Security World: [SECURITY] [DSA 1688-2] New courier-authlib packages fix regression

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1688-2 security@debian.org
http://www.debian.org/security/ Steffen Joeris
December 22, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : courier-authlib
Vulnerability : SQL injection
Problem type : local/remote XXX
Debian-specific: no
CVE Id(s) : CVE-2008-2380 CVE-2008-2667

The update of courier-authlib in DSA 1688-1 caused a regression with
setups that do not use mail addresses for authentification. This update
fixes this regression. For reference, the full advisory text is below.

Two SQL injection vulnerabilities have beein found in courier-authlib,
the courier authentification library. The MySQL database interface used
insufficient escaping mechanisms when constructing SQL statements,
leading to SQL injection vulnerabilities if certain charsets are used
(CVE-2008-2380). A similar issue affects the PostgreSQL database
interface (CVE-2008-2667).

For the stable distribution (etch), these problems have been fixed in
version 0.58-4+etch3.

For the testing distribution (lenny) and the unstable distribution
(sid), these problems have been fixed in version 0.61.0-1+lenny1.

We recommend that you upgrade your courier-authlib packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch3.dsc
Size/MD5 checksum: 970 eea6bc2a491339d1b06f0d9891906a4f
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58.orig.tar.gz
Size/MD5 checksum: 3342115 75b5b2b72d550048ed1b29e687a1a60d
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch3.diff.gz
Size/MD5 checksum: 44339 c051936ba955b33ac17bed1a7a062ed6

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-dev_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 150150 c1fb3322ef09b7e5592cdb2e0e972e8b
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authdaemon_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 6982 fdcfcee4cf7e92463d80fc52c31544c6
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-pipe_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 8958 d0d7c0c186dc70bf163fb56efdac13e0
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 92768 ad72b16c890b88f5878b044ba634d743
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-ldap_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 23274 072c28b73f51ec0c0853d2235cc43f7a
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-postgresql_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 20456 9946cb154a436ad185e6ac59d219ee0d
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-mysql_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 20384 add1d85c7f9f1f951110112e57dd941c
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-userdb_0.58-4+etch3_alpha.deb
Size/MD5 checksum: 39140 eb641b37baca55b34824e6ccc9123604

amd64 architecture (AMD x86_64 (AMD64))

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-dev_0.58-4+etch3_mips.deb
Size/MD5 checksum: 124734 db5ac1f173860a9a8b0abdb81899eaf5
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-ldap_0.58-4+etch3_mips.deb
Size/MD5 checksum: 21922 f905ce6714943afc4f99bde253ad06dd
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib_0.58-4+etch3_mips.deb
Size/MD5 checksum: 81866 342671c976b85df7f9cbdcd4e9944fbc
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authdaemon_0.58-4+etch3_mips.deb
Size/MD5 checksum: 6980 67f98c77898ebe0ad905c87a22df3765
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-pipe_0.58-4+etch3_mips.deb
Size/MD5 checksum: 8212 8f102b2250c3d69e28dcc72a50e660b9
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-postgresql_0.58-4+etch3_mips.deb
Size/MD5 checksum: 19488 a7fc20bcbaafd8d6f0053b41b2e07e5e
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-mysql_0.58-4+etch3_mips.deb
Size/MD5 checksum: 19506 782e5bf2a2ba56eba4f9836ffae51125
http://security.debian.org/pool/updates/main/c/courier-authlib/courier-authlib-userdb_0.58-4+etch3_mips.deb
Size/MD5 checksum: 35230 113b19cb398cdd1d9599a0cc21887e0c

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJJUCBIAAoJEL97/wQC1SS+BVsH/335R5WqInHRraHk0JE3Owzt
qV5xBgjWXnU7cxKEvsPmvhYanJs6kjd24S5d9GOQVVZhKS6zC6ToH+u7GwOnYChR
+kLdtLziYSx8mcZUtrjWeL/iYaE3xClRTROgfYUXrMJ2RawU4kUgx7nxTPwF76ei
axmURM4ImgoxVF7fMRRIoX/pgvl3dGoUPdzCepxTrrdjqfUhXZCaQ8l7xikKVcGV
71oM7szbhZL6QIBxY2G4Oa/LByuj1UOSfo9y0M4+V46KyFYBjjKbzbqNpo2agLU+
7LR0mtk7dYvVDDdr/gDBcTJ0y8UCkrJ3SVTJqHVXHx8CrDikc5IfOqEd+1sWA1g=
=0+3H
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Search This Blog

Monday, December 22, 2008

[SECURITY] [DSA 1688-2] New courier-authlib packages fix regression

No comments: