Python-Django/Tor/Radvd Security Updates for Debian

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2332-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
October 29, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : python-django
Vulnerability : several issues
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-4136 CVE-2011-4137 CVE-2011-4138 CVE-2011-4139
CVE-2011-4140
Debian Bug : 641405

Paul McMillan, Mozilla and the Django core team discovered several
vulnerabilities in Django, a Python web framework:

CVE-2011-4136

When using memory-based sessions and caching, Django sessions are
stored directly in the root namespace of the cache. When user data is
stored in the same cache, a remote user may take over a session.

CVE-2011-4137, CVE-2011-4138

Django's field type URLfield by default checks supplied URL's by
issuing a request to it, which doesn't time out. A Denial of Service
is possible by supplying specially prepared URL's that keep the
connection open indefinately or fill the Django's server memory.

CVE-2011-4139

Django used X-Forwarded-Host headers to construct full URL's. This
header may not contain trusted input and could be used to poison the
cache.

CVE-2011-4140

The CSRF protection mechanism in Django does not properly handle
web-server configurations supporting arbitrary HTTP Host headers,
which allows remote attackers to trigger unauthenticated forged
requests.

For the oldstable distribution (lenny), this problem has been fixed in
version 1.0.2-1+lenny3.

For the stable distribution (squeeze), this problem has been fixed in
version 1.2.3-3+squeeze2.

For the testing (wheezy) and unstable distribution (sid), this problem
has been fixed in version 1.3.1-1.

We recommend that you upgrade your python-django packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

- --------------------------------------------------------------------------
Debian Security Advisory DSA-2331-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
October 28, 2011 http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package : tor
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-2768 CVE-2011-2769

It has been discovered by "frosty_un" that a design flaw in Tor, an online
privacy tool, allows malicious relay servers to learn certain information
that they should not be able to learn. Specifically, a relay that a user
connects to directly could learn which other relays that user is
connected to directly. In combination with other attacks, this issue
can lead to deanonymizing the user. The Common Vulnerabilities and
Exposures project has assigned CVE-2011-2768 to this issue.

In addition to fixing the above mentioned issues, the updates to oldstable
and stable fix a number of less critical issues (CVE-2011-2769). Please
see this posting from the Tor blog for more information:
https://blog.torproject.org/blog/tor-02234-released-security-patches

For the oldstable distribution (lenny), this problem has been fixed in
version 0.2.1.31-1~lenny+1. Due to technical limitations in the Debian
archive scripts, the update cannot be released synchronously with the
packages for stable. It will be released shortly.

For the stable distribution (squeeze), this problem has been fixed in
version 0.2.1.31-1.

For the unstable and testing distributions, this problem has been fixed in
version 0.2.2.34-1.

For the experimental distribution, this problem have has fixed in version
0.2.3.6-alpha-1.

We recommend that you upgrade your tor packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2323-1 security@debian.org
http://www.debian.org/security/ Yves-Alexis Perez
October 26, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : radvd
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3602 CVE-2011-3604 CVE-2011-3605
Debian Bug : 644614

Multiple security issues were discovered by Vasiliy Kulikov in radvd, an
IPv6 Router Advertisement daemon:

CVE-2011-3602

set_interface_var() function doesn't check the interface name, which is
chosen by an unprivileged user. This could lead to an arbitrary file
overwrite if the attacker has local access, or specific files overwrites
otherwise.

CVE-2011-3604

process_ra() function lacks multiple buffer length checks which could
lead to memory reads outside the stack, causing a crash of the daemon.

CVE-2011-3605

process_rs() function calls mdelay() (a function to wait for a defined
time) unconditionnally when running in unicast-only mode. As this call
is in the main thread, that means all request processing is delayed (for
a time up to MAX_RA_DELAY_TIME, 500 ms by default). An attacked could
flood the daemon with router solicitations in order to fill the input
queue, causing a temporary denial of service (processing would be
stopped during all the mdelay() calls).
Note: upstream and Debian default is to use anycast mode.


For the oldstable distribution (lenny), this problem has been fixed in
version 1:1.1-3.1.

For the stable distribution (squeeze), this problem has been fixed in
version 1:1.6-1.1.

For the testing distribution (wheezy), this problem has been fixed in
version 1:1.8-1.2.

For the unstable distribution (sid), this problem has been fixed in
version 1:1.8-1.2.

We recommend that you upgrade your radvd packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/