[SECURITY] [DSA 586-1] New ruby packages fix denial of service
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 586-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 8th, 2004 http://www.debian.org/security/faq - -- Package: ruby Vulnerability : infinite loop Problem-Type : remote Debian-specific: no CVE ID : CAN-2004-0983 The upstream developers of Ruby have corrected a problem in the CGI module for this language. Specially crafted requests could cause an infinite loop and thus cause the program to eat up cpu cycles. For the stable distribution (woody) this problem has been fixed in version ruby_1.6.7-3woody4. For the unstable distribution (sid) this problem has been fixed in version 1.6.8-12 of ruby1.6 and in version 1.8.1+1.8.2pre2-4 of ruby1.8. We recommend that you upgrade your ruby packages. Upgrade Instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - Source archives: http://security.debian.org/pool/updates/main/r/ruby/ruby_1.6.7-3woody4.dsc Size/MD5 checksum: 909 199360fc56e90c03e2db35898539962f http://security.debian.org/pool/updates/main/r/ruby/ruby_1.6.7-3woody4.diff.gz Size/MD5 checksum:43409 c4c76a272d9d57142b2376146bc57297 http://security.debian.org/pool/updates/main/r/ruby/ruby_1.6.7.orig.tar.gz Size/MD5 checksum: 996835 a8859c679ee9acbfdf5056cdf26fcad3 Architecture independent components: http://security.debian.org/pool/updates/main/r/ruby/irb_1.6.7-3woody4_all.deb Size/MD5 checksum:51190 b6580615493b7f8c808f4f5eb515f477 http://security.debian.org/pool/updates/main/r/ruby/ruby-elisp_1.6.7-3woody4_all.deb Size/MD5 checksum:30256 88bcceab112fe1bcd53257744131eae1 http://security.debian.org/pool/updates/main/r/ruby/ruby-examples_1.6.7-3woody4_all.deb Size/MD5 checksum:37868 0cf747524848e0d2efa3645fb7c92689 Alpha architecture: http://security.debian.org/pool/updates/main/r/ruby/libcurses-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 129432 3cbff5f492c63cdc9f8fb4d024545ea1 http://security.debian.org/pool/updates/main/r/ruby/libdbm-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 128536 c81d37ad31fff057cf78609483e7271a http://security.debian.org/pool/updates/main/r/ruby/libgdbm-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 129916 3719a9eb879e07a1e57b3296008f6f69 http://security.debian.org/pool/updates/main/r/ruby/libnkf-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 134810 0f9dd8734048519d8b5e0816390c2378 http://security.debian.org/pool/updates/main/r/ruby/libpty-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 131850 8e272284f74f85a3d3eebdc913770658 http://security.debian.org/pool/updates/main/r/ruby/libreadline-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 128418 b733779d7cd49e56b5d66aebd19f37e7 http://security.debian.org/pool/updates/main/r/ruby/libruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 644334 87212bd04df1281c6a1d1a4193224c78 http://security.debian.org/pool/updates/main/r/ruby/libsdbm-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 132306 9ad79ac47ca27342fd43067f401d8022 http://security.debian.org/pool/updates/main/r/ruby/libsyslog-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 128898 2e1a420e607eb122b44d4569ed78b62d http://security.debian.org/pool/updates/main/r/ruby/libtcltk-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 147450 2dd530d288433af42f4ab618d6fca175 http://security.debian.org/pool/updates/main/r/ruby/libtk-ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 161412 bb9d3de7e3762fae64988cdb32058542 http://security.debian.org/pool/updates/main/r/ruby/ruby_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 142598 06bb7a48e88f88b1181f84ea5afdc6f0 http://security.debian.org/pool/updates/main/r/ruby/ruby-dev_1.6.7-3woody4_alpha.deb Size/MD5 checksum: 625952 d061059d60fbba454b4fecb82a379142 ARM architecture: http://security.debian.org/pool/updates/main/r/ruby/libcurses-ruby_1.6.7-3woody4_arm.deb Size/MD5 checksum: 128410 9e3bd9c043823c09cc125147c822895c http://security.debian.org/pool/updates/main/r/ruby/libdbm-ruby_1.6.7-3woody4_arm.deb Size/MD5 checksum: 127288 aa864c4c7f530ccf721c9fd93f099dc8
[SECURITY] [DSA 587-1] New freeam packages fix arbitrary code execution
