===================================================================== CERT-Renater Note d'Information No. 2004/VULN489 _____________________________________________________________________ DATE : 17/11/2004 HARDWARE PLATFORM(S) : / OPERATING SYSTEM(S) : Systems using XPM library. ====================================================================== ______________________________________________________________________________ SUSE Security Announcement Package: xshared, XFree86-libs, xorg-x11-libs Announcement-ID: SUSE-SA:2004:041 Date: Wednesday, Nov 17th 2004 15:00 MET Affected products: 8.1, 8.2, 9.0, 9.1, 9.2 SUSE Linux Desktop 1.0 SUSE Linux Enterprise Server 8, 9 Novell Linux Desktop 1.0 Vulnerability Type: remote system compromise Severity (1-10): 8 SUSE default package: yes Cross References: none Content of this advisory: 1) security vulnerability resolved: - several integer overflows - out-of-bounds memory access - shell command execution - path traversal - endless loops - memory leaks problem description 2) solution/workaround 3) special instructions and notes 4) package location and checksums 5) pending vulnerabilities, solutions, workarounds: - ImageMagick - clamav - perl-MIME-Tools, perl-Archive-ZIP - apache / mod_include - apache2 / mod_SSL 6) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion The XPM library which is part of the XFree86/XOrg project is used by several GUI applications to process XPM image files. A source code review done by Thomas Biege of the SuSE Security-Team revealed several different kinds of bugs. The bug types are: - integer overflows - out-of-bounds memory access - shell command execution - path traversal - endless loops By providing a special image these bugs can be exploited by remote and/or local attackers to gain access to the system or to escalate their local privileges. 2) solution/workaround No workaround exists to protect against these bugs. 3) special instructions and notes Please restart the X server or switch to runlevel 3 and back to 5 to make sure every GUI application is restarted and uses the new library. 4) package location and checksums Download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. Our maintenance customers are being notified individually. The packages are being offered for installation from the maintenance web. Smalltalk is the only package using libxpm statically. It will be available via YOU too. x86 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/xorg-x11-libs-6.8.1-15.3.i586.rpm 395edf444f05b448aa7c7e70455333ce patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/xorg-x11-libs-6.8.1-15.3.i586.patch.rpm 8d215ce255838120c70ba77ad944a84f source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/xorg-x11-6.8.1-15.3.src.rpm 3889aee5895035c57c716f370f5e414a SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.902-43.35.3.i586.rpm 89431783cd8261a970d6ec5484dd09e6 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/XFree86-libs-4.3.99.902-43.35.3.i586.patch.rpm 8ea579d10465143a2334be812f23561e source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/XFree86-4.3.99.902-43.35.3.src.rpm a37eaa7e7b99c5c3e61439f2a4b00b2d SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-57.i586.rpm a12b2e861f114868fd70997f72536c8b patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/XFree86-libs-4.3.0.1-57.i586.patch.rpm c6ea49a796b316aa68dacc51ffd8eb8d source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/XFree86-4.3.0.1-57.src.rpm f53026511a470b875b0f9a63c52128d3 SUSE Linux 8.2: ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-132.i586.rpm b918f14df14961cf89528a930f49d7c4 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/i586/XFree86-libs-4.3.0-132.i586.patch.rpm 9c9c268bb248f1bcf2ef899ced2d5aa4 source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.2/rpm/src/XFree86-4.3.0-132.src.rpm 9a7846ddf22d58f9f64704b3a2451640 SUSE Linux 8.1: ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/xshared-4.2.0-269.i586.rpm d4549acb039d8bf317bc6052598764c9 patch rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/xshared-4.2.0-269.i586.patch.rpm fcfc17915fdddb48ea84e4d528752edc source rpm(s): ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/src/xf86-4.2.0-269.src.rpm 3e1d6cf799d0a8e10e2597458264812e x86-64 Platform: SUSE Linux 9.2: ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/xorg-x11-libs-32bit-9.2-200411100529.x86_64.rpm e1a271567b2c784aedf3b10f60bbf8a1 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/x86_64/xorg-x11-libs-32bit-9.2-200411100529.x86_64.patch.rpm fe95d10e1287ebbe56ba8d7a07954431 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.2/rpm/src/baselibs-32bit-9.2-200411100529.src.rpm da697a970a5672a96016fff405f72692 SUSE Linux 9.1: ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.99.902-43.35.3.x86_64.rpm 37b2d73337bd0d70dcc092c0e15a0911 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/XFree86-libs-4.3.99.902-43.35.3.x86_64.patch.rpm d72e54995bd6468cf1ea78da81546a69 source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/XFree86-4.3.99.902-43.35.3.src.rpm 0158b2653157f518f8dcf030927c2107 SUSE Linux 9.0: ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0.1-57.x86_64.rpm 06a4fd1bd6eeb43fd82e18b9a255ff78 patch rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/XFree86-libs-4.3.0.1-57.x86_64.patch.rpm da96d1c51020a7de70195458b197fa3b source rpm(s): ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/XFree86-4.3.0.1-57.src.rpm f369153e40af338af2fd67957db09cff ______________________________________________________________________________ 5) Pending vulnerabilities in SUSE Distributions and Workarounds: - ImageMagick This update fixes an additional problem in the EXIF handling of ImageMagick, which could lead to a buffer overflow. This could enable remote attackers feeding handcrafted images to execute code as the user handling the image. New packages are available. - clamav The clamav version shipped with SUSE Linux is too old for the new data files. The version has been upgraded to 0.80. - perl-Mime-Tools / perl-Archive-ZIP Problems in the perl-MIME-Tools and perl-Archive-ZIP packages have been found which could allow virii to pass virus scanners using those packages (like for instance clamav). Fixed packages are in testing and will be released soon. - Apache 1.3 / mod_include A potential buffer overflow and a argument sanitization problem were found in the mod_include Apache 1.3 module. These issues are tracked as CAN-2004-0940 and CAN-2004-0492 by Mitre CVE. Fixed packages are in testing and will be released soon. - Apache 2 / mod_SSL SSL Ciphersuite bypass problems were identified and fixed by the Apache team in Apache 2. This is tracked under the Mitre CVE ID CAN-2004-0885. Fixed packages are in testing and will be released soon. ______________________________________________________________________________ 6) standard appendix: authenticity verification, additional information - Package authenticity verification: SUSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SUSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key security@suse.de), the checksums show proof of the authenticity of the package. We recommend against subscribing to security lists that cause the e-mail message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use the command rpm -v --checksig to verify the signature of the package, where is the file name of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SUSE in rpm packages for SUSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SUSE Linux distributions version 7.1 and thereafter install the key "build@suse.de" upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de . - SUSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an email to . suse-security-announce@suse.com - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. ===================================================================== SUSE's security contact is or . The public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the clear-text signature shows proof of the authenticity of the text. SUSE Linux AG makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key ====================================================================== ========================================================= Les serveurs de référence du CERT-Renater http://www.urec.fr/securite http://www.cru.fr/securite http://www.renater.fr ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 151 bd de l'Hopital | fax : 01-53-94-20-41 + + 75013 Paris | email: certsvp@renater.fr + =========================================================