paul

April 13, 2010

Security issues were identified and fixed in firefox:

Security researcher regenrecht reported (via TippingPoint's Zero Day

Initiative) a potential reuse of a deleted image frame in Firefox 3.6's

handling of multipart/x-mixed-replace images. Although no exploit was

shown, re-use of freed memory has led to exploitable vulnerabilities

in the past (CVE-2010-0164).

Mozilla developers identified and fixed several stability bugs in the

browser engine used in Firefox and other Mozilla-based products. Some

of these crashes showed evidence of memory corruption under certain

circumstances and we presume that with enough effort at least some

of these could be exploited to run arbitrary code (CVE-2010-0165,

CVE-2010-0167).

Mozilla developer Josh Soref of Nokia reported that documents

failed to call certain security checks when attempting to preload

images. Although the image content is not available to the page, it

is possible to specify protocols that are normally not allowed in a

web page such as file:. This includes internal schemes implemented

by add-ons that might perform privileged actions resulting in

something like a Cross-Site Request Forgery (CSRF) attack against

the add-on. Potential severity would depend on the add-ons installed

(CVE-2010-0168).

Mozilla developer Blake Kaplan reported that the window.location object

was made a normal overridable JavaScript object in the Firefox 3.6

browser engine (Gecko 1.9.2) because new mechanisms were developed

to enforce the same-origin policy between windows and frames. This

object is unfortunately also used by some plugins to determine the page

origin used for access restrictions. A malicious page could override

this object to fool a plugin into granting access to data on another

site or the local file system. The behavior of older Firefox versions

has been restored (CVE-2010-0170).

Mozilla developer Justin Dolske reported that the new asynchronous

Authorization Prompt (HTTP username and password) was not always

attached to the correct window. Although we have not demonstrated

this, it may be possible for a malicious page to convince a user

to open a new tab or popup to a trusted service and then have the

HTTP authorization prompt from the malicious page appear to be the

login prompt for the trusted page. This potential attack is greatly

mitigated by the fact that very few web sites use HTTP authorization,

preferring instead to use web forms and cookies (CVE-2010-0172).

Unspecified vulnerability in Mozilla Firefox 3.5.x through 3.5.8 allows

remote attackers to cause a denial of service (memory corruption and

application crash) and possibly have unknown other impact via vectors

that might involve compressed data, a different vulnerability than

CVE-2010-1028 (CVE-2010-1122).

Mozilla developers identified and fixed several stability bugs in the

browser engine used in Firefox and other Mozilla-based products. Some

of these crashes showed evidence of memory corruption under certain

circumstances, and we presume that with enough effort at least some

of these could be exploited to run arbitrary code (CVE-2010-0173,

CVE-2010-0174)

Security researcher regenrecht reported via TippingPoint's Zero Day

Initiative that a select event handler for XUL tree items could be

called after the tree item was deleted. This results in the execution

of previously freed memory which an attacker could use to crash a

victim's browser and run arbitrary code on the victim's computer

(CVE-2010-0175).

Security researcher regenrecht reported via TippingPoint's Zero Day

Initiative an error in the way elements are inserted into

a XUL tree . In certain cases, the number of references

to an element is under-counted so that when the element is

deleted, a live pointer to its old location is kept around and may

later be used. An attacker could potentially use these conditions to

run arbitrary code on a victim's computer (CVE-2010-0176).

Security researcher regenrecht reported via TippingPoint's

Zero Day Initiative an error in the implementation of the

window.navigator.plugins object. When a page reloads, the plugins array

would reallocate all of its members without checking for existing

references to each member. This could result in the deletion of

objects for which valid pointers still exist. An attacker could use

this vulnerability to crash a victim's browser and run arbitrary code

on the victim's machine (CVE-2010-0177).

Security researcher Paul Stone reported that a browser applet could

be used to turn a simple mouse click into a drag-and-drop action,

potentially resulting in the unintended loading of resources in a

user's browser. This behavior could be used twice in succession to

first load a privileged chrome: URL in a victim's browser, then load

a malicious javascript: URL on top of the same document resulting in

arbitrary script execution with chrome privileges (CVE-2010-0178).

