Neil McGovern
2005-Aug-28 19:28 UTC
[secure-testing-announce] [DTSA-6-1] New cgiwrap packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------------- Debian Testing Security Advisory DTSA-6-1 http://secure-testing.debian.net secure-testing-team@lists.alioth.debian.org Neil McGovern August 28th, 2005 - ----------------------------------------------------------------------------- Package : cgiwrap Vulnerability : multiple vulnerabilities Problem-Type : remote Debian-specific: yes,no Javier Fernández-Sanguino Peña discovered various vulnerabilities in cgiwrap: Minimum UID does not include all system users The CGIwrap program will not seteuid itself to uids below the ''minimum'' uid to prevent scripts from being misused to compromise the system. However, the Debian package sets the minimum uid to 100 when it should be 1000. CGIs can be used to disclose system information The cgiwrap (and php-cgiwrap) package installs some debugging CGIs (actually symbolink links, which link to cgiwrap and are called ''cgiwrap'' and ''nph-cgiwrap'' or link to php-cgiwrap). These CGIs should not be installed in production environments as they disclose internal and potentially sensible information. For the testing distribution (etch) this is fixed in version 3.9-3.0etch1. For the unstable distribution (sid) this is fixed in version 3.9-3.1. This upgrade is encouraged if you use cgiwrap. The Debian testing security team does not track security issues for the stable distribution (woody). If stable is vulnerable, the Debian security team will make an announcement once a fix is ready. Upgrade Instructions - -------------------- To use the Debian testing security archive, add the following lines to your /etc/apt/sources.list: deb http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free deb-src http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free The archive signing key can be downloaded from http://secure-testing.debian.net/ziyi-2005-7.asc To install the update, run this command as root: If you use cgiwrap: apt-get update && apt-get install cgiwrap If you use php-cgiwrap: apt-get update && apt-get install php-cgiwrap For further information about the Debian testing security team, please refer to http://secure-testing.debian.net/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDEg+597LBwbNFvdMRAs0lAJ9DdNovhwg3uAt41EWCewk38MwtYwCdGwmK eVNzmtmLnoFq8kVkL/YGuL0=4+o/ -----END PGP SIGNATURE-----
Micah
2006-Mar-13 12:28 UTC
[Secure-testing-team] Re: [secure-testing-announce] [DTSA-6-1] New cgiwrap packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 This DTSA shows "Debian-specific" as "yes,no"... micah Neil McGovern wrote:> ----------------------------------------------------------------------------- > Debian Testing Security Advisory DTSA-6-1 http://secure-testing.debian.net > secure-testing-team@lists.alioth.debian.org Neil McGovern > August 28th, 2005 > ----------------------------------------------------------------------------- > > Package : cgiwrap > Vulnerability : multiple vulnerabilities > Problem-Type : remote > Debian-specific: yes,no > > Javier Fern?ndez-Sanguino Pe?a discovered various vulnerabilities in cgiwrap: > > Minimum UID does not include all system users > > The CGIwrap program will not seteuid itself to uids below the ''minimum'' uid > to prevent scripts from being misused to compromise the system. However, > the Debian package sets the minimum uid to 100 when it should be 1000. > > CGIs can be used to disclose system information > > The cgiwrap (and php-cgiwrap) package installs some debugging CGIs > (actually symbolink links, which link to cgiwrap and are called ''cgiwrap'' > and ''nph-cgiwrap'' or link to php-cgiwrap). These CGIs should not be > installed in production environments as they disclose internal and > potentially sensible information. > > For the testing distribution (etch) this is fixed in version > 3.9-3.0etch1. > > For the unstable distribution (sid) this is fixed in version > 3.9-3.1. > > This upgrade is encouraged if you use cgiwrap. > > The Debian testing security team does not track security issues for the > stable distribution (woody). If stable is vulnerable, the Debian security > team will make an announcement once a fix is ready. > > Upgrade Instructions > -------------------- > > To use the Debian testing security archive, add the following lines to > your /etc/apt/sources.list: > > deb http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free > deb-src http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free > > The archive signing key can be downloaded from > http://secure-testing.debian.net/ziyi-2005-7.asc > > To install the update, run this command as root: > If you use cgiwrap: > apt-get update && apt-get install cgiwrap > If you use php-cgiwrap: > apt-get update && apt-get install php-cgiwrap > > For further information about the Debian testing security team, please refer > to http://secure-testing.debian.net/ >_______________________________________________ secure-testing-announce mailing list secure-testing-announce@lists.alioth.debian.org http://lists.alioth.debian.org/mailman/listinfo/secure-testing-announce -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDEllo9n4qXRzy1ioRAv5WAKCdN3O40gDCGsrRU366EULfWwoF6wCgj1J0 SMdgadmHkMAg2JL5aU/Gob0=f8fx -----END PGP SIGNATURE-----