LinuxLife Blog

This is an OpenPGP/MIME signed message (RFC 2440 and 3156)--------------enigB4942845972D914CBC615558Content-Type: text/plain; charset=ISO-8859-Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 201201-15- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: High    Title: ktsuss: Privilege escalation     Date: January 27, 2012     Bugs: #381115       ID: 201201-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis========

Two vulnerabilities have been found in ktsuss, allowing local attackersto gain escalated privileges.

Background==========

ktsuss is a simple, graphical version of su written in C and GTK+.

Affected packages=================

    -------------------------------------------------------------------     Package              /     Vulnerable     /            Unaffected    -------------------------------------------------------------------  1  x11-misc/ktsuss               = 1.4                  Vulnerable!    -------------------------------------------------------------------     NOTE: Certain packages are still vulnerable. Users should migrate           to another package if one is available or wait for the           existing packages to be marked stable by their           architecture maintainers.

Description===========

Two vulnerabilities have been found in ktuss:

* Under specific circumstances, ktsuss skips authentication and fails  to change the effective UID back to the real UID (CVE-2011-2921).* The GTK interface spawned by the ktsuss binary is run as root  (CVE-2011-2922).

Impact======

A local attacker could gain escalated privileges and use the"GTK_MODULES" environment variable to possibly execute arbitrary codewith root privileges.

Workaround==========

There is no known workaround at this time.

Resolution==========

Gentoo discontinued support for ktsuss. We recommend that users unmergektsuss:

  # emerge --unmerge "x11-misc/ktsuss"

References==========

[ 1 ] CVE-2011-2921http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2921[ 2 ] CVE-2011-2922http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2922

Availability============

This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:

 http://security.gentoo.org/glsa/glsa-201201-15.xml

Concerns?=========

Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users' machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttps://bugs.gentoo.org.

License=======

Copyright 2012 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).

The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5

--------------enigB4942845972D914CBC615558Content-Type: application/pgp-signature; name="signature.asc"Content-Description: OpenPGP digital signatureContent-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----Version: GnuPG v2.0.17 (GNU/Linux)Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iF4EAREIAAYFAk8ivTUACgkQAnl3SfnYR/jjkwD/T8zYdO5lqRkUNeIqV6SeUcZrzxinbp559kFhVtCYj9UBAJlqfEK+v/1KUUQwLZmMYa2wkdCQHlOlpq4Xph67AEbJ=9fkZ-----END PGP SIGNATURE-----

--------------enigB4942845972D914CBC615558--

Article source: http://www.pro-linux.de/sicherheit/2/16237/zwei-probleme-in-ktsuss.html

Das unter den Fittichen der Apache Software Foundation (ASF) beheimatete Shiro-Projekt hat die Version 1.2 seines Java- Applikationen-Sicherheits-Frameworks veröffentlicht. Shiro stellt Entwicklern eine API bereit, mit deren Hilfe sie ihre Anwendungen schnell um sicherheitsrelevante Funktionalitäten wie Authentifizierung und Authorisierung, Enterprise-Session-Management und Verschlüsselung erweitern können.

Article source: http://www.pro-linux.de/news/1/17967/apache-shiro-12-vereinfacht-umgang-mit-passwoertern.html

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA1

- -------------------------------------------------------------------------Debian Security Advisory DSA-2394-1                   security@debian.orghttp://www.debian.org/security/                             Luciano BelloJanuary 27, 2012                       http://www.debian.org/security/faq- -------------------------------------------------------------------------

Package        : libxml2Vulnerability  : severalProblem type   : remoteDebian-specific: noCVE ID         : CVE-2011-0216 CVE-2011-2821 CVE-2011-2834 CVE-2011-3905                  CVE-2011-3919 Debian Bug     : 652352 643648 656377

Many security problems had been fixed in libxml2, a popular library to handleXML data files.

CVE-2011-3919:Jüri Aedla discovered a heap-based buffer overflow that allows remote attackersto cause a denial of service or possibly have unspecified other impact viaunknown vectors.

