==========================================================Ubuntu Security Notice USN-551-1 December 04, 2007
openldap vulnerabilities
CVE-2007-5707, CVE-2007-5708
==========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 6.10
Ubuntu 7.04
Ubuntu 7.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
slapd 2.2.26-5ubuntu2.4
Ubuntu 6.10:
slapd 2.2.26-5ubuntu3.2
Ubuntu 7.04:
slapd 2.3.30-2ubuntu0.1
Ubuntu 7.10:
slapd 2.3.35-1ubuntu0.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
Thomas Sesselmann discovered that the OpenLDAP slapd server
did not properly handle certain modify requests. A remote
attacker could send malicious modify requests to the server
and cause a denial of service. (CVE-2007-5707)
Toby Blake discovered that slapd did not properly terminate
an array while running as a proxy-caching server. A remote
attacker may be able to send crafted search requests to the
server and cause a denial of service. This issue only affects
Ubuntu 7.04 and 7.10. (CVE-2007-5708)
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu2.4.diff.gz
Size/MD5: 511262 b54753c0e681803599125b18bef714ff
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu2.4.dsc
Size/MD5: 1020 519f96ba1375478163e3c40e881ae2d7
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26.orig.tar.gz
Size/MD5: 2626629 afc8700b5738da863b30208e1d3e9de8
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.4_amd64.deb
Size/MD5: 130406 8d3bf04e5529528c0ac26530b2070f78
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.4_amd64.deb
Size/MD5: 165830 e66f9e954c0ea05b4e2611ccd9fbcce6
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.4_amd64.deb
Size/MD5: 961236 e5a89ad1cf97801efd27c52191703752
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.4_i386.deb
Size/MD5: 118302 c57c5729bc9cf5ada18ebc3bef77d8da
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.4_i386.deb
Size/MD5: 145954 caf31365b85db0e03a5f9884dda48fc7
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.4_i386.deb
Size/MD5: 872794 8e5380a50fef5a25ac83c309f9a09a7d
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.4_powerpc.deb
Size/MD5: 132560 bcef53015f0225ad7e216d94f23d1190
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.4_powerpc.deb
Size/MD5: 157010 2132bdab3beff83ae731103602cdc38d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.4_powerpc.deb
Size/MD5: 959310 629b33d57e8087fbb8f5be51203f6dee
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu2.4_sparc.deb
Size/MD5: 120616 13c31cc42532a60ceb499fc044356dc8
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu2.4_sparc.deb
Size/MD5: 148044 3bf8d5ec833a67b9660bb7a448ae0c89
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu2.4_sparc.deb
Size/MD5: 903250 43b642eccf4fdb4b2ae81d9f4e65236d
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu3.2.diff.gz
Size/MD5: 512406 0a7387e1542e833d4fcf3dd458571805
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26-5ubuntu3.2.dsc
Size/MD5: 1020 2926a0c36b89ebb9dc498005f4a8c93a
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/openldap2.2_2.2.26.orig.tar.gz
Size/MD5: 2626629 afc8700b5738da863b30208e1d3e9de8
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu3.2_amd64.deb
Size/MD5: 130568 2c0d6fd715c4049d464acc6da91db771
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu3.2_amd64.deb
Size/MD5: 166602 43b9daf9f2938ee91818e08ef88e3897
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu3.2_amd64.deb
Size/MD5: 958238 76f32588bf19a293993f59281a1b19db
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu3.2_i386.deb
Size/MD5: 121234 8ef74f1ac973fd76c383c82d5ed1fcc8
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu3.2_i386.deb
Size/MD5: 152394 20c8c28e5c8f62db165592a847728600
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu3.2_i386.deb
Size/MD5: 900626 2fd37c48cbee64886b75665f3c4b22b7
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu3.2_powerpc.deb
Size/MD5: 133566 9f8ff85e0bcc546a35174d5f8e4c32d4
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu3.2_powerpc.deb
Size/MD5: 158770 7051d8aa41997d86ad9bdd1f0cbd09fd
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu3.2_powerpc.deb
Size/MD5: 966444 a0a61d9af0fd64251f75cf6062e85834
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/ldap-utils_2.2.26-5ubuntu3.2_sparc.deb
Size/MD5: 121492 9e05e58bb98a5ddd53656fd82a23d45b
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/libldap-2.2-7_2.2.26-5ubuntu3.2_sparc.deb
Size/MD5: 149232 8f73c53ad74062f446aac3c31ef953ff
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.2/slapd_2.2.26-5ubuntu3.2_sparc.deb
Size/MD5: 909242 2a9d3a22330886f4bf727ea1d19187e0
Updated packages for Ubuntu 7.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.30-2ubuntu0.1.diff.gz
Size/MD5: 139726 79fb0171f368ca4312d48d4c695edb53
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.30-2ubuntu0.1.dsc
Size/MD5: 1295 fc1bc630868634c3937dea90fe7f9c4e
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.30.orig.tar.gz
Size/MD5: 2971126 c40bcc23fa65908b8d7a86a4a6061251
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.30-2ubuntu0.1_amd64.deb
Size/MD5: 187572 cb6072c694a417d01d3da06c94977a4e
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.30-2ubuntu0.1_amd64.deb
Size/MD5: 292212 5afbe83546e56db28b59906d7820d92d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.30-2ubuntu0.1_amd64.deb
Size/MD5: 1227928 e2e2e821b94b2940bd599ad513922d7f
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.30-2ubuntu0.1_i386.deb
Size/MD5: 155982 05d6d346c35f7e6f3e3b3f13916cc7cb
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.30-2ubuntu0.1_i386.deb
Size/MD5: 267352 c0309cfc9c84f183df478d51c040400b
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.30-2ubuntu0.1_i386.deb
Size/MD5: 1154660 fa9fd13816f4181219749a39ec891413
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.30-2ubuntu0.1_powerpc.deb
Size/MD5: 203570 ee80e1eeb0e3affccecc9974bbc3e91d
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.30-2ubuntu0.1_powerpc.deb
Size/MD5: 294320 67698b61c8e2aa0b914b02483449813c
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.30-2ubuntu0.1_powerpc.deb
Size/MD5: 1280328 a559f7311835769efd965854e324036e
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.30-2ubuntu0.1_sparc.deb
Size/MD5: 164312 51a13892bf9013a12b2f356282281421
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.30-2ubuntu0.1_sparc.deb
Size/MD5: 264178 6fccf9f07791c6cf5ed41c52cdaac2cb
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.30-2ubuntu0.1_sparc.deb
Size/MD5: 1169780 f5d2064a6f5a560151865d87d963e3db
Updated packages for Ubuntu 7.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.35-1ubuntu0.1.diff.gz
Size/MD5: 153304 035a13818eebaca172ef7fb2e1b73f83
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.35-1ubuntu0.1.dsc
Size/MD5: 1305 89bc62db8536ab8292fc3afabbce98b5
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/openldap2.3_2.3.35.orig.tar.gz
Size/MD5: 2947629 5096146b7a7eb6ce3b0a97549347b5be
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.35-1ubuntu0.1_amd64.deb
Size/MD5: 189744 dce285ce9164fe57f56d99a53935205a
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.35-1ubuntu0.1_amd64.deb
Size/MD5: 346882 1e33bf330b7551e2035ba32f576ed8c7
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.35-1ubuntu0.1_amd64.deb
Size/MD5: 1295526 f16e6d501bb115b4c5b24ac7af676043
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.35-1ubuntu0.1_i386.deb
Size/MD5: 155172 b1229c692b2b0e90842f2a3963710d44
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.35-1ubuntu0.1_i386.deb
Size/MD5: 314500 ea70a6f6d29f2458401cd0de1a99772f
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.35-1ubuntu0.1_i386.deb
Size/MD5: 1215670 083901dcaadcb356d8d743facbe76410
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.35-1ubuntu0.1_powerpc.deb
Size/MD5: 204936 8144ae85dd773e4126bfb13dda6f383f
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.35-1ubuntu0.1_powerpc.deb
Size/MD5: 345608 449f262dee94fc35f907e3da735b2ff0
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.35-1ubuntu0.1_powerpc.deb
Size/MD5: 1344728 bec28b0dfb90095961a484ec2f3cc96e
