Test ID:	1.3.6.1.4.1.25623.1.0.66785
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-890-3 (python2.4)
Summary:	Ubuntu USN-890-3 (python2.4)
Description:	The remote host is missing an update to python2.4 announced via advisory USN-890-3. Details follow: USN-890-1 fixed vulnerabilities in Expat. This update provides the corresponding updates for the PyExpat module in Python 2.4. Original advisory details: Jukka Taimisto, Tero Rontti and Rauli Kaksonen discovered that Expat did not properly process malformed XML. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-2625, CVE-2009-3720) It was discovered that Expat did not properly process malformed UTF-8 sequences. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service via application crash. (CVE-2009-3560) Solution: The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: python2.4 2.4.3-0ubuntu6.4 python2.4-minimal 2.4.3-0ubuntu6.4 Ubuntu 8.04 LTS: python2.4 2.4.5-1ubuntu4.3 python2.4-minimal 2.4.5-1ubuntu4.3 Ubuntu 8.10: python2.4 2.4.5-5ubuntu1.2 python2.4-minimal 2.4.5-5ubuntu1.2 Ubuntu 9.04: python2.4 2.4.6-1ubuntu3.2.9.04.1 python2.4-minimal 2.4.6-1ubuntu3.2.9.04.1 Ubuntu 9.10: python2.4 2.4.6-1ubuntu3.2.9.10.1 python2.4-minimal 2.4.6-1ubuntu3.2.9.10.1 After a standard system upgrade you need to restart any Python 2.4 applications that use the PyExpat module to effect the necessary changes. http://www.securityspace.com/smysecure/catid.html?in=USN-890-3 Risk factor : Medium
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3560 http://mail.python.org/pipermail/expat-bugs/2009-November/002846.html http://lists.vmware.com/pipermail/security-announce/2010/000082.html Debian Security Information: DSA-1953 (Google Search) http://www.debian.org/security/2009/dsa-1953 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00370.html https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00394.html https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00413.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:316 http://www.redhat.com/support/errata/RHSA-2011-0896.html http://slackware.com/security/viewer.php?l=slackware-security&y=2011&m=slackware-security.486026 http://sunsolve.sun.com/search/document.do?assetkey=1-66-273630-1 SuSE Security Announcement: SUSE-SR:2010:001 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html SuSE Security Announcement: SUSE-SR:2010:011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html SuSE Security Announcement: SUSE-SR:2010:012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html SuSE Security Announcement: SUSE-SR:2010:013 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html SuSE Security Announcement: SUSE-SR:2010:014 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://www.ubuntu.com/usn/USN-890-1 http://www.ubuntu.com/usn/USN-890-6 BugTraq ID: 37203 http://www.securityfocus.com/bid/37203 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10613 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:6883 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12942 http://www.securitytracker.com/id?1023278 http://secunia.com/advisories/37537 http://secunia.com/advisories/38231 http://secunia.com/advisories/38794 http://secunia.com/advisories/38832 http://secunia.com/advisories/38834 http://secunia.com/advisories/39478 http://secunia.com/advisories/41701 http://secunia.com/advisories/43300 http://www.vupen.com/english/advisories/2010/0528 http://www.vupen.com/english/advisories/2010/0896 http://www.vupen.com/english/advisories/2010/1107 http://www.vupen.com/english/advisories/2011/0359 Common Vulnerability Exposure (CVE) ID: CVE-2009-3720 http://mail.python.org/pipermail/expat-bugs/2009-January/002781.html http://www.openwall.com/lists/oss-security/2009/08/21/2 http://www.openwall.com/lists/oss-security/2009/08/26/4 http://www.openwall.com/lists/oss-security/2009/08/26/3 http://www.openwall.com/lists/oss-security/2009/08/27/6 http://www.openwall.com/lists/oss-security/2009/09/06/1 http://www.openwall.com/lists/oss-security/2009/10/23/2 http://www.openwall.com/lists/oss-security/2009/10/22/9 http://www.openwall.com/lists/oss-security/2009/10/22/5 http://www.openwall.com/lists/oss-security/2009/10/23/6 http://www.openwall.com/lists/oss-security/2009/10/26/3 http://www.openwall.com/lists/oss-security/2009/10/28/3 http://sourceforge.net/tracker/index.php?func=detail&aid=1990430&group_id=10127&atid=110127 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01274.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051367.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051247.