April 2007 - security [ARCHIVED] - Fedora mailing-lists

[Bug 237533] New: CVE-2007-2165: proftpd auth bypass vulnerability
by Red Hat Bugzilla 30 Jul '08

30 Jul '08

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237533 Summary: CVE-2007-2165: proftpd auth bypass vulnerability Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: high Priority: high Component: proftpd AssignedTo: matthias(a)rpmforge.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2165 http://bugs.proftpd.org/show_bug.cgi?id=2922 "The Auth API in ProFTPD before 20070417, when multiple simultaneous authentication modules are configured, does not require that the module that checks authentication is the same as the module that retrieves authentication data, which might allow remote attackers to bypass authentication, as demonstrated by use of SQLAuthTypes Plaintext in mod_sql, with data retrieved from /etc/passwd." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 19

[Bug 233705] New: CVE-2007-0653 XMMS multiple issues (CVE-2007-0654)
by Red Hat Bugzilla 04 Apr '08

04 Apr '08

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=233705 Summary: CVE-2007-0653 XMMS multiple issues (CVE-2007-0654) Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: low Priority: normal Component: xmms AssignedTo: paul(a)all-the-johnsons.co.uk ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com Cloning RHEL bug for FE[56]. +++ This bug was initially created as a clone of Bug #228013 +++ Sven Krewitt of Secunia reported two flaws he discovered in the way XMMS handles skin files. Here are the technical details provided by Sven: --- Details --- CVE-2007-0654 1) An integer underflow error exists when loading skin bitmap images, which can be exploited to cause a stack-based buffer overflow via specially crafted skin images containing manipulated header information. The vulnerability is caused due to errors within "read_bmp()" in xmms/bmp.c when loading skin bitmap images. -- xmms/bmp.c -- GdkPixmap *read_bmp(gchar * filename) [...] fseek(file, 8, SEEK_CUR); read_le_long(file, &offset); <-- [1] read_le_long(file, &headSize); [...] else if (bitcount != 24 && bitcount != 16 && bitcount != 32) { gint ncols, i; ncols = offset - headSize - 14; <-- [2] if (headSize == 12) { ncols = MIN(ncols / 3, 256); for (i = 0; i < ncols; i++) fread(&rgb_quads[i], 3, 1, file); } else { ncols = MIN(ncols / 4, 256); fread(rgb_quads, 4, ncols, file); <-- [3] [...] ----- "offset" [1] is not properly verified before being used to calculate "ncols" [2]. "bitcount" has to be set to a different value than 24, 16 or 32 (but can also be user controlled). This can be exploited to cause a integer underflow, resulting in a stack based buffer overflow, which can be used to overwrite the return address of "read_bmp()" [3]. Successful exploitation allows execution of arbitrary code. CVE-2007-0653 2) An integer overflow error exists when loading skin bitmap images. This can be exploited to cause a memory corruption via specially crafted skin images containing manipulated header information. -- xmms/bmp.c -- GdkPixmap *read_bmp(gchar * filename) [...] else if (headSize == 40) /* BITMAPINFO */ { guint16 tmp; read_le_long(file, &w); <-- [4] read_le_long(file, &h); <-- [4] [...] fseek(file, offset, SEEK_SET); buffer = g_malloc(imgsize); fread(buffer, imgsize, 1, file); fclose(file); data = g_malloc0((w * 3 * h) + 3); <-- [5] if (bitcount == 1) ---- -- Additional comment from bressers(a)redhat.com on 2007-02-09 10:23 EST -- These flaws also affect RHEL2.1 and RHEL3 -- Additional comment from davidz(a)redhat.com on 2007-02-09 12:32 EST -- Are there patches for these yet? -- Additional comment from bressers(a)redhat.com on 2007-02-09 13:19 EST -- There are no patches yet. I'm still trying to contact someone upstream about this. If you have any upstream contacts, please let me know. -- Additional comment from bressers(a)redhat.com on 2007-03-21 09:26 EST -- Lifting embargo -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 7

[Bug 229990] New: CVE-2007-1030: libevent < 1.3 DoS
by Red Hat Bugzilla 04 Apr '08