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 587-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 8th, 2004 http://www.debian.org/security/faq - -- Package: freeamp Vulnerability : buffer overflow Problem-Type : remote Debian-specific: no CVE ID : CAN-2004-0964 Luigi Auriemma discovered a buffer overflow condition in the playlist module of freeamp which could lead to arbitrary code execution. Recent versions of freeamp were renamed into zinf. For the stable distribution (woody) this problem has been fixed in version 2.1.1.0-4woody2. For the unstable distribution (sid) this problem does not exist in the zinf packageas the code in question was rewritten. We recommend that you upgrade your freeamp packages. Upgrade Instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - Source archives: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2.dsc Size/MD5 checksum: 944 39d51f9def21f5b1d5542ccbcbc01e29 http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2.diff.gz Size/MD5 checksum:32347 783b34ce5201a8e4e10a8722fd00ad8f http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0.orig.tar.gz Size/MD5 checksum: 3116888 d465da9fcdcc6ee7991e9b6cd968127b Architecture independent components: http://security.debian.org/pool/updates/main/f/freeamp/freeamp-doc_2.1.1.0-4woody2_all.deb Size/MD5 checksum: 282330 ffb91e1362db38b0e063839afdb7eefa Alpha architecture: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2_alpha.deb Size/MD5 checksum: 2399962 187f779ad3fa78a1bcb6f79837a733ba http://security.debian.org/pool/updates/main/f/freeamp/freeamp-extras_2.1.1.0-4woody2_alpha.deb Size/MD5 checksum:90476 d184dd97abf70f5db80579e76bdca43a http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-alsa_2.1.1.0-4woody2_alpha.deb Size/MD5 checksum:34752 97704f6cd7245b6821d4683ee7999015 http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-esound_2.1.1.0-4woody2_alpha.deb Size/MD5 checksum:33376 77bbee46f4b02464e387d40fd850fac9 ARM architecture: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2_arm.deb Size/MD5 checksum: 2194684 c37e64837c2353be71062e9c74934028 http://security.debian.org/pool/updates/main/f/freeamp/freeamp-extras_2.1.1.0-4woody2_arm.deb Size/MD5 checksum:82794 6e6e0079c0f912c6aba7e3a73bc7963d http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-alsa_2.1.1.0-4woody2_arm.deb Size/MD5 checksum:29440 615324c7d033b4c327a883239b5afe9c http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-esound_2.1.1.0-4woody2_arm.deb Size/MD5 checksum:29342 d745a17d3a3c59dd6d004babcfa7563b Intel IA-32 architecture: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2_i386.deb Size/MD5 checksum: 2032164 5c68a2b2940d9bfa3f5f3320f9a85d5b http://security.debian.org/pool/updates/main/f/freeamp/freeamp-extras_2.1.1.0-4woody2_i386.deb Size/MD5 checksum:73482 091fe47ddd9308edcd2df707b00fefc8 http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-alsa_2.1.1.0-4woody2_i386.deb Size/MD5 checksum:29382 3b22fa0992c89e05542d06b78ca263df http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-esound_2.1.1.0-4woody2_i386.deb Size/MD5 checksum:28476 0142da2d0ed0d50e7fe454171d7066da Intel IA-64 architecture: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2_ia64.deb Size/MD5 checksum: 2367142 c43140e99b8dd87934e9611a060fe1bc http://security.debian.org/pool/updates/main/f/freeamp/freeamp-extras_2.1.1.0-4woody2_ia64.deb Size/MD5 checksum:84638 6e55107e3071f451b08d77aed3260d44 http://security.debian.org/pool/updates/main/f/freeamp/libfreeamp-esound_2.1.1.0-4woody2_ia64.deb Size/MD5 checksum:27532 84b0e8df2b31326b378ce79e404ec4cd HP Precision architecture: http://security.debian.org/pool/updates/main/f/freeamp/freeamp_2.1.1.0-4woody2_hppa.deb Size/MD5 checksum: 2184294
[SECURITY] [DSA 588-1] New gzip packages fix insecure temporary files
