Sistemas Afectados

1. Descripción

   Trustix liberó actualizaciones para múltiples paquetes. Estas reparan varias vulnerabilidades, de las cuales la más crítica puede explotarse por personas maliciosas para ocasionar una negación de servicio (DoS) y comprometer un sistema vulnerable.

   Algunas de las actualizaciones son:

   • CVS - Se corrigieron dos vulnerabilidades explotables para ocasionar un DoS y comprometer un sistema vulnerable, su origen esta en el uso de una versión vulnerable de zlib.

     Ver:
     Vulnerabilidad de buffer overflow en 'inftrees.c' de zlib.
     http://www.seguridad.unam.mx/vulnerabilidadesDB-vulne=4628

   • rsync - El código de zlib fue actualizado a la versión 1.2.3, versión más segura.

   • Kernel - La función sys_set_mempolicy() dentro de "mempolicy.c" permitía a usuarios locales ocasionar un DoS via un argumento negativo. También se corrigio un race condition y otros problemas.

   • Lynx - Se corrigio un desbordamiento de memoria en la función "HTrjis()" que permitía a servidores NNTP maliciosos ejecutar código arbitrario.

     Ver:
     Buffer Overflow en 'HTrjis()' de Lynx.
     http://www.seguridad.unam.mx/vulnerabilidadesDB-vulne=4848

   • OpenSSL - Se quito la funcionalidad SSL_OP_MSIE_SSLV2_RSA_PADDING. Opción utilizada para deshabilitar la protección contra un ataque man-in-the-middle.

   • PHP - Se corrigió una vulnerabilidad que podía explotarse para burlar ciertas restricciones de seguridad, debida a un error dentro de "fopen_wrappers.c" que no restringía el acceso a otros directorios cuando la directiva "open_basedir" incluía una diagonal, permitiendo que los scripts tuvieran acceso a archivos de otros directorios.

2. Impacto

   Desconocido.

   Security Bypass.

   Cross-site Scripting.

   Manipulación de datos.

   Escalación de privilegios.

   Negación de servicio (DoS).

   Acceso al sistema.

3. Solución

   Instalar paquetes actualizados.

   Trustix Secure Linux 2.2:

   2ec05ad15cf280b287d40a479af30fdc 2.2/rpms/cvs-1.12.13-1tr.i586.rpm
   6c00f9b202ba36512cfc742398b545e3 2.2/rpms/cvs-contrib-1.12.13-1tr.i586.rpm
   f9df9140be0cb7cd2ba5159a954f3036 2.2/rpms/cvs-pserver-1.12.13-1tr.i586.rpm
   97ea8846768d748cd2a662b142561a38 2.2/rpms/libimap-2002e-5tr.i586.rpm
   151d535b53131bcb5d530f380a790786 2.2/rpms/rsync-2.6.6-1tr.i586.rpm
   50407e1f98813181c1a296bc7ce6d3ca 2.2/rpms/rsync-server-2.6.6-1tr.i586.rpm
   c827dd526de65745a68a39396882624f 2.2/rpms/uw-imap-2002e-5tr.i586.rpm
   439debbd5a80da9efda6972ead0c4af9 2.2/rpms/uw-imap-devel-2002e-5tr.i586.rpm
   71996744ffdba603d36050fa341a6d61 2.2/rpms/cups-1.1.23-5tr.i586.rpm
   4b4d5fe96512a50ae96686930681c95b 2.2/rpms/cups-devel-1.1.23-5tr.i586.rpm
   39ec4d3d5d976165d0ab638e32d8b4e8 2.2/rpms/cups-libs-1.1.23-5tr.i586.rpm
   99a4dd6ce9c0a663db4a89418be919de 2.2/rpms/openssl-0.9.7e-6tr.i586.rpm
   8720b65174a2fe61433c9c8bb32ade65 2.2/rpms/openssl-devel-0.9.7e-6tr.i586.rpm
   a2dff79f4a9b831acff6af14c50c0469 2.2/rpms/openssl-python-0.9.7e-6tr.i586.rpm
   e16d089bba481621431beb04dfc0b55a 2.2/rpms/openssl-support-0.9.7e-6tr.i586.rpm
   308b171c54af53ca69fbd311584ec724 2.2/rpms/apache-2.0.55-1tr.i586.rpm
   d22246cbb3e71354e6153902c8ec1fe9 2.2/rpms/apache-dbm-2.0.55-1tr.i586.rpm
   5f4c3c81d43f0d5ca32ccb3c30f314c8 2.2/rpms/apache-devel-2.0.55-1tr.i586.rpm
   2adad928656dd80b58cdfbf6ceea7c76 2.2/rpms/apache-html-2.0.55-1tr.i586.rpm
   c97a5903d9ee7111498937c2ec82915e 2.2/rpms/apache-manual-2.0.55-1tr.i586.rpm
   9b5c3c1dc65a92539e93af9915f39177 2.2/rpms/apache-suexec-2.0.55-1tr.i586.rpm
   e21367f7e8eba231e780d592a46ac2ef 2.2/rpms/lynx-2.8.5-3tr.i586.rpm
   d7f72636202044256732cf5aa3f5a456 2.2/rpms/php-5.0.5-1tr.i586.rpm
   be9e6c6eef2e6cdb41d7284c78e2b215 2.2/rpms/php-cli-5.0.5-1tr.i586.rpm
   cb634e70926928e7e8fd44f72ccce560 2.2/rpms/php-curl-5.0.5-1tr.i586.rpm
   459c599f18af14ad72328333131dee78 2.2/rpms/php-devel-5.0.5-1tr.i586.rpm
