Secure testing team - Mar 2006 - done with the woody CANs

Djoume SALVETTI wrote:
> Le jeudi 11/18/04 Joey Hess <joeyh@debian.org> a ?crit :
> > There''s still over 200 CVEs to check though, and
I''ll wait for that
> > and for any remaining followup on the CANs.
> 
> I have finish my CVE block but I''m not able to commit
(authentication
> failed via svn but works on the website). Alioth seems to have some
> troubles...
Try again..
> > It''s amazing that we''ve turned up CANs from 2002 and
2003 that are not yet
> > fixed in sarge.
> 
> And even some not fixed in Woody... 
If you know of any in particular, be sure to let the stable security
team know. I haven''t been checking myself, though I''ve seen
several that
looked likely to affect woody too.
> BTW, I don''t know what to do with bug #178102 about vim. The
maintainer
> said on Jan 2003 that a fixed package has already been uploaded to the
> security team but no adivisory nor fixed packages are available yet. 
> I have mailed maintainer but didn''t receive any response.
If that bug affects sarge, it should be reopened. Have you pinged the
stable security team?

-- 
see shy jo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20041122/7c3e7de3/attachment.pgp

Skipped content of type multipart/mixed-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20041122/508f9500/attachment.pgp

Le lundi 11/22/04 Joey Hess <joeyh@debian.org> a ?crit
:
> > And even some not fixed in Woody... 
> 
> If you know of any in particular, be sure to let the stable security
> team know. I haven''t been checking myself, though I''ve
seen several that
> looked likely to affect woody too.
When it wasn''t already the case I''ve open bugs and tags them
security.
If it''s not enough I can mail stable security.
> > BTW, I don''t know what to do with bug #178102 about vim. The
maintainer
> > said on Jan 2003 that a fixed package has already been uploaded to the
> > security team but no adivisory nor fixed packages are available yet. 
> > I have mailed maintainer but didn''t receive any response.
> 
> If that bug affects sarge, it should be reopened. Have you pinged the
> stable security team?
It''s only affecting woody, I have just mailed security team.

Regards.
-- 
Djoum? SALVETTI
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url :
http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20041122/3ddc6b25/attachment.pgp

We seem to be done with checking all of the woody CANs, a grep for TODO
in the list finds only a few things that we''re waiting for updates or a
more thurough check on, and two or three really hard to check CANs, all
the rest checked. 

I''d like to post on -release and let them know that all the old CANs
have been verified fixed or have bugs in the BTS. There''s still over
200
CVEs to check though, and I''ll wait for that and for any remaining
followup on the CANs.

My check script shows piles of holes we now know are still present in
sarge. I''ve seen a lot of things fixed thanks to our work, but I think
we need to get more agressive about making NMUs for unfixed security
bugs. Here''s the full list of unfixed things:

fcron 2.9.5.1 (unfixed; bug #281436) for CAN-2004-1033
fcron 2.9.5.1 (unfixed; bug #281436) for CAN-2004-1032
fcron 2.9.5.1 (unfixed; bug #281436) for CAN-2004-1031
fcron 2.9.5.1 (unfixed; bug #281436) for CAN-2004-1030
zip 2.30-7 needed, have 2.30-6 for CAN-2004-1010
ppp 2.4.2+20040428-3 needed, have 2.4.2+20040428-2 for CAN-2004-1002
iptables 1.2.11-4 needed, have 1.2.11-2 for CAN-2004-0986
mailutils 1:0.5-4 needed, have 1:0.5-3 for CAN-2004-0984
perl 5.8.4-4 needed, have 5.8.4-3 for CAN-2004-0976
openssl 0.9.7e-1 needed, have 0.9.7d-5 for CAN-2004-0975
kbr5 (unfixed; bug #278271; not shipped in binary package) for CAN-2004-0971
libc6 (unfixed; bug #278278) for CAN-2004-0968
apache 1.3.33-2 needed, have 1.3.31-7 for CAN-2004-0940
koffice 1:1.3.4-1 needed, have 1:1.3.2-1.sarge.1 for CAN-2004-0888
kdelibs 4:3.2.3-3.sarge.1 needed, have 4:3.2.3-2 for CAN-2004-0746
konqueror 4:3.2.3-1.sarge.1 needed, have 4:3.2.2-1 for CAN-2004-0721
kdelibs 4:3.2.3-3.sarge.1 needed, have 4:3.2.3-2 for CAN-2004-0721
kdelibs 4:3.2.3-3.sarge.1 needed, have 4:3.2.3-2 for CAN-2004-0690
qla2x00-source 7.01.01-1 needed, have 6.6.10-2 for CAN-2004-0587
openssh (unfixed; bug #270770) for CAN-2004-0175 [very low]
openslp (unfixed; bug #279973; only problem in source package) for CAN-2003-0875
[source package only]
gtkhtml (unfixed; bug #279726) for CAN-2003-0541
kernel-source-2.4.27 (unfixed; bug #280492) for CAN-2003-0465 strncpy in kernel
does not pad with zeroes
ssh (unfixed; bug #281595) for CAN-2003-0190
exim (unfixed; bug #171774) for CVE-2002-1381
apache 1.3.33-2 needed, have 1.3.31-7 for DSA-594-1
libgd1 (unfixed; bug #280134) for DSA-589-1
iptables 1.2.11-4 needed, have 1.2.11-2 for DSA-580-1
kpdf 4:3.3.1-1 needed, have 4:3.2.3-1.1 for DSA-573-1
kfax 4:3.3.1-1 needed, have 4:3.2.3-1.1 for DSA-573-1
kdelibs 4:3.2.3-3.sarge.1 needed, have 4:3.2.3-2 for DSA-539

It''s amazing that we''ve turned up CANs from 2002 and 2003 that
are not yet
fixed in sarge.

-- 
see shy jo
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url :
http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20041117/5182966e/attachment.pgp