[Full-disclosure] [USN-745-1] Firefox and Xulrunner vulnerabilities
=== Ubuntu Security Notice USN-745-1 March 28, 2009 firefox, firefox-3.0, xulrunner-1.9 vulnerabilities CVE-2009-1044, CVE-2009-1169 === A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS Ubuntu 7.10 Ubuntu 8.04 LTS Ubuntu 8.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: firefox 1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1 Ubuntu 7.10: firefox 2.0.0.21~tb.21.308+nobinonly-0ubuntu0.7.10.1 Ubuntu 8.04 LTS: firefox-3.0 3.0.8+nobinonly-0ubuntu0.8.04.2 xulrunner-1.9 1.9.0.8+nobinonly-0ubuntu0.8.04.1 Ubuntu 8.10: abrowser3.0.8+nobinonly-0ubuntu0.8.10.2 firefox-3.0 3.0.8+nobinonly-0ubuntu0.8.10.2 xulrunner-1.9 1.9.0.8+nobinonly-0ubuntu0.8.10.1 After a standard system upgrade you need to restart Firefox and any applications that use xulrunner, such as Epiphany, to effect the necessary changes. Details follow: It was discovered that Firefox did not properly perform XUL garbage collection. If a user were tricked into viewing a malicious website, a remote attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. This issue only affected Ubuntu 8.04 LTS and 8.10. (CVE-2009-1044) A flaw was discovered in the way Firefox performed XSLT transformations. If a user were tricked into opening a crafted XSL stylesheet, an attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. (CVE-2009-1169) Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1.diff.gz Size/MD5: 11 4c0e1bcc5b9c6628cabb1043e00e232e http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1.dsc Size/MD5: 2389 4c85617a64728b2735fa16dbad02d549 http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.15~prepatch080614l.orig.tar.gz Size/MD5: 49519625 c566aa02a30d72b532b1831df653fa27 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/f/firefox/mozilla-firefox_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_all.deb Size/MD5:53936 1847ca99bedc6c3b3a9e452b78fc http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/mozilla-firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_all.deb Size/MD5:53046 a389c09950c126495ba024ccd61e6c99 amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 47686418 ec36b8546bbc4916096b55d05ee5fe4d http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 2859286 0e9174111e38cf2c1962acebff79483d http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-gnome-support_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5:86304 f9988fd7e2a5caea479d4c7ac53437f5 http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 9494192 0f830daf3dde2de3f8ffddc128ba1d28 http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 222592 7399acc67756f6af23c4a86e41a6670e http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnspr4_1.firefox1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 166156 9cd3f1bcd036a5fa4d04d11cbb10a0bb http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss-dev_1.firefox1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 248148 7f09db8598e69799f131aec1c4d10fb2 http://security.ubuntu.com/ubuntu/pool/main/f/firefox/libnss3_1.firefox1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 826572 30171fcf81e6a0736457067d489c351f http://security.ubuntu.com/ubuntu/pool/universe/f/firefox/firefox-dom-inspector_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_amd64.deb Size/MD5: 218878 dc19e2d7c1d904bbe28385bbea946894 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dbg_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_i386.deb Size/MD5: 44229562 65e5840f0b11f6c5675afcf0b85cfd2d http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox-dev_1.5.dfsg+1.5.0.15~prepatch080614l-0ubuntu1_i386.deb Size/MD5:
Re: [Full-disclosure] Novell Netstorage Multiple Vulnerabilities
-??-??: People still ROFLing. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
[Full-disclosure] [ MDVSA-2009:081 ] libsoup
