security [ARCHIVED] April 2007

security@lists.fedoraproject.org

8 participants
38 discussions

FYI: aircrack-ng / airodump-ng, remote code execution
by Till Maas 13 Apr '07

13 Apr '07

Hello, airodump-ng has a remote code execution vulnerability: http://archives.neohapsis.com/archives/fulldisclosure/2007-04/0408.html The bug is fixed in svn which will be released without major changes to the linux code as version 0.8, soon. A new package from cvs has been built. If you use airodump, please upgrade. Regards, Till

1 0

[Bug 233700] New: CVE-2007-1614: zzliplib stack-based buffer overflow
by Red Hat Bugzilla 11 Apr '07

11 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=233700 Summary: CVE-2007-1614: zzliplib stack-based buffer overflow Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: zziplib AssignedTo: matthias(a)rpmforge.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1614 "Stack-based buffer overflow in the zzip_open_shared_io function in zzip/file.c in ZZIPlib Library before 0.13.49 allows user-assisted remote attackers to cause a denial of service (application crash) or execute arbitrary code via a long filename." -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 1

[Bug 209167] New: seamonkey < 1.0.5 multiple vulnerabilities
by Red Hat Bugzilla 10 Apr '07

10 Apr '07

1 13

[Bug 235015] New: CVE-2007-1732: wordpress mt import XSS
by Red Hat Bugzilla 09 Apr '07

09 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235015 Summary: CVE-2007-1732: wordpress mt import XSS Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: wordpress AssignedTo: jwb(a)redhat.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1732 "** DISPUTED ** Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the demo parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. NOTE: another researcher disputes this issue, stating that this is legitimate functionality for administrators. However, it has been patched by at least one vendor." Posted for maintainer assessment whether this is a feature or a bug, and whether it affects current FE releases. FWIW, Gentoo has patched it. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

Fedora Security Response Team Update
by Josh Bressers 05 Apr '07

05 Apr '07

I think it's in the best interest of everyone if I give updates of what's going on as things happen. One of my goals is to have a transparent security team. This can't happen unless I keep everyone who cares in the loop. So far the biggest things done regarding the team are infrastructural changes. security(a)fp.o and secalert(a)fp.o aliases have been created and now deliver mail to a private list. Right now the only member are Luke Macken and myself. I'm not sure how to best hand out membership to this list. Ideas are welcome. It's a matter of trust, and part of the challenge here is who to trust? I've also requested a Xen instance for various security tools to run on: http://fedoraproject.org/wiki/Infrastructure/RFR/wiki/Infrastructure/RFR/Se… Things to do: Update the wiki pages. The current information is pretty slim. We'll try to grow these in an organic manner. It makes more sense to me if we let process evolve, and document it, rather than documenting, then trying to use a process. GPG key. I'm pondering how to handle this. There will be groups that want to send us encrypted mail. How can we do this in a secure manner (trust is a big issue here). Start the review of FC7. Task tracking. How can we do this best? We theoretically could use bugzilla, but it's really not ideal for this sort of thing. There is an OTRS instance running for the infrastructure group, but I'm afraid when I'm told it's not used much and could go away. If we have a Xen instance, we could run our own RT. I'm not sure if I like this idea though. ???? (Anything else to add) -- JB

3 2

[Bug 235014] New: CVE-2007-1799: ktorrent < 2.1.3 arbitrary file overwrite
by Red Hat Bugzilla 03 Apr '07

03 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=235014 Summary: CVE-2007-1799: ktorrent < 2.1.3 arbitrary file overwrite Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: ktorrent AssignedTo: wolters.liste(a)gmx.net ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list@redhat.com,rdieter@math.unl.edu http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1799 "Directory traversal vulnerability in torrent.cpp in KTorrent before 2.1.3 only checks for the ".." string, which allows remote attackers to overwrite arbitrary files via modified ".." sequences in a torrent filename, as demonstrated by "../" sequences, due to an incomplete fix for CVE-2007-1384." FC5, FC6, devel have 2.1.2 at the moment. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 2

About zhcon setuid issue.
by Hu Zheng 03 Apr '07

03 Apr '07

The zhcon package was added to FC6 and FC7 extra recently. But there is a issue of it that we may need to notice. Because it need to access /dev/fb0 and so on, it need the setuid permission, so normal users can use it too. This bring the security risk. But for users' convenience, I didn't remove this setuid permission. It is still better don't install zhcon by default. Let's user install it manually. Maybe we can use ACL to controll this?

3 3

[Bug 231728] New: CVE-2007-1359: mod_security <= 2.1.0 request rule bypass
by Red Hat Bugzilla 02 Apr '07

02 Apr '07

Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=231728 Summary: CVE-2007-1359: mod_security <= 2.1.0 request rule bypass Product: Fedora Extras Version: fc6 Platform: All OS/Version: Linux Status: NEW Severity: medium Priority: medium Component: mod_security AssignedTo: mfleming+rpm(a)enlartenment.com ReportedBy: ville.skytta(a)iki.fi QAContact: extras-qa(a)fedoraproject.org CC: fedora-security-list(a)redhat.com,redhat- bugzilla(a)linuxnetz.de http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1359 "Interpretation conflict in ModSecurity (mod_security) 2.1.0 and earlier allows remote attackers to bypass request rules via application/x-www-form-urlencoded POST data that contains an ASCIIZ (0x00) byte, which mod_security treats as a terminator even though it is still processed as normal data by some HTTP parsers including PHP 5.2.0, and possibly parsers in Perl, and Python." Based on version numbers, all FE releases are affected. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is.

1 5

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

security [ARCHIVED] April 2007