CVE-2011-0216:An Off-by-one error have been discoveried that allows remote attackers to execute arbitrary code or cause a denial of service. 

CVE-2011-2821:A memory corruption (double free) bug has been identified in libxml2's XPathengine. Through it, it is possible to an attacker allows cause a denial of service or possibly have unspecified other impact. This vulnerability does notaffect the oldstable distribution (lenny).

CVE-2011-2834:Yang Dingning discovered a double free vulnerability related to XPath handling.

CVE-2011-3905:An out-of-bounds read vulnerability had been discovered, which allows remoteattackers to cause a denial of service.

For the oldstable distribution (lenny), this problem has been fixed inversion 2.6.32.dfsg-5+lenny5.

For the stable distribution (squeeze), this problem has been fixed inversion 2.7.8.dfsg-2+squeeze2.

For the testing distribution (wheezy), this problem has been fixed inversion 2.7.8.dfsg-7.

For the unstable distribution (sid), this problem has been fixed inversion 2.7.8.dfsg-7.

We recommend that you upgrade your libxml2 packages.

Further information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8h1n8ACgkQQWTRs4lLtHnXgACfV+dXC4Yc/aNb5udhKMYsEryTmXAAoLetgUJRnDACae5LC9qnegUiNHRt=j/Is-----END PGP SIGNATURE-----

-- To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.orgwith a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.orgArchive: http://lists.debian.org/20120126224821.B5F9F1277F1@nube.usla.org.ar

Article source: http://www.pro-linux.de/sicherheit/2/16236/mehrere-probleme-in-libxml2.html

Gehen Linux und Spiele zusammen? Selbstverständlich, ist die offensichtliche Antwort. Die Tradition reicht bis zu den BSD-Spielen, Rogue und Nethack zurück. Selbst wenn wenige aktuelle, auf den Massenmarkt zielende Spiele für Linux erscheinen, gibt es eine kaum zu überschauende Vielfalt an Spielen: Zahlreiche freie Projekte, darunter einige von beachtlicher Größe, viele Independent-Spiele, Emulatoren, Wine, Online-Spiele usw. Nimmt man Android noch hinzu, ist sogar die Aussage, dass kaum aktuelle Spiele für Linux erscheinen, nicht mehr haltbar.

Wie steht es bei Ihnen, nutzen Sie dieses Angebot und wenn ja, wie oft? Bei der Antwort soll es egal sein, um was für ein Gerät es sich handelt, wenn ein Linux darauf läuft. Gern können Sie Ihre Antwort in den Kommentaren erläutern.

Article source: http://www.pro-linux.de/umfragen/2/96/wie-oft-spielen-sie-unter-linux.html

Originalnachricht

Article source: http://www.pro-linux.de/sicherheit/2/16227/cross-site-scripting-in-rubygem-actionpack.html

April und Mai gibt es bereits traditionell die LinuxWochen in Österreich, eine Art Roadshow in den größeren Städten des Landes. Gemeinsam mit der Veranstaltung in Wien findet auch das Libre Graphics Meeting statt.

Article source: http://www.pro-linux.de/news/1/17963/vienna-calling-libre-graphics-meeting-und-linux-wochen-in-wien.html

HP plant die Veröffentlichung des freien WebOS 1.0 im September. Auf dem Weg dorthin werden zahlreiche Komponenten bereits vorab veröffentlicht.

Article source: http://www.pro-linux.de/news/1/17965/webos-soll-im-september-frei-sein.html

--===============8095935223405777870==Content-Type: multipart/signed; micalg="pgp-sha512";	protocol="application/pgp-signature"; boundary="=-Ws82xzG8nz6l32WWH5NQ"

--=-Ws82xzG8nz6l32WWH5NQContent-Type: text/plain; charset="UTF-8Content-Transfer-Encoding: quoted-printable

==========================================================================Ubuntu Security Notice USN-1348-1January 26, 2012

icu vulnerability==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 11.10- Ubuntu 11.04- Ubuntu 10.10- Ubuntu 10.04 LTS

Summary:

ICU could be made to crash or run programs as your login if itopened specially crafted data.