Mozilla security researcher moz_bug_r_a4 reported that the

XMLHttpRequestSpy module in the Firebug add-on was exposing

an underlying chrome privilege escalation vulnerability. When

the XMLHttpRequestSpy object was created, it would attach various

properties of itself to objects defined in web content, which were not

being properly wrapped to prevent their exposure to chrome privileged

objects. This could result in an attacker running arbitrary JavaScript

on a victim's machine, though it required the victim to have Firebug

installed, so the overall severity of the issue was determined to be

High (CVE-2010-0179).

phpBB developer Henry Sudhof reported that when an image tag points to

a resource that redirects to a mailto: URL, the external mail handler

application is launched. This issue poses no security threat to users

but could create an annoyance when browsing a site that allows users

to post arbitrary images (CVE-2010-0181).

Mozilla community member Wladimir Palant reported that XML documents

were failing to call certain security checks when loading new

content. This could result in certain resources being loaded that

would otherwise violate security policies set by the browser or

installed add-ons (CVE-2010-0182).

Note that to benefit from the fix for CVE-2009-3555 added

in nss-3.12.6, Firefox 3.6 users will need to set their

security.ssl.require_safe_negotiation preference to true. In Mandriva

the default setting is false due to problems with some common sites.

Since firefox-3.0.19 is the last 3.0.x release Mandriva

opted to provide the latest 3.6.3 version for Mandriva Linux

2008.0/2009.1/MES5/2010.0.

Packages for 2008.0 are provided for Corporate Desktop 2008.0

customers.

Additionally, some packages which require so, have been rebuilt and

are being provided as updates.

April 9, 2010

The tkcvs package did not work properly with Tk release 8.6 and

later. This packages updates fixes this issue and ensure tcl is

properly required by tkcvs package.

April 8, 2010

This update fixes rpmdrake to suggest packages from disabled backports

media only when Backports view is used (#40556).

April 8, 2010

then again: my web and mail server for my own personal stuff runs on a vmware vm running vmware server free edition version 1.0.9

The old say: A mechnics car is always breaking down etc etc

April 8, 2010

or (as I do) you could use another network segment for iScsi .. I have a couple of Dell MD1000's attached to two Dell 2850's which run lvm/drdb

The front end (vm) server use this as storage; the result is I can migrate vm's across front ends with almost (read: mintues) downtime

April 8, 2010

1 interface with vlan'ing . .see below.

requires a vlan capable (Managed) switch for tagging and detagging etc

/etc/network/interfaces (snippet)

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
address 202.37.129.18
netmask 255.255.255.0
network 202.37.129.0
broadcast 202.37.129.255
gateway 202.37.129.1
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 202.37.129.2 131.203.126.178
dns-search interspeed.co.nz


auto virbr1022
iface virbr1022 inet manual
bridge_ports eth0.1022
bridge_stp off
bridge_maxwait 5



host:~# ip add | grep 1022
34: virbr1022: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
35: eth0.1022@eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP

April 7, 2010

This update fixes rpmdrake behavior when suggesting packages from

disabled backports media (#40556).

April 6, 2010

A vulnerability has been found and corrected in nss:

The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as

used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl

in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l,

GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS)

3.12.4 and earlier, and other products, does not properly associate

renegotiation handshakes with an existing connection, which allows

man-in-the-middle attackers to insert data into HTTPS sessions,

and possibly other types of sessions protected by TLS or SSL, by

sending an unauthenticated request that is processed retroactively

by a server in a post-renegotiation context, related to a plaintext

injection attack, aka the Project Mogul issue (CVE-2009-3555).

Additionally the NSPR package has been upgraded to 4.8.4 that brings

numerous upstream fixes.

Packages for 2008.0 are provided for Corporate Desktop 2008.0

customers.

This update provides the latest versions of NSS and NSPR libraries

and for which NSS is not vulnerable to this attack.

April 5, 2010

my 15 or so virtual server run debian using kvm.

I have two remainig vmare boxes destined for the trash heap this year

March 30, 2010

In mandriva 2010.0 /etc/pam.d/kde was not tagged as a config file so

was replaced by a new file on each update.This update fixes this issue.