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 ___ Mandriva Linux Security Advisory MDVSA-2009:081 http://www.mandriva.com/security/ ___ Package : libsoup Date: March 27, 2009 Affected: 2008.0, Corporate 3.0 ___ Problem Description: An integer overflow in libsoup Base64 encoding and decoding functions enables attackers either to cause denial of service and to execute arbitrary code (CVE-2009-0585). This update provides the fix for that security issue. ___ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0585 ___ Updated Packages: Mandriva Linux 2008.0: 1972c4b9fcdd24c4e58a5d8126934192 2008.0/i586/libsoup-2.2_8-2.2.100-1.1mdv2008.0.i586.rpm bdd6df7a38ef005ee0f04783dee36756 2008.0/i586/libsoup-2.2_8-devel-2.2.100-1.1mdv2008.0.i586.rpm c99c9cabb6fd1391dc3b97850c259694 2008.0/SRPMS/libsoup-2.2.100-1.1mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: 237ddbddfbee3f0f91a752e4b7433a07 2008.0/x86_64/lib64soup-2.2_8-2.2.100-1.1mdv2008.0.x86_64.rpm 78d90baeb9b5ac5f405577386c68159f 2008.0/x86_64/lib64soup-2.2_8-devel-2.2.100-1.1mdv2008.0.x86_64.rpm c99c9cabb6fd1391dc3b97850c259694 2008.0/SRPMS/libsoup-2.2.100-1.1mdv2008.0.src.rpm Corporate 3.0: 05c986deeb98dd73e1ac22d23ff605ae corporate/3.0/i586/libsoup-1.99.28-1.2.C30mdk.i586.rpm e99b68c6c991d6a97698bf9b08bdf854 corporate/3.0/i586/libsoup-2.0_0-1.99.28-1.2.C30mdk.i586.rpm f67bb628913f0a17f6b29cb2cbc5aa6f corporate/3.0/i586/libsoup-2.0_0-devel-1.99.28-1.2.C30mdk.i586.rpm 2e1a20ca0d80dcf735855a5f95347646 corporate/3.0/SRPMS/libsoup-1.99.28-1.2.C30mdk.src.rpm Corporate 3.0/X86_64: e7863b68562e8f2ea4eebb1d5c4ce05c corporate/3.0/x86_64/lib64soup-2.0_0-1.99.28-1.2.C30mdk.x86_64.rpm 50fd063851379413327a6878fbe44bf3 corporate/3.0/x86_64/lib64soup-2.0_0-devel-1.99.28-1.2.C30mdk.x86_64.rpm dc97738bc5397ea6290372e6fa13bc90 corporate/3.0/x86_64/libsoup-1.99.28-1.2.C30mdk.x86_64.rpm 2e1a20ca0d80dcf735855a5f95347646 corporate/3.0/SRPMS/libsoup-1.99.28-1.2.C30mdk.src.rpm ___ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com ___ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJzSPamqjQ0CJFipgRAhZ5AJ9HevNsvcfZOLIRqwzSHZr9DJSFGQCgmNmq 6Qm9NtIGAnHR5QIgDcGxsLE= =DBhP -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] phishing attacks against ISPs (also with Google translations)
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 What pertinence will this observation and possible discovery of fact bear upon the computer security world? Please refer to the list charter and take your off topic banter back to your childish funsec world. thank you On Thu, 26 Mar 2009 21:35:30 -0400 Gadi Evron wrote: >I'd be happy if someone has other ideas to help us reach a better >conclusion? > > Gadi. > >___ >Full-Disclosure - We believe in it. >Charter: http://lists.grok.org.uk/full-disclosure-charter.html >Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Version: Hush 3.0 Note: This signature can be verified at https://www.hushtools.com/verify wpwEAQMCAAYFAknM878ACgkQfuF4tUz/X+Lq6gP+NP0wTRkrB5w/IC3WlFnK8xVcg+RZ kjhuVLnhs1Z7unJ5USpabrC9D920lRPEENtSemMb0ydQsp0FMybXaiEMJfm03n2ELD0n bkD1zY3cy9xJMgrn37pRJffXc0O07Gsy/1vokFlLseeslnz6IVpNMFARTNghUVT9q5/c R9Fd7Us= =fuK3 -END PGP SIGNATURE- -- Start your medical billing career! Click here for more information. http://tagline.hushmail.com/fc/BLSrjkqmWewUC6yB2K4ytVzmwABx3tR1hyAxMotEDASdjMXRqoHRuAZ7fws/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] phishing attacks against ISPs (also with Google translations)
M.B.Jr. wrote: > Dear Gadi, > > > On Wed, Mar 25, 2009 at 9:40 AM, Gadi Evron wrote: >> While we have seen ISP phishing and Hebrew phishing before, these >> attacks started when Google added translation into Hebrew. > > > How exactly did you establish such a certain connection between > Google's Hebrew translation service's debut and these phishing attacks > you're referring to? > > If you're going to provide us with dates, please point out trustable > probative sources. Dear Mr. M.B.Jr., While I cannot show conclusive evidence between the two concurrent events, the causality in this case seems pretty obvious for the following reasons: 1. The two (phishing and translation module) occurred at around the same time frame. 2. Previously, this was not happening. 3. The imperfect Hebrew looks like a machine translation. 4. In fact, the only new element I can discern being added to the game was the new Google module. Google is not at fault, they provide a valuable and good service. Criminals abuse the same tools we use. I concede that it is not outside the realm of possibility some crappy Hebrew translator suddenly started working with the phishing gangs, but it doesn't seem likely. Conversely, do note I did not state it was Google's translation engine that was abused, but rather asked if others see this as well and can confirm. I say it now, it is the most likely conclusion. I'd be happy if someone has other ideas to help us reach a better conclusion? Gadi. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
