From bugzilla at redhat.com Thu Jun 1 19:04:17 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Thu, 1 Jun 2006 15:04:17 -0400 Subject: [Bug 193809] New: Snort URIContent Rules Detection Evasion Vulnerability Message-ID: Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193809 Summary: Snort URIContent Rules Detection Evasion Vulnerability Product: Fedora Extras Version: devel Platform: All OS/Version: Linux Status: NEW Severity: normal Priority: normal Component: snort AssignedTo: dennis at ausil.us ReportedBy: dennis at ausil.us QAContact: extras-qa at fedoraproject.org CC: extras-qa at fedoraproject.org,fedora-security- list at redhat.com Snort is reportedly prone to a vulnerability that may allow malicious packets to bypass detection. A successful attack can allow attackers to bypass intrusion detection and to carry out attacks against computers protected by Snort. This vulnerability affects Snort 2.4.4. Other versions may be vulnerable as well. there is no CVE yet Demarc snort-2.4.4-demarc-patch.diff http://www.demarc.com/files/patch_20060531/snort-2.4.4-demarc-patch.diff -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From deisenst at gtw.net Fri Jun 2 07:41:07 2006 From: deisenst at gtw.net (David Eisenstein) Date: Fri, 2 Jun 2006 02:41:07 -0500 (CDT) Subject: [Legacy] Mentoring for vulnerability bug tracking -- kernel, and general Message-ID: Hi, (Please forgive me for cross-posting, but I thought I'd post this question to all the relevant groups I could think of. Please let me know if I am committing a cross-posting felony here. :) ) I am in the process of mentoring someone to help them learn how to do vulnerability tracking for Fedora Legacy. This evening, we were looking at doing that for the kernels. We quickly got confused, though, because we weren't sure how to go about making sure we only report issues into Bugzilla that would be relevant kernel issues for Fedora Legacy at this time. One complicating factor here is that we in Legacy don't necessarily release kernels in any kind of lock-step with what either Fedora Core or Red Hat Enterprise Linux does, so the issues we have to fix are a different subset of issues than what is reported in any given RHSA or FEDORA release announcement. And even if we did release kernels in lockstep, no doubt there would still be differing CVE's per distro. (For those of you not familiar with Legacy processes: we normally put multiple CVE issues [maybe as many as dozens of CVE's] into a single bugzilla report for a given .src.rpm component; and we also put multiple distros in a given bugzilla ticket as well, using a "Version" tag of "unspecified" and tracking what distros are being worked on and their statuses via the use of Status Whiteboard entries. For more information about this, you can refer to , and the most recent completed Legacy kernel bug is here in case you're interested: .) I started to suggest to my mentee this method: Have a look at the latest release announcements from Fedora Legacy for the kernels that we maintain, and then look for issues in the usual places (e.g., those resources listed in ) that have come up since we released our latest security-fixed kernels. That would provide a list of CVE's to then put in a new Bugzilla ticket or add to an already-existing ticket that would likely be relevant. But is this enough? Does this method sound workable to you? Are we missing something? Do you have you have some better ideas how to track kernel vulnerabilities to get those vulnerabilities properly listed in a Bugzilla ticket to be worked on? A more general question is this: How do we in Fedora Legacy track vulnerabilities and make sure that we are aware of all the relevant vulnerabilities for the packages that we maintain, and haven't missed something? The fedora-security-list and Josh Bressers are using audit files to track all relevant security vulnerabilities for their sets of packages, which are kept in CVS here, but we here in Fedora Legacy haven't started using this kind of tool yet. Is it time for us to start doing so? If so, are any of you interested in forming some kind of vulnerability tracking team and getting started on such list(s) for the products we maintain? Thanks much in advance! Regards, David Eisenstein From sundaram at fedoraproject.org Fri Jun 2 11:20:58 2006 From: sundaram at fedoraproject.org (Rahul Sundaram) Date: Fri, 02 Jun 2006 16:50:58 +0530 Subject: [Legacy] Mentoring for vulnerability bug tracking -- kernel, and general In-Reply-To: References: Message-ID: <1149247258.4138.3.camel@sundaram.pnq.redhat.com> On Fri, 2006-06-02 at 02:41 -0500, David Eisenstein wrote: > A more general question is this: How do we in Fedora Legacy track > vulnerabilities and make sure that we are aware of all the relevant > vulnerabilities for the packages that we maintain, and haven't missed > something? > > The fedora-security-list and Josh Bressers are using audit files to track > all relevant security vulnerabilities for their sets of packages, which > are kept in CVS here, > > > but we here in Fedora Legacy haven't started using this kind of tool yet. > Is it time for us to start doing so? If so, are any of you interested in > forming some kind of vulnerability tracking team and getting started on > such list(s) for the products we maintain? It seems to me that whatever system used by the Fedora Security Team should be adopted by Fedora Legacy after discussion with the relevant contributors. Rahul From bugzilla at redhat.com Fri Jun 2 15:31:54 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 2 Jun 2006 11:31:54 -0400 Subject: [Bug 193809] CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability In-Reply-To: Message-ID: <200606021531.k52FVso1022872@bugzilla.redhat.com> Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193809 dennis at ausil.us changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|Snort URIContent Rules |CVE-2006-2769 Snort |Detection Evasion |URIContent Rules Detection |Vulnerability |Evasion Vulnerability Status|NEW |CLOSED Resolution| |NEXTRELEASE ------- Additional Comments From dennis at ausil.us 2006-06-02 11:24 EST ------- I've applied the supplied patch. Fixed in 2.4.4-4 Hans would you mind doing an audit of the snort code? this is the second similar vulnerability this year -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From bugzilla at redhat.com Fri Jun 2 20:16:19 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Fri, 2 Jun 2006 16:16:19 -0400 Subject: [Bug 193809] CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability In-Reply-To: Message-ID: <200606022016.k52KGJrT009188@bugzilla.redhat.com> Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193809 dennis at ausil.us changed: What |Removed |Added ---------------------------------------------------------------------------- Status|CLOSED |NEW Keywords| |Reopened Resolution|NEXTRELEASE | ------- Additional Comments From dennis at ausil.us 2006-06-02 16:08 EST ------- turns out that the patch is incomplete. -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From bugzilla at redhat.com Sat Jun 3 13:46:43 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Sat, 3 Jun 2006 09:46:43 -0400 Subject: [Bug 193962] New: CVE-2006-2777 (seamonkey): remote arbitrary code execution vulnerability Message-ID: Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193962 Summary: CVE-2006-2777 (seamonkey): remote arbitrary code execution vulnerability Product: Fedora Extras Version: fc5 Platform: All OS/Version: Linux Status: NEW Severity: high Priority: high Component: seamonkey AssignedTo: kengert at redhat.com ReportedBy: ville.skytta at iki.fi QAContact: extras-qa at fedoraproject.org CC: extras-qa at fedoraproject.org,fedora-security- list at redhat.com Remote arbitrary code execution vulnerability in seamonkey < 1.0.2: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-2777 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From bugzilla at redhat.com Sat Jun 3 13:50:14 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Sat, 3 Jun 2006 09:50:14 -0400 Subject: [Bug 193963] New: CVE-2006-2781 (seamonkey): DOS/arbitrary code execution vuln with vcards Message-ID: Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193963 Summary: CVE-2006-2781 (seamonkey): DOS/arbitrary code execution vuln with vcards Product: Fedora Extras Version: fc5 Platform: All OS/Version: Linux Status: NEW Severity: high Priority: high Component: seamonkey AssignedTo: kengert at redhat.com ReportedBy: ville.skytta at iki.fi QAContact: extras-qa at fedoraproject.org CC: extras-qa at fedoraproject.org,fedora-security- list at redhat.com vcard parsing related DOS/arbitrary code execution in seamonkey < 1.0.2: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-2781 -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From bugzilla at redhat.com Sat Jun 3 18:55:27 2006 From: bugzilla at redhat.com (bugzilla at redhat.com) Date: Sat, 3 Jun 2006 14:55:27 -0400 Subject: [Bug 193809] CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability In-Reply-To: Message-ID: <200606031855.k53ItRxj032440@bugzilla.redhat.com> Please do not reply directly to this email. All additional comments should be made in the comments box of this bug report. Summary: CVE-2006-2769 Snort URIContent Rules Detection Evasion Vulnerability https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193809 ------- Additional Comments From ville.skytta at iki.fi 2006-06-03 14:47 EST ------- FYI: due to rawhide libpcap packaging issues, libpcap may have been statically linked in in the current devel snort package, see bug 193189 comment 2 One possible workaround: BuildRequire both libpcap and libpcap-devel -- Configure bugmail: https://bugzilla.redhat.com/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug, or are watching someone who is. From deisenst at gtw.net Sat Jun 3 19:36:13 2006 From: deisenst at gtw.net (David Eisenstein) Date: Sat, 03 Jun 2006 14:36:13 -0500 Subject: New Mozilla vulnerabilities?? Message-ID: <4481E4AD.4040106@gtw.net> Hello all, Yesterday, I received a notice from US-CERT regarding Technical Cyber Security Alert TA06-153A -- Mozilla Products Contain Multiple Vulnerabilities, (available at ). It mentions a bunch of vulnerabilities (all of which seem to affect Seamonkey, Thunderbird, and Firefox). After looking at each VU#, it appears that none of the announcements mention the Mozilla suite. Also, at least as of last night, none of them mention any CVE #'s. What's going on with this? Are any Mozilla Suite products affected by these vulnerabilities? Some of these sound critical -- and if there are no patches available for mozilla-1.7.13, well, it seems bad! "Several vulnerabilities have been reported in the Mozilla web browser and derived products. More detailed information is available in the individual vulnerability notes, including: "VU#237257 - Mozilla privilege escalation using addSelectionListener A privilege escalation vulnerability exists in the Mozilla addSelectionListener method. This may allow a remote attacker to execute arbitrary code. "VU#421529 - Mozilla contains a buffer overflow vulnerability in crypto.signText() Mozilla products contain a buffer overflow in the crypto.signText() method. This may allow a remote attacker to execute arbitrary code. "VU#575969 - Mozilla may process content-defined setters on object prototypes with elevated privileges Mozilla allows content-defined setters on object prototypes to execute with elevated privileges. This may allow a remote attacker to execute arbitrary code. "VU#243153 - Mozilla may associate persisted XUL attributes with an incorrect URL Mozilla can allow persisted XUL attributes to associate with the wrong URL. This may allow a remote attacker to execute arbitrary code. "VU#466673 - Mozilla contains multiple memory corruption vulnerabilities Mozilla contains several memory corruption vulnerabilities. This may allow a remote attacker to execute arbitrary code." -David From deisenst at gtw.net Sat Jun 3 19:56:21 2006 From: deisenst at gtw.net (David Eisenstein) Date: Sat, 03 Jun 2006 14:56:21 -0500 Subject: Full list of Seamonkey (unpatched Mozilla Suite??) vulnerabilities... Message-ID: <4481E965.3090809@gtw.net> Hi again all, More Seamonkey vulnerabilties... From , there is this list: Fixed in SeaMonkey 1.0.2 ------------------------ Critical - MFSA 2006-43 Privilege escalation using addSelectionListener High - MFSA 2006-42 Web site XSS using BOM on UTF-8 pages High - MFSA 2006-41 File stealing by changing input type (variant) Critical - MFSA 2006-40 Double-free on malformed VCard Low - MFSA 2006-39 "View Image" local resource linking (Windows) Critical - MFSA 2006-38 Buffer overflow in crypto.signText() Critical - MFSA 2006-37 Remote compromise via content-defined setter on object prototypes Critical - MFSA 2006-35 Privilege escalation through XUL persist Moderate - MFSA 2006-34 XSS viewing javascript: frames or images from context menu High - MFSA 2006-33 HTTP response smuggling Critical - MFSA 2006-32 Fixes for crashes with potential memory corruption Moderate - MFSA 2006-31 EvalInSandbox escape (Proxy Autoconfig, Greasemonkey) Similar lists exists for Firefox ("Fixed in Firefox 1.5.0.4") and Thunderbird ("Fixed in Thunderbird 1.5.0.4") vulnerabilities on that same page. Somehow, I suspect that if these vulnerabilities exist in Seamonkey, then many will also exist in Mozilla-1.7.13, in Firefox-1.0.8, and Thunderbird-1.0.8 .... What is the Mozilla Foundation trying to do here? Make zero-day exploits available to malware writers to use against legacy users of Mozilla-1.7.13 Firefox-1.0.8, and Thunderbird-1.0.8 users?!? Is there any coordination among outside maintainers of these legacy packages (since the Mozilla foundation's official policy is that Mozilla-1.7.13 was the end of the line for the Mozilla suite)? Should there be?? Regards, David Eisenstein ps: None of the detailed MSFA's linked to from the known-vulnerabilities page that I looked at had any CVE's listed for them. Does anyone know if any CVE's are assigned for these vulnerabilities? Also, all of the bugzilla.mozilla.org links from the MFSA's seem to be embargoed (at least for me). Does anyone here have access to those bug reports? From deisenst at gtw.net Sat Jun 3 20:08:46 2006 From: deisenst at gtw.net (David Eisenstein) Date: Sat, 03 Jun 2006 15:08:46 -0500 Subject: [Fwd: Re: [Bug 193962] New: CVE-2006-2777 (seamonkey): remote arbitrary code execution vulnerability] Message-ID: <4481EC4E.8030803@gtw.net> Oops, used wrong "From" address... trying again ... sorry 'bout that. -David -------- Original Message -------- Subject: Re: [Bug 193962] New: CVE-2006-2777 (seamonkey): remote arbitrary From: Dave Eisenstein To: fedora-security-list at redhat.com Hey Ville, How did you get news of the existence of CVE-2006-2777? Regards, David Eisenstein bugzilla at redhat.com wrote: > > https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=193962 > > Summary: CVE-2006-2777 (seamonkey): remote arbitrary code > execution vulnerability > Product: Fedora Extras > Version: fc5 > Platform: All > OS/Version: Linux > Status: NEW > Severity: high > Priority: high > Component: seamonkey > AssignedTo: kengert at redhat.com > ReportedBy: ville.skytta at iki.fi > QAContact: extras-qa at fedoraproject.org > CC: extras-qa at fedoraproject.org,fedora-security- > list at redhat.com > > Remote arbitrary code execution vulnerability in seamonkey < 1.0.2: > http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-2777 > From ville.skytta at iki.fi Sat Jun 3 21:43:14 2006 From: ville.skytta at iki.fi (Ville =?ISO-8859-1?Q?Skytt=E4?=) Date: Sun, 04 Jun 2006 00:43:14 +0300 Subject: [Fwd: Re: [Bug 193962] New: CVE-2006-2777 (seamonkey): remote arbitrary code execution vulnerability] In-Reply-To: <4481EC4E.8030803@gtw.net> References: <4481EC4E.8030803@gtw.net> Message-ID: <1149370994.2853.24.camel@localhost.localdomain> On Sat, 2006-06-03 at 15:08 -0500, David Eisenstein wrote: > How did you get news of the existence of CVE-2006-2777? >From the RSS feeds available at http://nvd.nist.gov/download.cfm#RSS From bressers at redhat.com Sun Jun 4 00:34:32 2006 From: bressers at redhat.com (Josh Bressers) Date: Sat, 03 Jun 2006 20:34:32 -0400 Subject: Full list of Seamonkey (unpatched Mozilla Suite??) vulnerabilities... In-Reply-To: Your message of "Sat, 03 Jun 2006 14:56:21 CDT." <4481E965.3090809@gtw.net> Message-ID: <200606040034.k540YWJA019896@devserv.devel.redhat.com> > > Similar lists exists for Firefox ("Fixed in Firefox 1.5.0.4") and > Thunderbird ("Fixed in Thunderbird 1.5.0.4") vulnerabilities on that same page. > > Somehow, I suspect that if these vulnerabilities exist in Seamonkey, then > many will also exist in Mozilla-1.7.13, in Firefox-1.0.8, and > Thunderbird-1.0.8 .... Some of them do, some of them don't. I don't have a complete list yet. I've tracked down the most critical issues. Take a look at these bugs for the CVE ids I've identified. Mozilla: 193906 Firefox: 193895 We're working on a patch for those particular issues. Thunderbird has no critical bugs. > > What is the Mozilla Foundation trying to do here? Make zero-day exploits > available to malware writers to use against legacy users of Mozilla-1.7.13 > Firefox-1.0.8, and Thunderbird-1.0.8 users?!? Is there any coordination > among outside maintainers of these legacy packages (since the Mozilla > foundation's official policy is that Mozilla-1.7.13 was the end of the line > for the Mozilla suite)? Should there