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051228.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051442.html http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051405.html http://www.mandriva.com/security/advisories?name=MDVSA-2009:211 http://www.mandriva.com/security/advisories?name=MDVSA-2009:212 http://www.mandriva.com/security/advisories?name=MDVSA-2009:215 http://www.mandriva.com/security/advisories?name=MDVSA-2009:216 http://www.mandriva.com/security/advisories?name=MDVSA-2009:217 http://www.mandriva.com/security/advisories?name=MDVSA-2009:218 http://www.mandriva.com/security/advisories?name=MDVSA-2009:220 http://www.mandriva.com/security/advisories?name=MDVSA-2009:219 http://www.redhat.com/support/errata/RHSA-2010-0002.html SuSE Security Announcement: SUSE-SR:2009:018 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11019 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:7112 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:12719 http://www.securitytracker.com/id?1023160 http://secunia.com/advisories/37324 http://secunia.com/advisories/37925 http://secunia.com/advisories/38050 http://secunia.com/advisories/42326 http://secunia.com/advisories/42338 http://www.vupen.com/english/advisories/2010/3035 http://www.vupen.com/english/advisories/2010/3053 http://www.vupen.com/english/advisories/2010/3061 Common Vulnerability Exposure (CVE) ID: CVE-2009-2625 Bugtraq: 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components (Google Search) http://www.securityfocus.com/archive/1/archive/1/507985/100/0/threaded http://www.cert.fi/en/reports/2009/vulnerability2009085.html http://www.codenomicon.com/labs/xml/ http://www.networkworld.com/columnists/2009/080509-xml-flaw.html http://lists.apple.com/archives/security-announce/2009/Sep/msg00000.html Debian Security Information: DSA-1984 (Google Search) http://www.debian.org/security/2010/dsa-1984 https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00310.html https://www.redhat.com/archives/fedora-package-announce/2009-August/msg00325.html HPdes Security Advisory: HPSBUX02476 http://marc.info/?l=bugtraq&m=125787273209737&w=2 HPdes Security Advisory: SSRT090250 http://www.mandriva.com/security/advisories?name=MDVSA-2009:209 http://www.mandriva.com/security/advisories?name=MDVSA-2011:108 RedHat Security Advisories: RHSA-2009:1199 https://rhn.redhat.com/errata/RHSA-2009-1199.html RedHat Security Advisories: RHSA-2009:1200 https://rhn.redhat.com/errata/RHSA-2009-1200.html RedHat Security Advisories: RHSA-2009:1201 https://rhn.redhat.com/errata/RHSA-2009-1201.html http://www.redhat.com/support/errata/RHSA-2009-1615.html RedHat Security Advisories: RHSA-2009:1636 https://rhn.redhat.com/errata/RHSA-2009-1636.html RedHat Security Advisories: RHSA-2009:1637 https://rhn.redhat.com/errata/RHSA-2009-1637.html RedHat Security Advisories: RHSA-2009:1649 https://rhn.redhat.com/errata/RHSA-2009-1649.html RedHat Security Advisories: RHSA-2009:1650 https://rhn.redhat.com/errata/RHSA-2009-1650.html http://www.redhat.com/support/errata/RHSA-2011-0858.html RedHat Security Advisories: RHSA-2012:1232 http://rhn.redhat.com/errata/RHSA-2012-1232.html http://sunsolve.sun.com/search/document.do?assetkey=1-66-263489-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-272209-1 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021506.1-1 SuSE Security Announcement: SUSE-SR:2009:016 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html SuSE Security Announcement: SUSE-SA:2009:053 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html SuSE Security Announcement: SUSE-SR:2009:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html Cert/CC Advisory: TA09-294A http://www.us-cert.gov/cas/techalerts/TA09-294A.html Cert/CC Advisory: TA10-012A http://www.us-cert.gov/cas/techalerts/TA10-012A.html BugTraq ID: 35958 http://www.securityfocus.com/bid/35958 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8520 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:9356 http://www.securitytracker.com/id?1022680 http://secunia.com/advisories/36162 http://secunia.com/advisories/36176 http://secunia.com/advisories/36180 http://secunia.com/advisories/36199 http://secunia.com/advisories/37300 http://secunia.com/advisories/37460 http://secunia.com/advisories/37671 http://secunia.com/advisories/37754 http://secunia.com/advisories/38342 http://secunia.com/advisories/50549 http://www.vupen.com/english/advisories/2009/2543 http://www.vupen.com/english/advisories/2009/3316
Copyright	Copyright (c) 2010 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: