Aviso de seguridad de Debian

DSA-224-1 canna -- desbordamiento de búfer y más

Fecha del informe:
8 de ene de 2003
Paquetes afectados:
canna
Vulnerable:
Referencias a bases de datos de seguridad:
En la base de datos de Bugtraq (en SecurityFocus): Id. en BugTraq 6351, Id. en BugTraq 6354.
En el diccionario CVE de Mitre: CVE-2002-1158, CVE-2002-1159.
Información adicional:

Se han descubierto varias vulnerabilidades en canna, un sistema de entrada japonés. El proyecto CVE (Common Vulnerabilities and Exposures - Vulnerabilidades y Exposiciones Comunes) identificó las siguientes vulnerabilidades:

  • CAN-2002-1158 (BugTraq Id 6351): «hsj», de Shadow Penguin Security, descubrió una vulnerabilidad de desbordamiento de pila en la función irw_through del servidor canna.
  • CAN-2002-1159 (BugTraq Id 6354): Shinra Aida, del proyecto Canna, descubrió que canna no validaba adecuadamente las peticiones, lo que permitía a los atacantes remotos causar una denegación de servicio o una debilidad de información.

Para la distribución estable actual (woody), estos problemas se han corregido en la versión 3.5b2-46.2.

Para la distribución estable anterior (potato), estos problemas se han corregido en la versión 3.5b2-25.2.

Para la distribución inestable (sid), estos problemas se han corregido en la versión 3.6p1-1.

Le recomendamos que actualice los paquetes canna.

Arreglado en:

Debian GNU/Linux 2.2 (potato)

Fuentes:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2.dsc
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2.diff.gz
http://ftp.debian.org/debian/dists/potato/main/source/utils/canna_3.5b2.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_i386.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_m68k.deb
PowerPC:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_powerpc.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-25.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-25.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-25.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-25.2_sparc.deb

Debian GNU/Linux 3.0 (woody)

Fuentes:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2.dsc
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2.diff.gz
http://ftp.debian.org/debian/pool/main/c/canna/canna_3.5b2.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_alpha.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_arm.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_i386.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_ia64.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_ia64.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_ia64.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_hppa.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_hppa.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_hppa.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_m68k.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_mips.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_mips.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_mips.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_mipsel.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_mipsel.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_mipsel.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_powerpc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_s390.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_s390.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_s390.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/c/canna/canna_3.5b2-46.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/canna-utils_3.5b2-46.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g_3.5b2-46.2_sparc.deb
http://security.debian.org/pool/updates/main/c/canna/libcanna1g-dev_3.5b2-46.2_sparc.deb

Las sumas MD5 de los ficheros que se listan están disponibles en el aviso original.