March 30, 2010

This packages update fixes several issues in initscripts:

- ensure dm-mod is loading in speedboot mode (Mdv bug #57351)

- ensure loadkeys is called in the right order (Mdv bug #57134)

- ensure hid is loaded in first pass for speedboot (fix Macbook login)

- remove false check on alsa (Mdv bug #57265)

- avoid dmraid error message (Mdv bug #55344)

March 27, 2010

A vulnerability has been found and corrected in php:

The xmlrpc extension in PHP 5.3.1 does not properly handle a missing

methodName element in the first argument to the xmlrpc_decode_request

function, which allows context-dependent attackers to cause a denial of

service (NULL pointer dereference and application crash) and possibly

have unspecified other impact via a crafted argument (CVE-2010-0397).

Packages for 2008.0 are provided for Corporate Desktop 2008.0

customers.

The updated packages have been patched to correct this issue.

March 25, 2010

This update provides a fix to the correction of CVE-2010-0307, which

resulted in crashes when running i586 applications on x86_64.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

March 24, 2010

Some vulnerabilities were discovered and corrected in the Linux

2.6 kernel:

The gfs2_lock function in the Linux kernel before

2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux

kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly

remove POSIX locks on files that are setgid without group-execute

permission, which allows local users to cause a denial of service

(BUG and system crash) by locking a file on a (1) GFS or (2) GFS2

filesystem, and then changing this file's permissions. (CVE-2010-0727)

The do_pages_move function in mm/migrate.c in the Linux kernel before

2.6.33-rc7 does not validate node values, which allows local users

to read arbitrary kernel memory locations, cause a denial of service

(OOPS), and possibly have unspecified other impact by specifying a

node that is not part of the kernel's node set. (CVE-2010-0415)

drivers/net/e1000e/netdev.c in the e1000e driver in the Linux

kernel 2.6.32.3 and earlier does not properly check the size of an

Ethernet frame that exceeds the MTU, which allows remote attackers

to have an unspecified impact via crafted packets, a related issue

to CVE-2009-4537. (CVE-2009-4538)

The load_elf_binary function in fs/binfmt_elf.c in the Linux kernel

before 2.6.32.8 on the x86_64 platform does not ensure that the

ELF interpreter is available before a call to the SET_PERSONALITY

macro, which allows local users to cause a denial of service (system

crash) via a 32-bit application that attempts to execute a 64-bit

application and then triggers a segmentation fault, as demonstrated by

amd64_killer, related to the flush_old_exec function. (CVE-2010-0307)

Aditionally, it was added support for some backlight models used in

Samsung laptops and fixes to detect Saitek X52 joysticks.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

March 24, 2010

This update makes the debug package for dbus available to be used

by gdb on x86-64 and allows parallel installation of the development

packages for both x86 and x86-64 architectures.

March 23, 2010

A vulnerability has been found and corrected in cpio and tar:

Heap-based buffer overflow in the rmt_read__ function in lib/rtapelib.c

in the rmt client functionality in GNU tar before 1.23 and GNU cpio

before 2.11 allows remote rmt servers to cause a denial of service

(memory corruption) or possibly execute arbitrary code by sending more

data than was requested, related to archive filenames that contain a :

(colon) character (CVE-2010-0624).

The Tar package as shipped with Mandriva Linux is not affected

by this vulnerability, but it was patched nonetheless in order to

provide additional security to customers who recompile the package

while having the rsh package installed.

Packages for 2008.0 are provided for Corporate Desktop 2008.0

customers.

The updated packages have been patched to correct this issue.

March 23, 2010

A vulnerability has been found and corrected in libpng:

The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before

1.0.53, 1.2.x before 1.2.43, and 1.4.x before 1.4.1 does not properly

handle compressed ancillary-chunk data that has a disproportionately

large uncompressed representation, which allows remote attackers to

cause a denial of service (memory and CPU consumption, and application

hang) via a crafted PNG file, as demonstrated by use of the deflate

compression method on data composed of many occurrences of the same

character, related to a decompression bomb attack (CVE-2010-0205).

The updated packages have been patched to correct this issue.

March 22, 2010

Multiple vulnerabilities has been found and corrected in libpng:

libpng before 1.2.37 does not properly parse 1-bit interlaced images

with width values that are not divisible by 8, which causes libpng

to include uninitialized bits in certain rows of a PNG file and

might allow remote attackers to read portions of sensitive memory

via out-of-bounds pixels in the file (CVE-2009-2042).