   e933a67389c55ee9b9bd22b114d1bb78 2.2/rpms/php-exif-5.0.5-1tr.i586.rpm
   898cf72bed0e6efd1e7f8e56511056ac 2.2/rpms/php-fcgi-5.0.5-1tr.i586.rpm
   7d2a3e09100f36ad3a0742ad193bfe77 2.2/rpms/php-gd-5.0.5-1tr.i586.rpm
   a29e527b3a1d6925a1ead30070c42c8a 2.2/rpms/php-imap-5.0.5-1tr.i586.rpm
   c4b2af1eb8ebd9fea150fb703b60238a 2.2/rpms/php-ldap-5.0.5-1tr.i586.rpm
   8e58a96709c890d117a61083ca3cdca3 2.2/rpms/php-mhash-5.0.5-1tr.i586.rpm
   80b2bc354ddfcbe1dabc7539ff2c4b01 2.2/rpms/php-mysql-5.0.5-1tr.i586.rpm
   32d6befe9a92cd74462e7cef9bd6dd07 2.2/rpms/php-mysqli-5.0.5-1tr.i586.rpm
   21005dd2d46c17ee43211da816fada73 2.2/rpms/php-pgsql-5.0.5-1tr.i586.rpm
   003ea235528c40cbb201e2bb7233a264 2.2/rpms/php-zlib-5.0.5-1tr.i586.rpm
   238e983cdf2456dd74be19aeb8632a28 2.2/rpms/php4-4.4.0-6tr.i586.rpm
   11398dce9d02adc7db5cc5fd40522008 2.2/rpms/php4-cli-4.4.0-6tr.i586.rpm
   0ebf0c95e1b0e837e7099e4f1cc37ca2 2.2/rpms/php4-curl-4.4.0-6tr.i586.rpm
   ceb17c5eb5125e657cc77f796ce8569a 2.2/rpms/php4-devel-4.4.0-6tr.i586.rpm
   bd4b900b4698b58682c791fc9594fcc4 2.2/rpms/php4-domxml-4.4.0-6tr.i586.rpm
   676a8deb3b89c6ec0cb3335d1662b1a9 2.2/rpms/php4-exif-4.4.0-6tr.i586.rpm
   a30682de1a7496e00504a64d92805cf7 2.2/rpms/php4-fcgi-4.4.0-6tr.i586.rpm
   51585b634c5f4fa8536dc6548c52b0c1 2.2/rpms/php4-gd-4.4.0-6tr.i586.rpm
   42b97fbf30841216d14329de331def51 2.2/rpms/php4-imap-4.4.0-6tr.i586.rpm
   4465021897297d2f77f6d7a305b77adc 2.2/rpms/php4-ldap-4.4.0-6tr.i586.rpm
   a0b1353fea968890386498f5bae5381f 2.2/rpms/php4-mhash-4.4.0-6tr.i586.rpm
   4dd3ef7f1ff7c5eb17b179a803a25051 2.2/rpms/php4-mysql-4.4.0-6tr.i586.rpm
   57a952d4a679c022eb6b068fc3eb8203 2.2/rpms/php4-pgsql-4.4.0-6tr.i586.rpm
   38a7b2a2af002f7178f85dceee63a483 2.2/rpms/php4-test-4.4.0-6tr.i586.rpm
   bec3cba7e234674a113be8d9d8531a5c 2.2/rpms/squid-2.5.STABLE11-1tr.i586.rpm
   109ff17cb00b7446c75bc48a529742a8 2.2/rpms/texinfo-4.7-2tr.i586.rpm
   46343428fe4e0831098727f877020fdb 2.2/rpms/wget-1.10.2-1tr.i586.rpm
   

   Trustix Secure Linux 3.0:

   573fe2b9f8c175440c4216c6341ff05b 3.0/rpms/cvs-1.12.13-1tr.i586.rpm
   7aef92f6aa16b2c2a82bba6adefc1f6b 3.0/rpms/cvs-contrib-1.12.13-1tr.i586.rpm
   f86419d3857805606c96a41c084dca4e 3.0/rpms/cvs-pserver-1.12.13-1tr.i586.rpm
   4557892b6d5a38313d934a3b5aa80237 3.0/rpms/rsync-2.6.6-1tr.i586.rpm
   903ba1b5c2df2a2d9fdef95f60aa3ef2 3.0/rpms/rsync-server-2.6.6-1tr.i586.rpm
   a4b179055d87886f5342eb00abcaa9fc 3.0/rpms/kernel-2.6.13.4-1tr.i586.rpm
   305d521bd4542e2f71f3cf42af6ce275 3.0/rpms/kernel-doc-2.6.13.4-1tr.i586.rpm
   4985bb2ae00f77f1058f660134d01254 3.0/rpms/kernel-headers-2.6.13.4-1tr.i586.rpm
   f1d13780bcaa83608993b6f3787717f6 3.0/rpms/kernel-smp-2.6.13.4-1tr.i586.rpm
   f038611dd528d987eb8eb0dece1a6830 3.0/rpms/kernel-smp-headers-2.6.13.4-1tr.i586.rpm
   706f8ce8e8a3b7908034ca32612b7adc 3.0/rpms/kernel-source-2.6.13.4-1tr.i586.rpm
   ca505dd1b3d1b8a5a0b019ae200a468e 3.0/rpms/kernel-utils-2.6.13.4-1tr.i586.rpm
   4b499c65ece0377d4e5c402af1b23609 3.0/rpms/openssl-0.9.7i-1tr.i586.rpm
   93dbd422a4c28733b6e90b158348c3c3 3.0/rpms/openssl-devel-0.9.7i-1tr.i586.rpm
   99de13687137116ac13ce3a23c67b444 3.0/rpms/openssl-support-0.9.7i-1tr.i586.rpm
   3395c3b84ee9966d8bbf30065f0e630a 3.0/rpms/apache-2.0.55-2tr.i586.rpm
   73917049e2250742496118de92c87b21 3.0/rpms/apache-dbm-2.0.55-2tr.i586.rpm
   edd4e9aa3afaa18d284a627cd76efed5 3.0/rpms/apache-devel-2.0.55-2tr.i586.rpm
   4c37c211cf64f45c1439ec3714fd8938 3.0/rpms/apache-html-2.0.55-2tr.i586.rpm
   d5a886712855264b54e0258a2c39a552 3.0/rpms/apache-manual-2.0.55-2tr.i586.rpm
   9755d7ba05b083095f1e6ec8280f9c4e 3.0/rpms/apache-suexec-2.0.55-2tr.i586.rpm
   4b499c65ece0377d4e5c402af1b23609 3.0/rpms/openssl-0.9.7i-1tr.i586.rpm
   93dbd422a4c28733b6e90b158348c3c3 3.0/rpms/openssl-devel-0.9.7i-1tr.i586.rpm
   99de13687137116ac13ce3a23c67b444 3.0/rpms/openssl-support-0.9.7i-1tr.i586.rpm
   63d897ffe0950c09460b7216701419ad 3.0/rpms/php-5.0.5-1tr.i586.rpm
   34eca9c935f672e0cbf84391ba9f3b70 3.0/rpms/php-calendar-5.0.5-1tr.i586.rpm
   384779d4c5ee34f62596accc579993ce 3.0/rpms/php-cli-5.0.5-1tr.i586.rpm
   dd173818f7ba684c8e0426d58987668e 3.0/rpms/php-curl-5.0.5-1tr.i586.rpm
   7527dfa50ca73a278512cd398b58e189 3.0/rpms/php-devel-5.0.5-1tr.i586.rpm
   fb7a469048594adda7989c014d26a569 3.0/rpms/php-exif-5.0.5-1tr.i586.rpm
   375a30351593da9fe907d08bbdab9e2d 3.0/rpms/php-fcgi-5.0.5-1tr.i586.rpm
   d140161d7d0f2a07d9890fccbd3c9496 3.0/rpms/php-gd-5.0.5-1tr.i586.rpm
   30dec126230b4b9eb4a57c85d08e6c97 3.0/rpms/php-imap-5.0.5-1tr.i586.rpm
   5cde38799cb1f3438ac308dc25310600 3.0/rpms/php-ldap-5.0.5-1tr.i586.rpm
   10d467eb33d7db3637db769e674cdf16 3.0/rpms/php-mhash-5.0.5-1tr.i586.rpm
   c6d4099e9761b33f8878695ab435fd9f 3.0/rpms/php-mysql-5.0.5-1tr.i586.rpm
   144b0c9f2856aa658ecce822dc1fbc51 3.0/rpms/php-mysqli-5.0.5-1tr.i586.rpm
   8c208c65bf8a5b97b16c941f4cd6522f 3.0/rpms/php-pgsql-5.0.5-1tr.i586.rpm
   9c78572b45947c534badd8827689b183 3.0/rpms/php-pspell-5.0.5-1tr.i586.rpm
   5701a41a41d579dba344ef891e7f716f 3.0/rpms/php-snmp-5.0.5-1tr.i586.rpm
   072c14983025f5580abc03a988f2ebc5 3.0/rpms/php-zlib-5.0.5-1tr.i586.rpm
   0d08fd0117f1d68eb3d384cc0fd192af 3.0/rpms/squid-2.5.STABLE11-1tr.i586.rpm
   a3b76833d8fa775af53cd22040938c91 3.0/rpms/texinfo-4.8-5tr.i586.rpm
   5291e67f84de20d4d5e9892996546719 3.0/rpms/wget-1.10.2-1tr.i586.rpm
   

4. Apéndices

   Mayor información.

   http://www.trustix.org/errata/2005/0055/
   http://www.trustix.org/errata/2005/0057/
   http://www.trustix.org/errata/2005/0059/
   http://www.seguridad.unam.mx/vulnerabilidadesDB-vulne=4628
   http://www.seguridad.unam.mx/vulnerabilidadesDB-vulne=4848

La Coordinación de Seguridad de la Información/UNAM-CERT agradece el apoyo en la elaboración ó traducción y revisión de éste Documento a:

• Floriberto López Velázquez (flopez at seguridad dot unam dot mx)