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/ldap-utils_2.3.35-1ubuntu0.1_sparc.deb
Size/MD5: 166128 e14bbb2254d7a577b3f04453b8743ac5
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/libldap-2.3-0_2.3.35-1ubuntu0.1_sparc.deb
Size/MD5: 306682 95a1008f5696a6d9cb6f9e7e521c7ab8
http://security.ubuntu.com/ubuntu/pool/main/o/openldap2.3/slapd_2.3.35-1ubuntu0.1_sparc.deb
Size/MD5: 1228072 8ffd29411e996e6a5853f29621d092d3
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla -
http://enigmail.mozdev.org
iD8DBQFHVMZ2W0JvuRdL8BoRAo44AJ4lKdQaZEkOT/rJCCH87ZHB/sPK9ACghXsW
uzbIzU1FCeG9gaq4dD0g+kQ=QjYS
-----END PGP SIGNATURE-----
From - Tue Dec 4 10:44:11 2007
X-Account-Key: account7
X-UIDL: 4648aa8300004a44
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-34809-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id 7125C5CC01B
for <lists@securityspace.com>; Tue, 4 Dec 2007 10:38:58 -0500 (EST)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
via smtpd (for mx.securityspace.com [69.28.227.216]) with ESMTP; Tue, 4 Dec 2007 07:31:42 -0800
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id C3A1614394E; Tue, 4 Dec 2007 07:34:01 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 17729 invoked from network); 4 Dec 2007 13:12:04 -0000
Subject: SEC Consult SA-20071204-0 :: SonicWALL Global VPN Client Format
String Vulnerability
From: Bernhard Mueller <research@sec-consult.com>
To: Full Disclosure <full-disclosure@lists.grok.org.uk>,
Bugtraq <bugtraq@securityfocus.com>
Content-Type: text/plain
Date: Tue, 4 Dec 2007 14:56:42 +0100
Message-ID: <1196776602.6253.11.camel@b4byl0n>
MIME-Version: 1.0
X-Mailer: Evolution 2.12.1
Content-Transfer-Encoding: 7bit
Status:
SEC Consult Security Advisory < 20071204-0 >
==================================================================================== title: SonicWALL Global VPN Client Format String
Vulnerability
program: SonicWALL Global VPN Client
vulnerable version: < 4.0.0.830
homepage: www.sonicwall.com
found: 06-12-2007
by: lofi42*
perm. link:
http://www.sec-consult.com/305.html
====================================================================================
Vendor description:
---------------
The SonicWALL Global VPN Client provides mobile users with access to
mission-critical network resources by establishing secure connections to
their office network's IPSec-compliant SonicWALL VPN gateway.
Vulnerabilty overview:
---------------
SonicWALL Global VPN Client suffers from a format string vulnerability
that can be triggered by supplying a specially crafted configuration
file. This vulnerability allows an attacker to execute arbitrary code in
the context of the vulnerable client. For a successful attack, the
attacker would have to entice his victim into importing the special
configuration file.
Vulnerability details:
---------------
Format string errors occur when the client parses the "name" attribute
of the "Connection" tag and the content of the "Hostname" Tags in the
configuration file.
Examples:
<Connection name=%s%s%s%s>
<HostName>%s%s%s%s</HostName>
The bugs has been verified in version 3.1.556 and beta 4.0.0.810. With
version 3.1.556 the client has to initiate a connection to trigger the
vulnerability, whereas with version 4.0.0.810, the bug can be exploited
by simply double-clicking the configuration file. This can be attributed
to the 4.0 version trying to write the imported configuration to an
extra debug log.
Proof-of-concept:
---------------
In 4.0.0.810, the bug can be beautifully demonstrated by supplying a
crafted config file and then viewing the debug logfile. A configuration
like this...
<Connection name=> AAAAAAAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x
<HostName> BBBBBBBBBB%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x.%x.%x.%x.%x.%x
...yields the following logfile:
----------------------< Connection name
>-----------------------------------
OnLogMessage(): 'The connection "AAAAAAAAAAe64d20.37327830.46413139.
203a3833.782b8d00.6f4c6e4f.73654d67.65676173.203a2928.65685427.
