[Bug 198108] New: CVE-NOID: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.




https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108

           Summary: CVE-NOID: Multiple stack/heap overflow vulnerabilities
                    in adplug
           Product: Fedora Extras
           Version: fc5
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: normal
         Component: adplug
        AssignedTo: triad(a)df.lth.se
        ReportedBy: ville.skytta(a)iki.fi
         QAContact: extras-qa(a)fedoraproject.org
                CC: extras-qa(a)fedoraproject.org,fedora-security-
                    list(a)redhat.com


Adplug <= 2.0 and CVS <= 2006-07-04 is reportedly affected by various heap and
stack overflow vulnerabilities.  No CVE id Yet.

http://seclists.org/lists/bugtraq/2006/Jul/0071.html

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 198108] CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in
adplug


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108


ville.skytta(a)iki.fi changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|CVE-NOID: Multiple          |CVE-2006-3581, CVE-2006-
                   |stack/heap overflow         |3582: Multiple stack/heap
                   |vulnerabilities in adplug   |overflow vulnerabilities in
                   |                            |adplug




------- Additional Comments From ville.skytta(a)iki.fi  2006-07-14 15:04 EST -------
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3581
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-3582

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 198108] CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in
adplug


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108


triad(a)df.lth.se changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |CLOSED
         Resolution|                            |NEXTRELEASE




------- Additional Comments From triad(a)df.lth.se  2006-07-25 16:35 EST -------
Solved by upgrading to the new upstream version.
Thanks for bringing this to attention, Ville!
I hope not too many systems were compromised by
rouge AdLib songs ;-)

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 198108] CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in
adplug


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108





------- Additional Comments From ville.skytta(a)iki.fi  2006-07-26 16:47 EST -------
Thanks for the fix, but please be careful with shared library sonames in the
future.  Packages built against the old one and depending on it are likely to
prevent the new fixed library package from being installed.

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 198108] CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in
adplug


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108





------- Additional Comments From triad(a)df.lth.se  2006-07-26 17:02 EST -------
Yeah, sorry I know, in this case I happened to maintain all affected packages
so just rebuilt them.

However, a first timer the question arise: how do I properly retire an .so file
with security vulnerabilities? (Cannot find a good idea in any guidelines.)

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug 198108] CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in adplug

[Red Hat Bugzilla]

Please do not reply directly to this email. All additional
comments should be made in the comments box of this bug report.

Summary: CVE-2006-3581, CVE-2006-3582: Multiple stack/heap overflow vulnerabilities in
adplug


https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=198108





------- Additional Comments From ville.skytta(a)iki.fi  2006-07-28 12:17 EST -------
(In reply to comment #4)
>  Yeah, sorry I know, in this case I happened to maintain all affected
> packages 
Yes, but only in FE.  3rd party repositories and local packages which use the
libs are affected too.

>  However, a first timer the question arise: how do I properly retire
> an .so
>  file with security vulnerabilities? (Cannot find a good idea in any 
>  guidelines.) 
If doable and feasible, backporting only the security fixes and avoiding the
soname change would be one way of handling it smoothly.

An incompatible upgrade policy and instructions are slowly in the works, but so
far there is no consensus except that the very least one should do is to send a
mail to fedora-maintainers, notifying about the issue, beforehand if at all
possible so others (including non-FC/FE packagers) can prepare.

Here's one example which IMO is being handled well.
https://www.redhat.com/archives/fedora-maintainers/2006-July/msg00397.html
https://www.redhat.com/archives/fedora-maintainers/2006-July/msg00398.html

-- 
Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.