be?? The Mozilla Foundation doesn't care about users running the older versions of the suite and Firefox. I could go into detail about their mishandling of this, but I'd rather not. They have no interest in coordinating with vendors in any way. They've done a very poor job communicating the EOL of their products. I personally consider releasing a critical update on a Friday very irresponsible. I've let them know this more than once, which has been ignored. > > Regards, > > David Eisenstein > > ps: None of the detailed MSFA's linked to from the known-vulnerabilities > page that I looked at had any CVE's listed for them. Does anyone know if > any CVE's are assigned for these vulnerabilities? Also, all of the > bugzilla.mozilla.org links from the MFSA's seem to be embargoed (at least > for me). Does anyone here have access to those bug reports? All issues have CVE ids. I'm attaching the CVE mails that detail these. -- JB From coley at mitre.org Fri Jun 2 18:01:38 2006 From: coley at mitre.org (coley at mitre.org) Date: Fri, 2 Jun 2006 14:01:38 -0400 (EDT) Subject: [CVENEW] New CVE CANs: 2006/06/02 14:00 ; count=4 Message-ID: <200606021801.k52I1cba021249@cairo.mitre.org> ====================================================== Name: CVE-2006-2775 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2775 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20060602 Category: Reference: CONFIRM:http://www.mozilla.org/security/announce/2006/mfsa2006-35.html Reference: CERT-VN:VU#243153 Reference: URL:http://www.kb.cert.org/vuls/id/243153 Mozilla Firefox and Thunderbird before 1.5.0.4 associates XZUL attributes with the wrong URL under certain unspecified circumstances, which might allow remote attackers to bypass restrictions by causing a persisted string to be associated with the wrong URL. ====================================================== Name: CVE-2006-2776 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2776 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20060602 Category: Reference: CONFIRM:http://www.mozilla.org/security/announce/2006/mfsa2006-37.html Reference: CERT-VN:VU#575969 Reference: URL:http://www.kb.cert.org/vuls/id/575969 Certain privileged UI code in Mozilla Firefox and Thunderbird before 1.5.0.4 calls content-defined setters on an object prototype, which allows remote attackers to execute code at a higher privilege than intended. ====================================================== Name: CVE-2006-2777 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2777 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20060602 Category: Reference: CONFIRM:http://www.mozilla.org/security/announce/2006/mfsa2006-43.html Reference: CERT-VN:VU#237257 Reference: URL:http://www.kb.cert.org/vuls/id/237257 Unspecified vulnerability in Mozilla Firefox before 1.5.0.4 and SeaMonkey before 1.0.2 allows remote attackers to execute arbitrary code by using the nsISelectionPrivate interface of the Selection object to add a SelectionListener and create notifications that are executed in a privileged context. ====================================================== Name: CVE-2006-2778 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2778 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20060602 Category: Reference: CONFIRM:http://www.mozilla.org/security/announce/2006/mfsa2006-38.html Reference: CERT-VN:VU#421529 Reference: URL:http://www.kb.cert.org/vuls/id/421529 The crypto.signText function in Mozilla Firefox and Thunderbird before 1.5.0.4 allows remote attackers to execute arbitrary code via certain optional Certificate Authority name arguments, which causes an invalid array index and triggers a buffer overflow. From coley at mitre.org Fri Jun 2 19:01:37 2006 From: coley at mitre.org (coley at mitre.org) Date: Fri, 2 Jun 2006 15:01:37 -0400 (EDT) Subject: [CVENEW] New CVE CANs: 2006/06/02 15:00 ; count=7 Message-ID: <200606021901.k52J1bOv022240@cairo.mitre.org> ====================================================== Name: CVE-2006-2779 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2779 Final-Decision: Interim-Decision: Modified: Proposed: Assigned: 20060602 Category: Reference: CONFIRM:http://www.mozilla.org/security/announce/2006/mfsa2006-32.html Reference: CERT-VN:VU#466673 Reference: URL:http://www.kb.cert.org/vuls/id/466673 Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via (1) nested