SuSE: 'hylafax' Format string vulnerability
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: hylafax
Announcement-ID: SuSE-SA:2002:035
Date: Friday, Oct 4th 2002 10:30 MEST
Affected products: 7.0, 7.1, 7.2, 7.3, 8.0
SuSE Linux Connectivity Server
SuSE Linux Enterprise Server
SuSE Linux Office Server
Vulnerability Type: remote privilege escalation
Severity (1-10): 4
SuSE default package: no
Cross References: CAN-2002-1050
Content of this advisory:
1) security vulnerability resolved:
- format string bug in logging
code for TSI
- buffer overflow in faxgetty
while handling image data
2) pending vulnerabilities, solutions, workarounds:
- glibc
- ghostview/kghostview
- fetchmail
- kdelibs
- ethereal
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
HylaFAX is a client-server architecture for receiving and sending
facsimiles.
The logging function of faxgetty prior version 4.1.3 was vulnerable to
a format string bug when handling the TSI value of a received facsimile.
This bug could easily be used to trigger a denial-of-service attack or
to execute arbitrary code remotely.
Another bug in faxgetty, a buffer overflow, can be abused by a remote
attacker by sending a large line of image data to execute arbitrary
commands too.
Several format string bugs in local helper applications were fixed too.
These bugs can not be exploited to gain higher privileges on a system
running SuSE Linux because of the absence of setuid bits.
The hylafax package is not installed by default.
A temporary fix is not known.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
i386 Intel Platform:
SuSE-8.0
3115ebdb9e65027f35809463c5e6ae7e
SuSE-8.0
07b0f2d015b0fd83c5bb9be548e7b8fb
source rpm:
8231586e2de356c737ef3d6f9d17c0ea
SuSE-7.3
de51bda21cc9ee1a4dd3cd06ccccf71e
source rpm:
aac2ecddf06934f286960f52f2e7670e
SuSE-7.2
275c73b0b192da9c883cfebf6638604e
source rpm:
b8698144b8bb859d880659fcf01eb020
SuSE-7.1
c322bc9007191e3692341b5702b29200
source rpm:
4d76cd426565e411941b4aaebf6ad761
SuSE-7.0
fa7399ce161a44dbad630928cd6b3b84
source rpm:
0ac9d8b33b75f29b55a5750f17a65b93
Sparc Platform:
SuSE-7.3
1cabb4113f858df010d305fa576c5a02
source rpm:
a5ddaee97231c423e04fb71b757532a3
SuSE-7.1
1449e568071f5fb6080efebb8f2a7a2b
source rpm:
bf8c780206da51bc548e9fd4264b9bfc
SuSE-7.0
bb265465ea8b84ca31b5c954266daf1d
source rpm:
b5bcae601fe056f399fc8696aa156529
AXP Alpha Platform:
SuSE-7.1
45d0fd7061f10e4bef9e57c42a9b160d
source rpm:
baf364ec3636077fe8f810edeb111572
SuSE-7.0
856e96ce4a165b74e70ebc9ef3201672
source rpm:
f68e2260aa36d4d218a3f3589333ea0e
PPC Power PC Platform:
SuSE-7.3
79846b9ae0f75f8ed9b17fed07ba6263
source rpm:
98a123cf18cb6b34ffd9018a76ad161f
SuSE-7.1
2bfe866f1bd1d93307449de95d84d6c2
source rpm:
972c605bd3a9cc15bbbc5aa188dfc864
SuSE-7.0
00b1ae1c91235ecceb287ffe7aced175
source rpm:
e905325a032854fb653cf458e0db8942
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- glibc
Client applications which use res_search/res_nsreach and/or res_query()/
res_nquery() of libresolv could trigger a DNS decoding error, a SEGV or
leak information by reading beyond the end of a too small 'answer'
buffer.
The update packages are being built and tested. We will publish a security
announcement as soon as they are ready.
- ghostview/kghostview
Bufferoverflows have recently been discovered in these packages. They
allow attackers to execute arbitrary code with the privileges of the
user viewing special crafted documents created by the attacker. New
packgaes will soon be available on our ftp servers.
- fetchmail
Fetchmail contains remotely exploitable overflows in the mail header
parsing functions. In depth discussion of these problems can be found
at .
New packages will soon be available on our ftp servers.
- kdelibs
KDE's SSL implementation fails to check the trust chain in SSL
certificates. This bug allows faking valid SSL certificates.
New KDE packages will be available soon to fix this and other bugs.
- ethereal
Several potential security issues have been discovered in ethereal
0.9.4. After this package is tested succesfuly it will be relased.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