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 588-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 8th, 2004 http://www.debian.org/security/faq - -- Package: gzip Vulnerability : insecure temporary files Problem-Type : local Debian-specific: no CVE ID : CAN-2004-0970 BugTraq ID : 11288 Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack. For the stable distribution (woody) these problems have been fixed in version 1.3.2-3woody3. The unstable distribution (sid) is not affected by these problems. We recommend that you upgrade your gzip package. Upgrade Instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - Source archives: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3.dsc Size/MD5 checksum: 577 3b5fd05de61de0a41973facf1edc6692 http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3.diff.gz Size/MD5 checksum: 6371 cdb2a28b380ba84bae2c652eb156ca5a http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2.orig.tar.gz Size/MD5 checksum: 311011 57bff96b6b4bcbb060566bdbed29485d Alpha architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_alpha.deb Size/MD5 checksum:76456 3b8b2991a66b675198febc281ca59e84 ARM architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_arm.deb Size/MD5 checksum:68776 c049ef9bec9ac21c99c1f7eefc6ceb2e Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_i386.deb Size/MD5 checksum:62076 536b666d29bcc648a1f105b3e5ef0708 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_ia64.deb Size/MD5 checksum:86840 dd973820227968197c4da091db22bf18 HP Precision architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_hppa.deb Size/MD5 checksum:72594 70eb93310c314cd923091c93e0eded97 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_m68k.deb Size/MD5 checksum:61278 a47c8230f4f721e2a1adc6545aa25198 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_mips.deb Size/MD5 checksum:71762 68707f5373f065430d43cd2700902b60 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_mipsel.deb Size/MD5 checksum:71660 50646d0590343e2b90dc9f32fade4d54 PowerPC architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_powerpc.deb Size/MD5 checksum:69280 9f49c09ec45ae1d4135e384e94914b72 IBM S/390 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_s390.deb Size/MD5 checksum:66726 c2a0ca55f66fa0a6631756fc68d14b8d Sun Sparc architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_sparc.deb Size/MD5 checksum:70298 88378dc40c8e762b97da5a16058190af These files will probably be moved into the stable distribution on its next update. - - For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: [EMAIL PROTECTED] Package info: `apt-cache show pkg' and http://packages.debian.org/pkg -BEGIN PGP SIGNATURE- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFBj5IwW5ql+IAeqTIRAoYJAJ41JFb6u0yuf2fomIzGcYNNPgrkIACgmfz/ ljBz6K9A7PBxJLYAzXHFUbc= =L+Am -END PGP SIGNATURE- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: TCP SYN packets which have the FIN flag set.
On Mon, Nov 08, 2004 at 09:36:43AM +0100, Giacomo Mulas wrote: On Fri, 5 Nov 2004, George Georgalis wrote: and for anybody who is interested, I've found the limit function works well to manage logging and types of deny. -m limit --limit-burst 50 --limit 1/s At the end of my NEW ACCEPT set, I call a chain that, within the limit, logs and rejects remaining connections, beyond the limit it returns. the next two rules log some (with limit again) of the remaining connections and drops them all. The setup gives a balance between the problems of logging and rejecting everything bad and just dropping everything bad. Doesn't that open the possibility for a DOS, simply by sending a stream of new attempted connections to your computers? Then this would continuously saturate the rate of new attempted connections, and your legitimate connections would be virtually impossible. Or is the netfilter limit code as smart as to use separate limits to separate source IP numbers? Unfortunately the limit function doesn't easily apply to specific ip addresses (I think there is a way to do it but it's not easy and I don't know how). and a stream of new connections will dos me. :) Maybe I wasn't clear, I don't limit good connections. (though it might be a good idea to limit port 80 to a rate my apache can sustain, otherwise route to a lightweight httpd that responds with try again later). I'm using limit for REJECT of bad connections when they connect, when the limit is reached I stop rejecting the bad ones and just DROP them. for logging, I log the rejected ones but only some of the dropped ones. REJECT means I respond, DROP means the client may continue to try until it times out, So generally there is less bandwidth with REJECT, unless you are being attacked, then there is less with DROP. and for certain abusive subnets I request that they be dropped (or whatever) at my ISP router. // George -- George Georgalis, systems architect, administrator Linux BSD IXOYE http://galis.org/george/ cell:646-331-2027 mailto:[EMAIL PROTECTED] -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Re: [SECURITY] [DSA 588-1] New gzip packages fix insecure temporary files