04 Apr '08

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229990 Summary: CVE-2007-1030: libevent < 1.3 DoS Product: Fedora Extras Version: devel Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: normal Component: libevent AssignedTo: redhat-bugzilla(a)camperquake.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list@redhat.com,steved@redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1030 "Niels Provos libevent 1.2 and 1.2a allows remote attackers to cause a denial of service (infinite loop) via a DNS response containing a label pointer that references its own offset." FE5 and FC6 are at 1.1a, not clear if those versions are affected. Rawhide was updated to 1.2a a few days ago, however (unlike the changelog says) the latest upstream is 1.3a, not 1.2a. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 7

[Bug 221694] New: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure
by Red Hat Bugzilla 10 Dec '07

10 Dec '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=221694 Summary: CVE-2007-0095: phpMyAdmin <= 2.9.1.1 information disclosure Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: low Priority: normal Component: phpMyAdmin AssignedTo: imlinux(a)gmail.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com,redhat- bugzilla(a)linuxnetz.de http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0095 "phpMyAdmin 2.9.1.1 allows remote attackers to obtain sensitive information via a direct request for themes/darkblue_orange/layout.inc.php, which reveals the path in an error message." FC5+ apparently affected, even though I'm not sure if this is an issue at all. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 13

[Bug 237882] New: CVE-2007-2245: phpMyAdmin < 2.10.1 XSS vulnerabilities
by Red Hat Bugzilla 01 Nov '07

01 Nov '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237882 Summary: CVE-2007-2245: phpMyAdmin < 2.10.1 XSS vulnerabilities Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: phpMyAdmin AssignedTo: mmcgrath(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com,redhat- bugzilla(a)linuxnetz.de http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-2245 "Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin before 2.10.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the fieldkey parameter to browse_foreigners.php or (2) certain input to the PMA_sanitize function." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 3

[Bug 230927] New: CVE-2007-1103: tor information disclosure
by Red Hat Bugzilla 01 Nov '07

01 Nov '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=230927 Summary: CVE-2007-1103: tor information disclosure Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: low Priority: medium Component: tor AssignedTo: enrico.scholz(a)informatik.tu-chemnitz.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1103 "Tor does not verify a node's uptime and bandwidth advertisements, which allows remote attackers who operate a low resource node to make false claims of greater resources, which places the node into use for many circuits and compromises the anonymity of traffic sources and destinations." All <= 0.1.1.26 versions reportedly affected. Upstream statement: http://blogs.law.harvard.edu/anonymous/2007/02/26/the-rumors-of-our-demise/ -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 235013] New: CVE-2007-1804: pulseaudio 0.9.5 DoS
by Red Hat Bugzilla 07 Sep '07

07 Sep '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235013 Summary: CVE-2007-1804: pulseaudio 0.9.5 DoS Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: pulseaudio AssignedTo: drzeus-bugzilla(a)drzeus.cx ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1804 "PulseAudio 0.9.5 allows remote attackers to cause a denial of service (daemon crash) via (1) a PA_PSTREAM_DESCRIPTOR_LENGTH value of FRAME_SIZE_MAX_ALLOW sent on TCP port 9875, which triggers a p->export assertion failure in do_read; (2) a PA_PSTREAM_DESCRIPTOR_LENGTH value of 0 sent on TCP port 9875, which triggers a length assertion failure in pa_memblock_new; or (3) an empty packet on UDP port 9875, which triggers a t assertion failure in pa_sdp_parse; and allows remote authenticated users to cause a denial of service (daemon crash) via a crafted packet on TCP port 9875 that (4) triggers a maxlength assertion failure in pa_memblockq_new, (5) triggers a size assertion failure in pa_xmalloc, or (6) plays a certain sound file." FC5, FC6, devel have 0.9.5 at the moment. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 4

[Bug 192830] New: CVE-2006-2453 Additional dia format string flaws
by Red Hat Bugzilla 30 Aug '07

