4 Security Updates for Gentoo
Posted on: 09/07/2010 08:20 PM
4 new security updates are available for Gentoo Linux
- [ GLSA 201009-03 ] sudo: Privilege Escalation
- [ GLSA 201009-06 ] Clam AntiVirus: Multiple vulnerabilities
- [ GLSA 201009-05 ] Adobe Reader: Multiple vulnerabilities
- [ GLSA 201009-04 ] SARG: User-assisted execution of arbitrary code
[gentoo-announce] [ GLSA 201009-03 ] sudo: Privilege Escalation- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: sudo: Privilege Escalation
Date: September 07, 2010
Bugs: #322517, #335381
ID: 201009-03
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
The secure path feature and group handling in sudo allow local
attackers to escalate privileges.
Background
==========
sudo allows a system administrator to give users the ability to run
commands as other users.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-admin/sudo < 1.7.4_p3-r1 >= 1.7.4_p3-r1
Description
===========
Multiple vulnerabilities have been reported in sudo:
* Evan Broder and Anders Kaseorg of Ksplice, Inc. reported that the
sudo 'secure path' feature does not properly handle multiple PATH
variables (CVE-2010-1646).
* Markus Wuethrich of Swiss Post reported that sudo fails to restrict
access when using Runas groups and the group (-g) command line option
(CVE-2010-2956).
Impact
======
A local attacker could exploit these vulnerabilities to gain the
ability to run certain commands with the privileges of other users,
including root, depending on the configuration.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All sudo users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/sudo-1.7.4_p3-r1"
References
==========
[ 1 ] CVE-2010-1646
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1646 [ 2 ] CVE-2010-2956
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2956Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-03.xmlConcerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Clam AntiVirus: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #314087, #321157
ID: 201009-06
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been reported in Clam AntiVirus.
Background
==========
Clam AntiVirus (short: ClamAV) is an anti-virus toolkit for UNIX,
designed especially for e-mail scanning on mail gateways.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-antivirus/clamav < 0.96.1 >= 0.96.1
Description
===========
Multiple vulnerabilities were discovered in Clam AntiVirus. For further
information, please consult the CVE entries referenced below.
Impact
======
A remote attacker could possibly bypass virus detection or cause a
Denial of Service.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Clam AntiVirus users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-antivirus/clamav-0.96.1"
References
==========
[ 1 ] CVE-2010-0098
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0098 [ 2 ] CVE-2010-1311
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1311 [ 3 ] CVE-2010-1639
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1639 [ 4 ] CVE-2010-1640
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1640Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-06.xmlConcerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: Adobe Reader: Multiple vulnerabilities
Date: September 07, 2010
Bugs: #297385, #306429, #313343, #322857
ID: 201009-05
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities in Adobe Reader might result in the execution
of arbitrary code or other attacks.
Background
==========
Adobe Reader (formerly Adobe Acrobat Reader) is a closed-source PDF
reader.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-text/acroread < 9.3.4 >= 9.3.4
Description
===========
Multiple vulnerabilities were discovered in Adobe Reader. For further
information please consult the CVE entries and the Adobe Security
Bulletins referenced below.
Impact
======
A remote attacker might entice a user to open a specially crafted PDF
file, possibly resulting in the execution of arbitrary code with the
privileges of the user running the application, or bypass intended
sandbox restrictions, make cross-domain requests, inject arbitrary web
script or HTML, or cause a Denial of Service condition.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All Adobe Reader users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/acroread-9.3.4"
References
==========
[ 1 ] APSA10-01
http://www.adobe.com/support/security/advisories/apsa10-01.html [ 2 ] APSB10-02
http://www.adobe.com/support/security/bulletins/apsb10-02.html [ 3 ] APSB10-07
http://www.adobe.com/support/security/bulletins/apsb10-07.html [ 4 ] APSB10-09
http://www.adobe.com/support/security/bulletins/apsb10-09.html [ 5 ] APSB10-14
http://www.adobe.com/support/security/bulletins/apsb10-14.html [ 6 ] APSB10-16
http://www.adobe.com/support/security/bulletins/apsb10-16.html [ 7 ] CVE-2009-3953
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3953 [ 8 ] CVE-2009-4324
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4324 [ 9 ] CVE-2010-0186
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0186 [ 10 ] CVE-2010-0188
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0188 [ 11 ] CVE-2010-0190
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0190 [ 12 ] CVE-2010-0191
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0191 [ 13 ] CVE-2010-0192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0192 [ 14 ] CVE-2010-0193
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0193 [ 15 ] CVE-2010-0194
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0194 [ 16 ] CVE-2010-0195
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0195 [ 17 ] CVE-2010-0196
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0196 [ 18 ] CVE-2010-0197
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0197 [ 19 ] CVE-2010-0198
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0198 [ 20 ] CVE-2010-0199
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0199 [ 21 ] CVE-2010-0201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0201 [ 22 ] CVE-2010-0202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0202 [ 23 ] CVE-2010-0203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0203 [ 24 ] CVE-2010-0204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0204 [ 25 ] CVE-2010-1241
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1241 [ 26 ] CVE-2010-1285
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1285 [ 27 ] CVE-2010-1295
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1295 [ 28 ] CVE-2010-1297
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1297 [ 29 ] CVE-2010-2168
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2168 [ 30 ] CVE-2010-2201
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2201 [ 31 ] CVE-2010-2202
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2202 [ 32 ] CVE-2010-2203
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2203 [ 33 ] CVE-2010-2204
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2204 [ 34 ] CVE-2010-2205
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2205 [ 35 ] CVE-2010-2206
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2206 [ 36 ] CVE-2010-2207
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2207 [ 37 ] CVE-2010-2208
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2208 [ 38 ] CVE-2010-2209
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2209 [ 39 ] CVE-2010-2210
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2210 [ 40 ] CVE-2010-2211
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2211 [ 41 ] CVE-2010-2212
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2212Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-05.xmlConcerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: SARG: User-assisted execution of arbitrary code
Date: September 07, 2010
Bugs: #222121
ID: 201009-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple stack-based buffer overflow vulnerabilities were discovered in
SARG allowing for remote code execution.
Background
==========
SARG is the Squid Analysis Report Generator.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-analyzer/sarg < 2.2.5-r5 >= 2.2.5-r5
Description
===========
Multiple vulnerabilities were discovered in SARG. For further
information please consult the CVE entries referenced below.
Impact
======
These vulnerabilities might allow attackers to execute arbitrary code
via unknown vectors.
NOTE: This is a legacy GLSA. Updates for all affected architectures are
available since April 18, 2009. It is likely that your system is
already no longer affected by this issue.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All SARG users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/sarg-2.2.5-r5"
References
==========
[ 1 ] CVE-2008-1922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1922Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-201009-04.xmlConcerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.License
=======
Copyright 2010 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5