From joey@infodrom.org Wed Mar 15 03:47:25 2006 From: Martin Schulze Resent-From: list@murphy.debian.org (Mailing List Manager) To: Debian Security Announcements Date: Wed, 15 Mar 2006 09:42:49 +0100 (CET) Reply-To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] [SECURITY] [DSA 1002-1] New webcalendar packages fix several vulnerabilities -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1002-1 security@debian.org http://www.debian.org/security/ Martin Schulze March 15th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : webcalendar Vulnerability : several Problem type : remote Debian-specific: no CVE IDs : CVE-2005-3949 CVE-2005-3961 CVE-2005-3982 CERT advisory : BugTraq IDs : 15606 15608 15662 15673 Debian Bugs : 341208 342090 Several security related problems have been discovered in webcalendar, a PHP based multi-user calendar. The Common Vulnerabilities and Exposures project identifies the following vulnerabilities: CVE-2005-3949 Multiple SQL injection vulnerabilities allow remote attackers to execute arbitrary SQL commands. CVE-2005-3961 Missing input sanitising allowas an attacker to overwrite local files. CVE-2005-3982 A CRLF injection vulnerability allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks. The old stable distribution (woody) does not contain webcalendar packages. For the stable distribution (sarge) these problems have been fixed in version 0.9.45-4sarge3. For the unstable distribution (sid) these problems have been fixed in version 1.0.2-1. We recommend that you upgrade your webcalendar package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge3.dsc Size/MD5 checksum: 610 a0cd6c66192d6fcb08ad235bab03682f http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge3.diff.gz Size/MD5 checksum: 11838 01cadcadb69aea8688183bf7093b90e8 http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45.orig.tar.gz Size/MD5 checksum: 612360 a6a66dc54cd293429b604fe6da7633a6 Architecture independent components: http://security.debian.org/pool/updates/main/w/webcalendar/webcalendar_0.9.45-4sarge3_all.deb Size/MD5 checksum: 629166 eebb63997aa535fce008490679d89b3a These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEF9OJW5ql+IAeqTIRAke9AJ0csITsMHmHs4ncMlRCiNfObGeZpQCeIaHm 6+AFNmAybHujJNRTpNmg90s= =02az -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/