30 Aug '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=192830 Summary: CVE-2006-2453 Additional dia format string flaws Product: Fedora Extras Version: fc5 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: dia AssignedTo: j.w.r.degoede(a)hhs.nl ReportedBy: bressers(a)redhat.com QAContact: extras-qa(a)fedoraproject.org CC: extras-qa(a)fedoraproject.org,fedora-security- list(a)redhat.com A number of additional format string issues were discovered by Hans de Goede and has been assigned the CVE id CVE-2006-2453. The fix is attachment 129852 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 13

[Bug 215136] New: CVE-2006-5864: gv <= 3.6.2 stack-based buffer overflow
by Red Hat Bugzilla 30 Aug '07

30 Aug '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=215136 Summary: CVE-2006-5864: gv <= 3.6.2 stack-based buffer overflow Product: Fedora Extras Version: fc6 Platform: All URL: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5864 OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: gv AssignedTo: orion(a)cora.nwra.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: extras-qa(a)fedoraproject.org,fedora-security- list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-5864 "Stack-based buffer overflow in the ps_gettext function in ps.c for GNU gv 3.6.2, and possibly earlier versions, allows user-assisted attackers to execute arbitrary code via a PostScript (PS) file with certain headers that contain long comments, as demonstrated using the DocumentMedia header." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 5

Fedora 7 and the Security Response Team
by Josh Bressers 21 Jun '07

21 Jun '07

As everybody is no doubt aware, Fedora 7 is bringing a number of changes, one of which will be putting the burden of security on the Fedora Security Response Team. Right now it's basically the Red Hat Security Response Team working on Core, and not much of anything happening for Extras. This is going to change. I'm going to be filing a request for some resources sometime this week. I have an IRC bot and an xmlrpc server that will initially run from there. The long term goal is to host the various security related tools that don't yet exist. In the meantime, the task at hand should be to start tracking flaws for Fedora 7. What we usually would do at this point for core, is copy the fc6 file into fc7 in CVS. We then pour over the entries looking for questionable items. I'm thinking what we should do for Fedora 7, is merge the fe6 and fc6 files into a f7 (a better name is welcome) file, then start working through this file. We've never done this in a distributed manner before, so ideas are welcome. -- JB

7 16

[Bug 231734] New: CVE-2007-1246: xine-lib buffer overflow
by Red Hat Bugzilla 17 Jun '07

17 Jun '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=231734 Summary: CVE-2007-1246: xine-lib buffer overflow Product: Fedora Extras Version: fc5 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: xine-lib AssignedTo: gauret(a)free.fr ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list@redhat.com,ville.skytta@iki.fi http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1246 Originally reported against MPlayer, but it turns out xine-lib is vulnerable too. Upstream fix pushed to FC6+ (1.1.4-3 currently building), but FC5 is still at 1.1.2, probably already lacking "several bug and security fixes" as put by upstream in the 1.1.3 release announcement. No FC5 system here to test with, so leaving up to Aurelien to decide whether to update while at it or just to possibly apply the patch for this issue from FC6+ (if it applies, unchecked). ------- Additional Comments From ville.skytta(a)iki.fi 2007-03-10 17:29 EST ------- Created an attachment (id=149781) --> (https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=149781&action=view) Fix from upstream CVS -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

[Bug 228764] New: CVE-2007-0901, CVE-2007-0902: moin 1.5.7 XSS, information disclosure
by Red Hat Bugzilla 07 May '07

07 May '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=228764 Summary: CVE-2007-0901, CVE-2007-0902: moin 1.5.7 XSS, information disclosure Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: normal Component: moin AssignedTo: matthias(a)rpmforge.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com CVE's against moin 1.5.7, with little useful information available at the moment: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0901 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0902 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 3

[Bug 235416] New: CVE-2004-1025, CVE-2004-1026: imlib integer/buffer overflows
by Red Hat Bugzilla 02 May '07

02 May '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235416 Summary: CVE-2004-1025, CVE-2004-1026: imlib integer/buffer overflows Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: imlib AssignedTo: paul(a)city-fan.org ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-1025 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-1026 These two old issues appear to be still present in FE6 (1.9.13-*) and devel (1.9.15-*) imlib packages. Bug 138516 contains a test case XPM as well as a patch which should fix these issues. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 3