6e6f6320.7463656e.206e6f69.41414122.41414141.25414141" has been
enabled.' ''
----------------------</Connection name
>-----------------------------------
----------------------<HostName>--------------------------------------------
BBBBBBBBBB656d616e.41414120.41414141.25414141.78252e78.2e78252e.252e7825.
78252e78.2e78252e.252e7825.78252e78.2e78252e.252e7825.78252e78.2e78252e.
74207825.6e61206f.20504920.72646461.2e737365.42272027.42424242.42424242'
----------------------</HostName>---------------------------------------
This vulnerability allows reading / writing to arbitrary memory
addresses within the process memory space. Exploitation is trivial under
these circumstances.
vendor status:
---------------
vendor notified: 2007-08-16
vendor response: 2007-08-29
patch available: 2007-11-26
The issue has been fixed in SonicWall VPN client 4.0.0.830.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
* The vulnerabilities described above have been purchased by
SEC Consult from an independent security researcher.
In the research bonus programme, SEC Consult is looking for security
vulnerabilities in common software products. For more information,
contact research [at] sec-consult [dot] com
From - Tue Dec 4 10:54:12 2007
X-Account-Key: account7
X-UIDL: 4648aa8300004a45
X-Mozilla-Status: 0000
X-Mozilla-Status2: 00000000
Return-Path: <bugtraq-return-34808-lists=securityspace.com@securityfocus.com>
X-Original-To: lists@securityspace.com
Delivered-To: lists@securityspace.com
Received: from outgoing.securityfocus.com (outgoing.securityfocus.com [205.206.231.26])
by mx.securityspace.com (Postfix) with ESMTP id B0EEB5CC01B
for <lists@securityspace.com>; Tue, 4 Dec 2007 10:53:03 -0500 (EST)
Received: from outgoing.securityfocus.com by outgoing.securityfocus.com
via smtpd (for mx.securityspace.com [69.28.227.216]) with ESMTP; Tue, 4 Dec 2007 07:49:16 -0800
Received: from lists2.securityfocus.com (lists2.securityfocus.com [205.206.231.20])
by outgoing2.securityfocus.com (Postfix) with QMQP
id 9FDD414398A; Tue, 4 Dec 2007 07:30:28 -0700 (MST)
Mailing-List: contact bugtraq-help@securityfocus.com; run by ezmlm
Precedence: bulk
List-Id: <bugtraq.list-id.securityfocus.com>
List-Post: <mailto:bugtraq@securityfocus.com>
List-Help: <mailto:bugtraq-help@securityfocus.com>
List-Unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
List-Subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
Delivered-To: mailing list bugtraq@securityfocus.com
Delivered-To: moderator for bugtraq@securityfocus.com
Received: (qmail 8606 invoked from network); 4 Dec 2007 03:01:14 -0000
Date: Mon, 3 Dec 2007 19:45:53 -0800
From: Kees Cook <kees@ubuntu.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
Subject: [USN-549-2] PHP regression
Message-ID: <20071204034553.GQ8789@outflux.net>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="+d/sD+4Memv8CeGA"
Content-Disposition: inline
Organization: Ubuntu
X-MIMEDefang-Filter: outflux$Revision: 1.301 $
X-HELO: gorgon.outflux.net
X-Scanned-By: MIMEDefang 2.57 on 10.2.0.1
Status:
--+d/sD+4Memv8CeGA
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
===========================================================
Ubuntu Security Notice USN-549-2 December 03, 2007
php5 regression
https://launchpad.net/bugs/173043
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 7.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 7.10:
libapache2-mod-php5 5.2.3-1ubuntu6.2
php5-cgi 5.2.3-1ubuntu6.2
php5-cli 5.2.3-1ubuntu6.2
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
USN-549-1 fixed vulnerabilities in PHP. However, some upstream changes
were incomplete, which caused crashes in certain situations with Ubuntu
7.10. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the wordwrap function did not correctly
check lengths. Remote attackers could exploit this to cause
a crash or monopolize CPU resources, resulting in a denial of
service. (CVE-2007-3998)
Integer overflows were discovered in the strspn and strcspn functions.
Attackers could exploit this to read arbitrary areas of memory, possibly
gaining access to sensitive information. (CVE-2007-4657)
Stanislav Malyshev discovered that money_format function did not correctly
handle certain tokens. If a PHP application were tricked into processing
a bad format string, a remote attacker could execute arbitrary code with
application privileges. (CVE-2007-4658)
It was discovered that the php_openssl_make_REQ function did not
correctly check buffer lengths. A remote attacker could send a
specially crafted message and execute arbitrary code with application
privileges. (CVE-2007-4662)
It was discovered that certain characters in session cookies were not
handled correctly. A remote attacker could injection values which could
lead to altered application behavior, potentially gaining additional
privileges. (CVE-2007-3799)
Gerhard Wagner discovered that the chunk_split function did not
correctly handle long strings. A remote attacker could exploit this
to execute arbitrary code with application privileges. (CVE-2007-2872,
CVE-2007-4660, CVE-2007-4661)
Stefan Esser discovered that deeply nested arrays could be made to
fill stack space. A remote attacker could exploit this to cause a
crash or monopolize CPU resources, resulting in a denial of service.
(CVE-2007-1285, CVE-2007-4670)
Rasmus Lerdorf discovered that the htmlentities and htmlspecialchars
functions did not correctly stop when handling partial multibyte
sequences. A remote attacker could exploit this to read certain areas of
memory, possibly gaining access to sensitive information. (CVE-2007-5898)
It was discovered that the output_add_rewrite_var fucntion would
sometimes leak session id information to forms targeting remote URLs.
Malicious remote sites could use this information to gain access to a
PHP application user's login credentials. (CVE-2007-5899)
Updated packages for Ubuntu 7.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.2.diff.gz
Size/MD5: 126545 02fbb9e80b615dc9a718d60c9367538a
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.2.dsc
Size/MD5: 1921 d8aec3af9962e69e67bc7ae6bfa31537
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3.orig.tar.gz
Size/MD5: 9341653 df79b04d63fc4c1ccb6d8ea58a9cf3ac
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php-pear_5.2.3-1ubuntu6.2_all.deb
Size/MD5: 351400 62ead0de4a2ea48ca87be08b0448f5ab
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5_5.2.3-1ubuntu6.2_all.deb
Size/MD5: 1082 77c1c2ec676628707caf5588962f0f45
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 2669448 95ae60da41ef7b4594f86ff5264a13d4
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 5190794 1758c00b1b859342f5c3e73e5e867bbd
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 2617924 b4bda6f34586d6c8887cb2c10079ea76
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 222450 67e1f5d10721cad22936f0068211a3c7
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 24778 811ec34d4ea460b00fac5bdb16e9b8f5
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 355046 dfb88072d5b404ee353f4af63ae9ebb2
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 37826 6c17e662bb7a6b2c525a705d91fa65d5
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 19948 753ec86c6795479bc0891ca9c0670b91
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 5516 66519e995a609455868d5ad23e927221
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 73880 afcde53c84b70c2f9882d6c319f0ca6c
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 37356 ee6186620f7ee27b153c5104db3fa541
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 55904 99be8556d41e3561a25e24c281d0a11b
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 9642 c3295facb9fa364802abb6857f46f63d
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 4996 455b57531d167ecc89555e6e1f5605de
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 12352 fdca6404e8a8621fa702f1866e46751a
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 39482 55d7eb36b22298c3cae3305ea6e210f4
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 19824 8d13dfe918c0cea9d41fae314e22452d
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 17880 9ab41423658fbff93ae9c9012400d8ac
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 40808 eb5b2070dab4107f00e8e7475eab2b14
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.2_amd64.deb
Size/MD5: 13368 8dc3c21c551572a5187341fe7f9368a4
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 2542558 0fa871af840de95357d417e81b1bde12
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 5024704 4d076101de583289f74b472f66a3d321
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 2530522 a45f9fae50da18f4455a55c166b73f0a
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 218722 5c3bc75d5873441488fd0c8f65c2b53f
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 23598 a04e61affc316a84891bad58ee0eddbd
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 355044 94e2c641392ac5ae29e237c5132382f7
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 33490 0afcb138e970ca9d10dc1d754470494e
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 17970 b0258ea33e7642deb82aaead60a0e978
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 5194 49596e1453c3131e06af3e045a623977
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 65216 80135f11d58a1c872d4d60989baedf48
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 34432 29f2821eafc5fbf46a6e8ca4feec1970
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 51304 e66d6510daaaa6b4a6d4b64a5f7a0a60
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 8700 a594aa7f95afa110e83e529b97aa2f40
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 4774 5a766568c97f65f2be95c60f4a57bda9
