WINDOWS CENTER: ubuntu-security-announce Digest, Vol 53, Issue 6

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-724-1] Squid vulnerability (Jamie Strandboge)
2. [USN-725-1] KMail vulnerability (Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Thu, 26 Feb 2009 06:28:55 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-724-1] Squid vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20090226122855.GD6712@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-724-1 February 25, 2009
squid vulnerability
CVE-2009-0478
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.10:
squid 2.7.STABLE3-1ubuntu2.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

Joshua Morin, Mikko Varpiola and Jukka Taimisto discovered that Squid did
not properly validate the HTTP version when processing requests. A remote
attacker could exploit this to cause a denial of service (assertion failure).

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1.diff.gz
Size/MD5: 303042 9132293f589a71ae3f771e1ae6de30f1
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1.dsc
Size/MD5: 1252 6953f88d6f4825daabd9e77bd0fa1a88
http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3.orig.tar.gz
Size/MD5: 1782040 a4d7608696e2b617aa5853c7d23e25b0

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid-common_2.7.STABLE3-1ubuntu2.1_all.deb
Size/MD5: 495876 b6d1e76b140c792297c14382a06ed3e3

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1_amd64.deb
Size/MD5: 771610 7f2ca95b0497cc23f0bf26b7a6503cc7
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1ubuntu2.1_amd64.deb
Size/MD5: 119880 27ff06a902debe143acb7b3959fb1c52

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1_i386.deb
Size/MD5: 695708 312c710ebdb46e3017b02cb672d14524
http://security.ubuntu.com/ubuntu/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1ubuntu2.1_i386.deb
Size/MD5: 118638 f2f2f698523d49d8971c7a22faebc427

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1_lpia.deb
Size/MD5: 694080 6720b3aca93aabb7600a1a2c2f699af5
http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1ubuntu2.1_lpia.deb
Size/MD5: 118550 7484981bd7c4c8b6361362e98d5d1631

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1_powerpc.deb
Size/MD5: 777958 b9d530e92ad4638fb8d169ef55eb33f4
http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1ubuntu2.1_powerpc.deb
Size/MD5: 120446 9899cd403bbca3e0e6f5a936cd2d9955

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/s/squid/squid_2.7.STABLE3-1ubuntu2.1_sparc.deb
Size/MD5: 719088 2781d6fd1c7adc0b76aa12670ac1abb5
http://ports.ubuntu.com/pool/universe/s/squid/squid-cgi_2.7.STABLE3-1ubuntu2.1_sparc.deb
Size/MD5: 119398 8a26b4da728c31d7bd116666191575b2

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20090226/094bd2c3/attachment-0001.pgp

------------------------------

Message: 2
Date: Thu, 26 Feb 2009 23:07:55 -0600
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-725-1] KMail vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20090227050755.GP6712@severus.strandboge.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-725-1 February 26, 2009
kdepim vulnerability
https://launchpad.net/bugs/332069
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
kmail 4:3.5.2-0ubuntu6.1

Ubuntu 7.10:
kmail 4:3.5.7enterprise20070926-0ubuntu2.2

Ubuntu 8.04 LTS:
kmail 4:3.5.10-0ubuntu1~hardy3.1

Ubuntu 8.10:
kmail 4:4.1.4-0ubuntu1~intrepid2.1

After a standard system upgrade you need to restart KMail to effect
the necessary changes.

Details follow:

It was discovered that Kmail did not adequately prevent execution of arbitrary
code when a user clicked on a URL to an executable within an HTML mail. If a
user clicked on a malicious URL and chose to execute the file, a remote
attacker could execute arbitrary code with user privileges. This update changes
KMail's behavior to instead launch a helper program to view the file if the
user chooses to execute such a link.

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/k/kdepim/kdepim_3.5.2-0ubuntu6.1.diff.gz
Size/MD5: 315514 4a27ae64fd67b04c9724af23e9904432
http://security.ubuntu.com/ubuntu/pool/main/k/kdepim/kdepim_3.5.2-0ubuntu6.1.dsc
Size/MD5: 1688 114e959d7724b4772009cc99d8f5b2e3
http://security.ubuntu.com/ubuntu/pool/main/k/kdepim/kdepim_3.5.2.orig.tar.gz
Size/MD5: 16304136 dc9ca1007aeb1ab9c916cd0bc2ba9878

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/universe/k/kdepim/kdepim-doc-html_3.5.2-0ubuntu6.1_all.deb
Size/MD5: 404808 8b12c4d1b36ec909bcc2f48b8a00c42f
http://security.ubuntu.com/ubuntu/pool/universe/k/kdepim/kdepim-doc_3.5.2-0ubuntu6.1_all.deb
Size/MD5: 20883782 2358784b072f37afa8b9eb667ecf118c
http://security.ubuntu.com/ubuntu/pool/universe/k/kdepim/kdepim_3.5.2-0ubuntu6.1_all.deb
Size/MD5: 19618 81afe041c34db923798642c59262b197

amd64 architecture (Athlon64, Opteron, EM64T Xeon):