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 25 Apr '07

25 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 ------- Additional Comments From jonathan.underwood(a)gmail.com 2007-04-25 06:15 EST ------- Splendid, thanks. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 24 Apr '07

24 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 tibbs(a)math.uh.edu changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution| |CURRENTRELEASE Fixed In Version| |2.6-4 ------- Additional Comments From tibbs(a)math.uh.edu 2007-04-24 18:21 EST ------- I did some testing and let the new version stew on my servers overnight. Since that went OK, I pushed and built for F7, FC6, FC5, EL5 and EL4. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 23 Apr '07

23 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 ------- Additional Comments From jonathan.underwood(a)gmail.com 2007-04-23 12:41 EST ------- OK, thanks. An update for FC6 would also be much appreciated. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 23 Apr '07

23 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 ------- Additional Comments From tibbs(a)math.uh.edu 2007-04-23 12:36 EST ------- OK, let me do a build and see if I can get this past releng for F7. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 23 Apr '07

23 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 ------- Additional Comments From jonathan.underwood(a)gmail.com 2007-04-23 12:28 EST ------- (In reply to comment #4) > Any clue as to what this looks like for an IPv6 denial? Um, no. Seems irrelevant though, this fix is as IPV6 safe as the rest of DenyHosts - basically it brings REGEX7 into alignment with the other REGEXs - if this is broken for IPV6, then all the others are too. I don't have any way to test this I'm afraid. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 23 Apr '07

23 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 ------- Additional Comments From jonathan.underwood(a)gmail.com 2007-04-23 12:25 EST ------- Created an attachment (id=153291) --> (https://bugzilla.redhat.com/bugzilla/attachment.cgi?id=153291&action=view) Fix REGEX7 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237449] Login attempts as root may go unnoticed
by Red Hat Bugzilla 23 Apr '07

23 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: Login attempts as root may go unnoticed https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237449 tibbs(a)math.uh.edu changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fedora-security- | |list(a)redhat.com -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 237293] New: CVE-2007-1558: claws-mail APOP vulnerability
by Red Hat Bugzilla 21 Apr '07

21 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=237293 Summary: CVE-2007-1558: claws-mail APOP vulnerability Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: claws-mail AssignedTo: andreas.bierfert(a)lowlatency.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1558 "The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including (1) Thunderbird, (2) Evolution, (3) mutt, and (4) fetchmail." According to upstream, fixed in 2.9.1. http://www.claws-mail.org/news.php -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 236703] possible vulnerabilities CVE-2007-1745
by Red Hat Bugzilla 20 Apr '07

20 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: possible vulnerabilities CVE-2007-1745 https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236703 ville.skytta(a)iki.fi changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Security CC| |fedora-security- | |list(a)redhat.com -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 236948] New: CVE-2007-1745: clamav < 0.90.2 chm unpack issue
by Red Hat Bugzilla 18 Apr '07

18 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236948 Summary: CVE-2007-1745: clamav < 0.90.2 chm unpack issue Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: clamav AssignedTo: enrico.scholz(a)informatik.tu-chemnitz.de ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1745 "The chm_decompress_stream function in libclamav/chmunpack.c in Clam AntiVirus (ClamAV) before 0.90.2 leaks file descriptors, which has unknown impact and attack vectors involving a crafted CHM file, a different vulnerability than CVE-2007-0897. NOTE: some of these details are obtained from third party information." CVE-2007-1997 appears to be somewhat related and is said to affect 0.9x versions before 0.90.2 only, however for this CVE I didn't find anything that would say 0.88.7 currently in FE5 and FE6 wouldn't be affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 229253] New: CVE-2007-0981: seamonkey cookie setting / same-domain bypass vulnerability
by Red Hat Bugzilla 17 Apr '07

17 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=229253 Summary: CVE-2007-0981: seamonkey cookie setting / same-domain bypass vulnerability Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: normal Component: seamonkey AssignedTo: kengert(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0981 "Mozilla based browsers allows remote attackers to bypass the same origin policy, steal cookies, and conduct other attacks by writing a URI with a null byte to the hostname (location.hostname) DOM property, due to interactions with DNS resolver code." Seamonkey seems vulnerable. See also https://bugzilla.mozilla.org/show_bug.cgi?id=370445 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