all updated. platypus.netregistry.net: gzip 1.3.2-3woody3 mix.netregistry.net: gzip 1.3.2-3woody3 www.jp.com: gzip not installed cthulhu.netregistry.net: gzip 1.3.2-3woody3 caelum.netregistry.net: gzip 1.3.2-3woody3 proxy.netregistry.net: gzip 1.3.2-3woody3 asp.netregistry.net: gzip 1.3.2-3woody3 ws-1.netregistry.net: gzip 1.3.2-3woody3 ws-2.netregistry.net: gzip 1.3.2-3woody3 ws-3.netregistry.net: gzip 1.3.2-3woody3 lb1.netregistry.net: gzip 1.3.2-3woody3 lb2.netregistry.net: gzip 1.3.2-3woody3 ns.au.com: gzip 1.3.2-3woody3 ns2.au.com: gzip 1.3.2-3woody3 redirector.netregistry.net: gzip 1.3.2-3woody3 mail.netregistry.net: gzip 1.3.2-3woody3 mx1.au.com: gzip 1.3.2-3woody3 mx-1.netregistry.net: gzip 1.3.2-3woody3 mx-2.netregistry.net: gzip 1.3.2-3woody3 mx1.netregistry.net: gzip 1.3.2-3woody3 webmail.netregistry.net: gzip 1.3.2-3woody3 theconsole.netregistry.net: gzip 1.3.2-3woody3 azathoth.nro.au.com: gzip 1.3.2-3woody3 smarthost.nro.au.com: gzip not installed logs.netregistry.net: gzip 1.3.2-3woody3 pop3-1.netregistry.net: gzip 1.3.2-3woody3 pop3-2.netregistry.net: gzip 1.3.2-3woody3 support.netregistry.net: gzip 1.3.5-9 On Tue, 2004-11-09 at 02:35, Martin Schulze wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 - -- Debian Security Advisory DSA 588-1 [EMAIL PROTECTED] http://www.debian.org/security/ Martin Schulze November 8th, 2004 http://www.debian.org/security/faq - -- Package: gzip Vulnerability : insecure temporary files Problem-Type : local Debian-specific: no CVE ID : CAN-2004-0970 BugTraq ID : 11288 Trustix developers discovered insecure temporary file creation in supplemental scripts in the gzip package which may allow local users to overwrite files via a symlink attack. For the stable distribution (woody) these problems have been fixed in version 1.3.2-3woody3. The unstable distribution (sid) is not affected by these problems. We recommend that you upgrade your gzip package. Upgrade Instructions - wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - Source archives: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3.dsc Size/MD5 checksum: 577 3b5fd05de61de0a41973facf1edc6692 http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3.diff.gz Size/MD5 checksum: 6371 cdb2a28b380ba84bae2c652eb156ca5a http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2.orig.tar.gz Size/MD5 checksum: 311011 57bff96b6b4bcbb060566bdbed29485d Alpha architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_alpha.deb Size/MD5 checksum:76456 3b8b2991a66b675198febc281ca59e84 ARM architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_arm.deb Size/MD5 checksum:68776 c049ef9bec9ac21c99c1f7eefc6ceb2e Intel IA-32 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_i386.deb Size/MD5 checksum:62076 536b666d29bcc648a1f105b3e5ef0708 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_ia64.deb Size/MD5 checksum:86840 dd973820227968197c4da091db22bf18 HP Precision architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_hppa.deb Size/MD5 checksum:72594 70eb93310c314cd923091c93e0eded97 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_m68k.deb Size/MD5 checksum:61278 a47c8230f4f721e2a1adc6545aa25198 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_mips.deb Size/MD5 checksum:71762 68707f5373f065430d43cd2700902b60 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_mipsel.deb Size/MD5 checksum:71660 50646d0590343e2b90dc9f32fade4d54 PowerPC architecture: http://security.debian.org/pool/updates/main/g/gzip/gzip_1.3.2-3woody3_powerpc.deb Size/MD5 checksum:69280 9f49c09ec45ae1d4135e384e94914b72 IBM S/390 architecture:
