                CAN-2005-2362
                                CAN-2005-2363
                                CAN-2005-2364
                                CAN-2005-2365
                                CAN-2005-2366
                                CAN-2005-2367

    Content of this advisory:
        1) Solved Security Vulnerabilities:
            - SUSE Linux 8.2 discontinued.
            - pstopnm use of ghostscript without -dSAFER
            - gaim various security problems
            - kopete gadu denial of service attack
            - squirrelmail various cross site scripting issues
            - awstats remote code execution
            - powerdns denial of service attack
            - gpdf denial of service attack
            - kpdf denial of service attack
            - mediawiki cross site scripting problem
            - wipe left around backup copies
            - ethereal various security issues
        2) Pending Vulnerabilities, Solutions, and Work-Arounds:
            - acroread plugin buffer overflow
            - various kernel security issues
            - evolution format string problems
        3) Authenticity Verification and Additional Information

______________________________________________________________________________

1) Solved Security Vulnerabilities

   To avoid flooding mailing lists with SUSE Security Announcements for minor
   issues, SUSE Security releases weekly summary reports for the low profile
   vulnerability fixes. The SUSE Security Summary Reports do not list md5 sums
   or download URLs like the SUSE Security Announcements that are released for
   more severe vulnerabilities.

   Fixed packages for the following incidents are already available on our FTP
   server and via the YaST Online Update.

   - SUSE Linux 8.2 discontinued

     As previously announced we have discontinued support of SUSE Linux 8.2
     on the 31rd of July.

     Begin of next week we will now move away the directories for the
     YaST Online Update to free disk space on the mirrors.

     The YOU patches and fixed RPMs will remain on:
         ftp://ftp.suse.com/pub/suse/discontinued/i386/8.2/


   - pstopnm use of ghostscript without -dSAFER

     pstopnm in netpbm does not properly use the "-dSAFER" option when
     calling Ghostscript to convert convert a Postscript file into a (1)
     PBM, (2) PGM, or (3) PNM file, which allows external user-complicit
     attackers to execute arbitrary commands.

     This is tracked by the Mitre CVE ID CAN-2005-2471.

     This problem affects all SUSE Linux based products.

   - gaim various security problems

     Various memory corruption bugs within the GNOME instant messenger
     client gaim have been fixed:

     - An AIM/ICQ malformed filename crash. Mitre CVE ID: CAN-2005-2102 -
     - An AIM/ICQ away-message buffer overflow. Mitre CVE ID: CAN-2005-2103

     For the SUSE Linux 9.3 and 9.2 distributions a memory alignment
     bug within libgadu has been fixed too, tracked by the Mitre CVE
     ID CAN-2005-1852.

     All SUSE Linux versions including gaim are affected.

   - kopete gadu denial of service attack

     The KDE instant messenging program 'kopete' was affected by a
     problem within the "gadu" protocol handling. A specially crafted
     'gadu' message could crash the program.

     This is tracked by the Mitre CVE ID CAN-2005-1852. Only SUSE Linux
     9.3 contained the vulnerable code, no other versions were affected.

   - squirrelmail various cross site scripting issues

     The web mailer squirrelmail had several more cross site scripting
     problems which were fixed upstream. This patch integrates them into
     our packages.

     This is tracked by the Mitre CVE ID CAN-2004-0519.

     This issue affects SUSE Linux Professional 9.0 up to 9.3.

   - awstats remote code execution

     The web statistics program 'awstats'  contains an invalid usage
     of the eval() function within the awstats perl script. This
     vulnerability can be used by remote attackers to execute arbitrary
     code.

     This issue is tracked by the Mitre CVE ID CAN-2005-1527 and affects
     SUSE Linux 9.0 up to 9.3.

   - powerdns denial of service attack

     The PowerDNS nameserver was updated to fix the following security
     issues:

     - The LDAP backend could fail and not respond anymore.
       This is tracked by the Mitre CVE ID CAN-2005-2301.

     - Recursive Queries of unauthorized clients could temporarily block
       queries of authorized clients.
       This is tracked by the Mitre CVE ID CAN-2005-2302.

     Only SUSE Linux 9.3 contains the pdns package and is affected.

   - gpdf and kpdf denial of service attack

     Broken as well as specially crafted PDF files can cause the GNOME
     PDF viewer gpdf and the KDE PDF viewer PDF to create large files
     in /tmp until the filesystem runs out of space.

     This is tracked by the Mitre CVE ID CAN-2005-2097.

     Only gpdf and kpdf in SUSE Linux 9.3 are affected by this problem.

   - MediaWiki cross site scripting problem

     Several cross site scripting (XSS) bugs were found and fixed in
     MediaWiki.

     - in the page move template, tracked by the Mitre CVE ID
       CAN-2005-2215.

     - with HTML attributes In page templates, tracked by the Mitre CVE
       ID CAN-2005-1888.

     Only SUSE Linux 9.3 includes MediaWiki and is affected by this
     problem.

   - wipe left around backup copies

     Due to bad path handling the secure file deletion tool 'wipe' in
     some cases leaves around a copy of the original file.

     This problem affects SUSE Linux 9.1 up to 9.3.

   - ethereal various security issues

     This update upgrades ethereal to version 0.10.12 which has all
     known security bugs fixed. Bugs fixed are tracked by the Mitre CVE
     IDs CAN-2005-2360, CAN-2005-2361, CAN-2005-2362, CAN-2005-2363,
     CAN-2005-2364, CAN-2005-2365, CAN-2005-2366, and CAN-2005-2367.

     A detailed list of bugs fixed can be found at:
          http://ethereal.com/appnotes/enpa-sa-00020.html

     All SUSE Linux versions were affected by this problem.
______________________________________________________________________________

2) Pending Vulnerabilities, Solutions, and Work-Arounds

   - acroread plugin buffer overflow

     A buffer overflow was reported in the Acrobat Reader plugin, allowing
     remote attackers to potentially execute code as the viewing user.

     This is tracked by the Mitre CVE ID CAN-2005-2470, we are
     currently testing updates.

   - various kernel security issues

     We are currently preparing a security kernel update for
     the 2.6 lines of kernels fixing currently known issues.

     We expect it to be released end of next week.

   - evolution format string problems

     Format string problems were reported in the evolution mail client.

     We are preparing updates for this issue.
______________________________________________________________________________

3) Authenticity Verification and Additional Information

  - Announcement authenticity verification:

    SUSE security announcements are published via mailing lists and on Web
    sites. The authenticity and integrity of a SUSE security announcement is
    guaranteed by a cryptographic signature in each announcement. All SUSE
    security announcements are published with a valid signature.

    To verify the signature of the announcement, save it as text into a file
    and run the command

      gpg --verify <file>

    replacing <file> with the name of the file containing the announcement.
    The output for a valid signature looks like:

      gpg: Signature made <DATE> using RSA key ID 3D25D3D9
      gpg: Good signature from "SuSE Security Team <security@suse.de>"

    where <DATE> is replaced by the date the document was signed.

    If the security team's key is not contained in your key ring, you can
    import it from the first installation CD. To import the key, use the
    command

      gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc

  - Package authenticity verification:

    SUSE update packages are available on many mirror FTP servers all over the
    world. While this service is considered valuable and important to the free
    and open source software community, the authenticity and integrity of a
    package needs to be verified to ensure that it has not been tampered with.

    The internal RPM package signatures provide an easy way to verify the
    authenticity of an RPM package. Use the command

      rpm -v --checksig <file.rpm>

    to verify the signature of the package, replacing <file.rpm> with the
    filename of the RPM package downloaded. The package is unmodified if it
    contains a valid signature from build@suse.de with the key ID 9C800ACA.

    This key is automatically imported into the RPM database (on RPMv4-based
    distributions) and the gpg key ring of 'root' during installation. You can
    also find it on the first installation CD and included at the end of this
    announcement.

  - SUSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        -   General Linux and SUSE security discussion.
            All SUSE security announcements are sent to this list.
            To subscribe, send an e-mail to
                <suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
        -   SUSE's announce-only mailing list.
            Only SUSE's security announcements are sent to this list.
            To subscribe, send an e-mail to
                <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (FAQ)
    send mail to <suse-security-info@suse.com> or
    <suse-security-faq@suse.com>.

    =====================================================================
    SUSE's security contact is <security@suse.com> or <security@suse.de>.
    The <security@suse.de> public key is listed below.
    =====================================================================
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way. In particular, the
    clear text signature should show proof of the authenticity of the text.

    SUSE Linux Products GmbH provides no warranties of any kind whatsoever
    with respect to the information contained in this security advisory.

Type Bits/KeyID    Date       User ID
pub  2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de>
pub  1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCkYS3yEKeueNWc+z/0Kvff
4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP+Y0PFPboMvKx0FXl/A0d
M+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR8xocQSVCFxcwvwCglVcO
QliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U8c/yE/vdvpN6lF0tmFrK
XBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0ScZqITuZC4CWxJa9GynBE
D3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEhELBeGaPdNCcmfZ66rKUd
G5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtBUVKn4zLUOf6aeBAoV6NM
CC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOoAqajLfvkURHAeSsxXIoE
myW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1nKFvF+rQoU3VTRSBQYWNr
YWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohcBBMRAgAcBQI57vSBBQkD
wmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8sAJ98BgD40zw0GHJHIf6d
NfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQEQIABgUCOnBeUgAKCRCe
QOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACeOO1HIbActAevk5MUBhNe
LZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vfiUUE1VQnt+T/EYklES3t
XXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEISZxbzdXGnqIlcT08TzBU
D9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9gTPSr+/fT3WeVnwJiQCQ3
0kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23pQUPAgJENDEqeU6iIO9Ot
1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1yPqZd5CvvznYvB6bWBIpW
cRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IXSzyohEJB6XG5+D0BiF0E
ExECAB0FAjxqqTQFCQoAgrMFCwcKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyp1f
AJ9dR7saz2KPNwD3U+fy/0BDKXrYGACfbJ8fQcJqCBQxeHvt9yMPDVq0B0W5Ag0E
Oe70khAIAISR0E3ozF/la+oNaRwxHLrCet30NgnxRROYhPaJB/Tu1FQokn2/Qld/
HZnh3TwhBIw1FqrhWBJ7491iAjLR9uPbdWJrn+A7t8kSkPaF3Z/6kyc5a8fas44h
t5h+6HMBzoFCMAq2aBHQRFRNp9Mz1ZvoXXcI1lk1l8OqcUM/ovXbDfPcXsUVeTPT
tGzcAi2jVl9hl3iwJKkyv/RLmcusdsi8YunbvWGFAF5GaagYQo7YlF6UaBQnYJTM
523AMgpPQtsKm9o/w9WdgXkgWhgkhZEeqUS3m5xNey1nLu9iMvq9M/iXnGz4sg6Q
2Y+GqZ+yAvNWjRRou3zSE7Bzg28MI4sAAwYH/2D71Xc5HPDgu87WnBFgmp8MpSr8
QnSs0wwPg3xEullGEocolSb2c0ctuSyeVnCttJMzkukL9TqyF4s/6XRstWirSWaw
JxRLKH6Zjo/FaKsshYKf8gBkAaddvpl3pO0gmUYbqmpQ3xDEYlhCeieXS5MkockQ
1sj2xYdB1xO0ExzfiCiscUKjUFy+mdzUsUutafuZ+gbHog1CN/ccZCkxcBa5IFCH
ORrNjq9pYWlrxsEn6ApsG7JJbM2besW1PkdEoxak74z1senh36m5jQvVjA3U4xq1
wwylxadmmJaJHzeiLfb7G1ZRjZTsB7fyYxqDzMVul6o9BSwO/1XsIAnV1uuITAQY
EQIADAUCOe70kgUJA8JnAAAKCRCoTtronIAKyksiAJsFB3/77SkH3JlYOGrEe1Ol
0JdGwACeKTttgeVPFB+iGJdiwQlxasOfuXyITAQYEQIADAUCPGqpWQUJCgCCxwAK
CRCoTtronIAKyofBAKCSZM2UFyta/fe9WgITK9I5hbxxtQCfX+0ar2CZmSknn3co
SPihn1+OBNyZAQ0DNuEtBAAAAQgAoCRcd7SVZEFcumffyEwfLTcXQjhKzOahzxpo
omuF+HIyU4AGq+SU8sTZ/1SsjhdzzrSAfv1lETACA+3SmLr5KV40Us1w0UC64cwt
A46xowVq1vMlH2Lib+V/qr3b1hE67nMHjysECVx9Ob4gFuKNoR2eqnAaJvjnAT8J
/LoUC20EdCHUqn6v+M9t/WZgC+WNR8cq69uDy3YQhDP/nIan6fm2uf2kSV9A7ZxE
GrwsWl/WX5Q/sQqMWaU6r4az98X3z90/cN+eJJ3vwtA+rm+nxEvyev+jaLuOQBDf
ebh/XA4FZ35xmi+spdiVeJH4F/ubaGlmj7+wDOF3suYAPSXT2QAFEbQlU3VTRSBT
ZWN1cml0eSBUZWFtIDxzZWN1cml0eUBzdXNlLmRlPokBFQMFEDbhLUfkWLKHsco8
RQEBVw4H/1vIdiOLX/7hdzYaG9crQVIk3QwaB5eBbjvLEMvuCZHiY2COUg5QdmPQ
8SlWNZ6k4nu1BLcv2g/pymPUWP9fG4tuSnlUJDrWGm3nhyhAC9iudP2u1YQY37Gb
B6NPVaZiYMnEb4QYFcqv5c/r2ghSXUTYk7etd6SW6WCOpEqizhx1cqDKNZnsI/1X
11pFcO2N7rc6byDBJ1T+cK+F1Ehan9XBt/shryJmv04nli5CXQMEbiqYYMOu8iaA
8AWRgXPCWqhyGhcVD3LRhUJXjUOdH4ZiHCXaoF3zVPxpeGKEQY8iBrDeDyB3wHmj
qY9WCX6cmogGQRgYG6yJqDalLqrDOdmJARUDBRA24S0Ed7LmAD0l09kBAW04B/4p
WH3f1vQn3i6/+SmDjGzUu2GWGq6Fsdwo2hVM2ym6CILeow/K9JfhdwGvY8LRxWRL
hn09j2IJ9P7H1Yz3qDf10AX6V7YILHtchKT1dcngCkTLmDgC4rs1iAAl3f089sRG
BafGPGKv2DQjHfR1LfRtbf0P7c09Tkej1MP8HtQMW9hPkBYeXcwbCjdrVGFOzqx+
AvvJDdT6a+oyRMTFlvmZ83UV5pgoyimgjhWnM1V4bFBYjPrtWMkdXJSUXbR6Q7Pi
RZWCzGRzwbaxqpl3rK/YTCphOLwEMB27B4/fcqtBzgoMOiaZA0M5fFoo54KgRIh0
zinsSx2OrWgvSiLEXXYKiEYEEBECAAYFAjseYcMACgkQnkDjEAAKq6ROVACgjhDM
/3KM+iFjs5QXsnd4oFPOnbkAnjYGa1J3em+bmV2aiCdYXdOuGn4ZiQCVAwUQN7c7
whaQN/7O/JIVAQEB+QP/cYblSAmPXxSFiaHWB+MiUNw8B6ozBLK0QcMQ2YcL6+Vl
D+nSZP20+Ja2nfiKjnibCv5ss83yXoHkYk2Rsa8foz6Y7tHwuPiccvqnIC/c9Cvz
dbIsdxpfsi0qWPfvX/jLMpXqqnPjdIZErgxpwujas1n9016PuXA8K3MJwVjCqSKI
RgQQEQIABgUCOhpCpAAKCRDHUqoysN/3gCt7AJ9adNQMbmA1iSYcbhtgvx9ByLPI
DgCfZ5Wj+f7cnYpFZI6GkAyyczG09sE=
=LRKC
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iQEVAwUBQwXq8Xey5gA9JdPZAQKw8wf/diJKq2F/OF8jobHIIhGOJSHJ9UpOJQ0o
S1iiZaZ5uRYV7TtFA++DXzTSVn68hA7OE2TV89oz9S7dMUzf1i8xb8fhOGla8cAa
Y6te2qe/cfY/PiyRl6H9n6O3RJrf8WBhiSJ6GNUOPdt6mPOSHpfQNfoYNuyKvyPw
nS76BWPc42i2CxO7vGS/ITf62L6Mz1sgvYsrqZg4LxHzMXfdtVkddbiFV/HmcZz1
NUlUEK/m3Tz0dcNjU+IRSO2DkKb2N9EvOY3k3r1s4HRW1DecrSRxv+TPJjGt7nuS
zqBaqGgoSkH+QQHZNSE5D9vnXNQU/0w9QZVgwVkZf2SlpCpsN9IaRQ==
=3+tK
-----END PGP SIGNATURE-----

-- 
To unsubscribe, e-mail: suse-security-announce-unsubscribe@suse.com
For additional commands, e-mail: suse-security-announce-help@suse.com