3 3

[Bug 235912] New: CVE-2007-1893, CVE-2007-1897: wordpress < 2.1.3 issues
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235912 Summary: CVE-2007-1893, CVE-2007-1897: wordpress < 2.1.3 issues Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: wordpress AssignedTo: jwb(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1893 "WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post."" http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1897 "SQL injection vulnerability in xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable." All active FE releases have 2.1.3-RC2 which seems affected. 2.1.3 final is said to fix these issues. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236489 matthias(a)rpmforge.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |CLOSED Resolution| |NEXTRELEASE ------- Additional Comments From matthias(a)rpmforge.net 2007-04-16 07:35 EST ------- Branches FC-5, FC-6 and devel (to become F7) have been updated. No EL packages yet, since lua is still missing from EPEL. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 16 Apr '07

16 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236489 matthias(a)rpmforge.net changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED ------- Additional Comments From matthias(a)rpmforge.net 2007-04-16 07:24 EST ------- Since 1.4.15 doesn't seem to break any configuration syntax (I've tested an update on a few servers, some with complex setups), I've decided to update all currently supported branches to 1.4.15, which contains these fixes. Note that the CVE-2007-1869 bug was already fixed in the devel and EL-5 branches, but they hadn't yet been rebuilt. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

[Bug 232103] New: CVE-2007-1429: moodle 1.7.1 remote file inclusion
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=232103 Summary: CVE-2007-1429: moodle 1.7.1 remote file inclusion Product: Fedora Extras Version: devel Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: moodle AssignedTo: mmcgrath(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1429 "Multiple PHP remote file inclusion vulnerabilities in Moodle 1.7.1 allow remote attackers to execute arbitrary PHP code via a URL in the cmd parameter to (1) admin/utfdbmigrate.php or (2) filter.php." Reported against 1.7.1 which is not currently in any FE repo; reporting here in order to track/ask for confirmation whether 1.6.x in FC-5 and FC-6, and 1.7 in devel are affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

[Bug 220041] New: CVE-2006-6625, CVE-2006-6626: moodle XSS vulnerabilities
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=220041 Summary: CVE-2006-6625, CVE-2006-6626: moodle XSS vulnerabilities Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: moodle AssignedTo: imlinux(a)gmail.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: extras-qa(a)fedoraproject.org,fedora-security- list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6625 Reported against 1.6.1 but an upstream patch which I suppose fixes this is not applied in 1.6.3: http://moodle.cvs.sourceforge.net/moodle/moodle/mod/forum/discuss.php?r1=1.… http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-6626 Reported against 1.5, too little information available at the moment to say whether this is an issue with 1.6.3. All FC4+ distro releases are equally affected (or not). -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 3

[Bug 236489] CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities
by Red Hat Bugzilla 15 Apr '07

15 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2007-1869, CVE-2007-1870: lighttpd < 1.4.14 DoS vulnerabilities https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=236489 ville.skytta(a)iki.fi changed: What |Removed |Added ---------------------------------------------------------------------------- Keywords| |Security CC| |fedora-security- | |list(a)redhat.com -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 0

FYI: aircrack-ng / airodump-ng, remote code execution
by Till Maas 13 Apr '07

13 Apr '07

Hello, airodump-ng has a remote code execution vulnerability: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0408.html The bug is fixed in svn which will be released without major changes to the linux code as version 0.8, soon. A new package from cvs has been built. If you use airodump, please upgrade. Regards, Till

1 0

[Bug 233700] New: CVE-2007-1614: zzliplib stack-based buffer overflow
by Red Hat Bugzilla 11 Apr '07

11 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=233700 Summary: CVE-2007-1614: zzliplib stack-based buffer overflow Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: zziplib AssignedTo: matthias(a)rpmforge.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1614 "Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 209167] New: seamonkey < 1.0.5 multiple vulnerabilities
by Red Hat Bugzilla 10 Apr '07