Software Description:- icu: International Components for Unicode library

Details:

It was discovered that ICU did not properly handle invalid locale dataduring Unicode conversion. If an application using ICU processed crafteddata, an attacker could cause it to crash or potentially execute arbitrarycode with the privileges of the user invoking the program.

Update instructions:

The problem can be corrected by updating your system to the followingpackage versions:

Ubuntu 11.10:  libicu44                        4.4.2-2ubuntu0.11.10.1

Ubuntu 11.04:  libicu44                        4.4.2-2ubuntu0.11.04.1

Ubuntu 10.10:  libicu42                        4.2.1-3ubuntu0.10.10.1

Ubuntu 10.04 LTS:  libicu42                        4.2.1-3ubuntu0.10.04.1

In general, a standard system update will make all the necessary changes.

References:http://www.ubuntu.com/usn/usn-1348-1  CVE-2011-4599

Package Information:https://launchpad.net/ubuntu/+source/icu/4.4.2-2ubuntu0.11.10.1https://launchpad.net/ubuntu/+source/icu/4.4.2-2ubuntu0.11.04.1https://launchpad.net/ubuntu/+source/icu/4.2.1-3ubuntu0.10.10.1https://launchpad.net/ubuntu/+source/icu/4.2.1-3ubuntu0.10.04.1


--Ðs82xzG8nz6l32WWH5NQContent-Type: application/pgp-signature; name="signature.asc"Content-Description: This is a digitally signed message partContent-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----Version: GnuPG v1.4.11 (GNU/Linux)

iQIcBAABCgAGBQJPIWgrAAoJEGVp2FWnRL6TYpcP/0jeDBG2BwjP/xcPA23E84A0CKhAd20CKn6j/+ehYOzK648JlDXXdhUwfeIbeJrwRm0wr2RYqKXd80LyxWKOz0KwqpJTn6IJ7UDhPkAamyyoXfrg5e9JNFDk/bR7LplJDZmeu/TQqeaPSzb7KE2shSjfgdan7s1M14NXLS1bAop9ijKfXlXEfb3lval9yypSzlQ/X5YDd7ox5ELK5t4OeUIeQMFA0NCtUHC3arGy9y9peYf1EekFyB2j8T2FWN+ONg2vUIBHy7jMbHmflIDrbfxGY8xVqk0I1mPRA1U2+52We1vVJwI50jW5dfctylF6KaamWrx49imwX6s4/1An2bNFfzlDoXnQELEFOZfs/4s15rHYIw8zo7u4sRntFRfV2WcyFl4UMKdVQ5im0eR31cQOPSazQGrnbl4tixWhHgeyIdc+nYfL1QXCxofIerOHaO9tB8Hhs+oVsy6wv/jFv4gOaEYFx6us/pAuuzQmOQKOqpGHlMscWXEu+1rcPQHLLprRgfq/mLZg/r4O0k3wI1gt06JCfp+wjhn1Mhc3GldXjpLY238yHJ8IQpBFcQaTh7xnvNPB0guU2DqJ5UmTrrk9/+bKYNALB+k5zjargsaJso46srCONLKqBoT5ABgJIpkXg9FZLFRQjBBHZ1k4OK6/6ybXw2Wp5KZcLgmabTfx=lV2J-----END PGP SIGNATURE-----

--=-Ws82xzG8nz6l32WWH5NQ--


--===============8095935223405777870==Content-Type: text/plain; charset="us-ascii"MIME-Version: 1.0Content-Transfer-Encoding: 7bitContent-Disposition: inline

-- ubuntu-security-announce mailing listubuntu-security-announce@lists.ubuntu.comModify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============8095935223405777870==--

Article source: http://www.pro-linux.de/sicherheit/2/16230/ausfuehren-beliebiger-kommandos-in-icu.html

Originalnachricht

Article source: http://www.pro-linux.de/sicherheit/2/16223/pufferueberlauf-in-bip.html