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 11562 a663a6acf219a33af357f78c70c6b89d
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 34496 ab97a8b5c2b87c89517c6372907e4223
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 18134 9b97f35dd2cf631b8d4d407b802e09ba
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 16348 061fc0d3060ab441b7319608d7968ac6
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 37722 9d9eba9fd632f8d473ed095e17ad6d57
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.2_i386.deb
Size/MD5: 12402 355d6a8d187b53704d169ac2527b51a3
powerpc architecture (Apple Macintosh G3/G4/G5):
http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 2742574 b90d20abf4b71b58d67902f0904e3f54
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 5270574 67c8541045c90489d495ce234f6e1ffb
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 2654246 f27259c7b3841e50bf3c86dc782b20f0
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 225816 31458de4e7c9177f0138973fc0d5b25b
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 28060 86f7e5fad55a12472c985c32f743f015
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 355080 fecb9665cbde35a8518b600cdf205fb4
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 39110 adc0322de702ada2e0b80e490e417685
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 21724 edc5f9999abac743ecc66592cecf3767
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 7640 6377891afce3ee5b592c32cc95b42f95
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 78026 47fd399637c816e4a4206f76cd9d8afc
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 40974 641321c2fb3f5b8de7d772f3eeba46bc
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 59574 58b072639918acd35515d8eceb76971d
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 11248 4e667071c4471a24ecae795485aa3655
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 7172 1d98c91eafdf94442f8e4efddcbc0946
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 14118 6fc7790c62b8a7ae231a974271ce40f5
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 42674 53a718dcd9cebd06054ca7bcba4b31c6
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 21860 b210d78bfc0a04fa53f45b901ad3158e
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 20138 a5b73e99fe5320576a0ade3b9aca0cd4
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 43136 29eb3af8e346b10ae0c150406e16b996
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.2_powerpc.deb
Size/MD5: 15466 e1e046bc8e77d9237038abce92763c74
sparc architecture (Sun SPARC/UltraSPARC):
http://security.ubuntu.com/ubuntu/pool/main/p/php5/libapache2-mod-php5_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 2576838 4eb1b61129d7191fa5f9a8186a3eb545
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cgi_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 5020902 a74c4167bd3c9072b62c8e8d4ac40eb9
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-cli_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 2529358 790f9b28adf0a84e1f5fe8421fb9c5c6
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-common_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 218684 d3becd4261e09cdecbcdb17a2c28df2d
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-curl_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 24486 c0eb7ca78a301b561175403f8a72f1a5
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-dev_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 355090 4aba6b1a9c1cbe55e43ba0cd2e281740
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-gd_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 34328 d002fe95e04fa7d471a401d29d18521f
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-ldap_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 17966 74f9b87291910eccdd06138619c27dc8
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mhash_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 5070 cf33fa098810fe83e872c6156933b410
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-mysql_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 64752 c92758c6d14df97dfcb57d7aa2d6c243
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-odbc_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 32858 23ff82df0be4350ae39a0602e41bfe3e
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pgsql_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 50136 10970c45c6d1f679d478c781881d4adb
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-pspell_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 8620 899ac45be91a8ffa5630c99bf91fe059
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-recode_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 4754 101ac244742ef3c43d95ab1ccd5a0262
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-snmp_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 11428 d8d1fb1c1a8e1b0f60fafc06a0e2ab07
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sqlite_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 33264 b5fe644c2419e3336f23ba47301174cb
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-sybase_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 17918 895e4b8d78babe51b656e5c3536542b0
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-tidy_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 16494 18f96996d94c777cf35150ebb7799653
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xmlrpc_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 36576 fe16a39635b929178778d1df340e8250
http://security.ubuntu.com/ubuntu/pool/main/p/php5/php5-xsl_5.2.3-1ubuntu6.2_sparc.deb
Size/MD5: 11958 98ceda91197ea9d786f66f43d2fd4c4f