10 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=209167 Summary: seamonkey < 1.0.5 multiple vulnerabilities Product: Fedora Extras Version: fc4 Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: seamonkey AssignedTo: kengert(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: extras-qa(a)fedoraproject.org,fedora-security- list(a)redhat.com seamonkey 1.0.4 in FE4 is probably affected by CVE-2006-4253, CVE-2006-4340, CVE-2006-4565, CVE-2006-4566, CVE-2006-4568, CVE-2006-4570 and CVE-2006-4571. According to upstream, these are fixed in 1.0.5 (FE5+) -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 13

[Bug 235015] New: CVE-2007-1732: wordpress mt import XSS
by Red Hat Bugzilla 09 Apr '07

09 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235015 Summary: CVE-2007-1732: wordpress mt import XSS Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: wordpress AssignedTo: jwb(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1732 "** DISPUTED ** Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor." Posted for maintainer assessment whether this is a feature or a bug, and whether it affects current FE releases. FWIW, Gentoo has patched it. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

Fedora Security Response Team Update
by Josh Bressers 05 Apr '07

05 Apr '07

I think it's in the best interest of everyone if I give updates of what's going on as things happen. One of my goals is to have a transparent security team. This can't happen unless I keep everyone who cares in the loop. So far the biggest things done regarding the team are infrastructural changes. security(a)fp.o and secalert(a)fp.o aliases have been created and now deliver mail to a private list. Right now the only member are Luke Macken and myself. I'm not sure how to best hand out membership to this list. Ideas are welcome. It's a matter of trust, and part of the challenge here is who to trust? I've also requested a Xen instance for various security tools to run on: http://fedoraproject.org/wiki/Infrastructure/RFR/wiki/Infrastructure/RFR/Se… Things to do: Update the wiki pages. The current information is pretty slim. We'll try to grow these in an organic manner. It makes more sense to me if we let process evolve, and document it, rather than documenting, then trying to use a process. GPG key. I'm pondering how to handle this. There will be groups that want to send us encrypted mail. How can we do this in a secure manner (trust is a big issue here). Start the review of FC7. Task tracking. How can we do this best? We theoretically could use bugzilla, but it's really not ideal for this sort of thing. There is an OTRS instance running for the infrastructure group, but I'm afraid when I'm told it's not used much and could go away. If we have a Xen instance, we could run our own RT. I'm not sure if I like this idea though. ???? (Anything else to add) -- JB

3 2

[Bug 235014] New: CVE-2007-1799: ktorrent < 2.1.3 arbitrary file overwrite
by Red Hat Bugzilla 03 Apr '07

03 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235014 Summary: CVE-2007-1799: ktorrent < 2.1.3 arbitrary file overwrite Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: ktorrent AssignedTo: wolters.liste(a)gmx.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list@redhat.com,rdieter@math.unl.edu http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1799 "Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.3 only checks for the ".." string, which allows remote attackers to overwrite arbitrary files via modified ".." sequences in a torrent filename, as demonstrated by "../" sequences, due to an incomplete fix for CVE-2007-1384." FC5, FC6, devel have 2.1.2 at the moment. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

About zhcon setuid issue.
by Hu Zheng 03 Apr '07

03 Apr '07

The zhcon package was added to FC6 and FC7 extra recently. But there is a issue of it that we may need to notice. Because it need to access /dev/fb0 and so on, it need the setuid permission, so normal users can use it too. This bring the security risk. But for users' convenience, I didn't remove this setuid permission. It is still better don't install zhcon by default. Let's user install it manually. Maybe we can use ACL to controll this?

3 3

[Bug 231728] New: CVE-2007-1359: mod_security <= 2.1.0 request rule bypass
by Red Hat Bugzilla 02 Apr '07

02 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=231728 Summary: CVE-2007-1359: mod_security <= 2.1.0 request rule bypass Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: mod_security AssignedTo: mfleming+rpm(a)enlartenment.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com,redhat- bugzilla(a)linuxnetz.de http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1359 "Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python." Based on version numbers, all FE releases are affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] April 2007