[ATrpms-devel] [Fwd: (AUSCERT ESB-2007.1008) [Linux] - Updated wpa_supplicant package fixes remote denial of service]
Axel Thimm
Axel.Thimm at ATrpms.net
Fri Dec 14 17:27:05 CET 2007
On Fri, Dec 14, 2007 at 03:48:51PM +1100, Alex Kruchkoff wrote:
> Hi,
>
> Not sure if atrpms package is affected, just want to let you know.
Thanks! I checked and indeed ATrpms' packages are not affected as there
was no TSF code in driver_wext.c yet.
In general I think no stable-released tarball of wpa_supplicant seems
to be affected, but some have been using the development 0.6.x series
(Debian and Mandriva).
> Cheers
> Alex
> From: AusCERT <auscert at auscert.org.au>
> Subject: (AUSCERT ESB-2007.1008) [Linux] - Updated wpa_supplicant package
> fixes remote denial of service
> To: auscert-subscriber at auscert.org.au
> Date: Fri, 14 Dec 2007 09:32:24 +1000 (EST)
> X-Account-Key: account9
> X-Sieve: CMU Sieve 2.2
> X-Spam-Score: -1.436
> X-Spam-Level:
> X-Spam-Status: No, score=-1.436 required=5 tests=[ALL_TRUSTED=-1.44, AWL=0.004]
> Reply-To: auscert at auscert.org.au
> X-Precedence: bulk
>
> ===========================================================================
> AUSCERT External Security Bulletin Redistribution
>
> ESB-2007.1008 -- [Linux]
> Updated wpa_supplicant package fixes remote denial of service
> 14 December 2007
>
> ===========================================================================
>
> AusCERT Security Bulletin Summary
> ---------------------------------
>
> Product: wpa_supplicant 0.6.0 and earlier
> Publisher: Mandriva Linux
> Operating System: Linux variants
> Impact: Denial of Service
> Access: Remote/Unauthenticated
> CVE Names: CVE-2007-6025
>
> Original Bulletin:
> http://www.mandriva.com/en/security/advisories?name=MDKSA-2007:245
>
> Comment: This advisory references vulnerabilities in products which run
> on platforms other than Mandriva. It is recommended that
> administrators running wpa_supplicant check for an updated
> version of the software for their operating system.
>
> This vulnerability does not appear to affect Red Hat Linux.
>
> --------------------------BEGIN INCLUDED TEXT--------------------
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> _______________________________________________________________________
>
> Mandriva Linux Security Advisory MDKSA-2007:245
> http://www.mandriva.com/security/
> _______________________________________________________________________
>
> Package : wpa_supplicant
> Date : December 13, 2007
> Affected: 2008.0
> _______________________________________________________________________
>
> Problem Description:
>
> Stack-based buffer overflow in driver_wext.c in wpa_supplicant
> 0.6.0 allows remote attackers to cause a denial of service (crash)
> via crafted TSF data.
>
> Updated package fixes this issue.
> _______________________________________________________________________
>
> References:
>
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6025
> _______________________________________________________________________
>
> Updated Packages:
>
> Mandriva Linux 2008.0:
> 80c2dc52d42fb324f6ff90fcfe02b9fa 2008.0/i586/wpa_gui-0.6.0-1.1mdv2008.0.i586.rpm
> 0ec22d8e71719af986748a86ee4063ce 2008.0/i586/wpa_supplicant-0.6.0-1.1mdv2008.0.i586.rpm
> 18581ca13cf1758016bfaf52a0ea4992 2008.0/SRPMS/wpa_supplicant-0.6.0-1.1mdv2008.0.src.rpm
>
> Mandriva Linux 2008.0/X86_64:
> 677b536c2f630585c2df72a832aee497 2008.0/x86_64/wpa_gui-0.6.0-1.1mdv2008.0.x86_64.rpm
> 0c87ce95a9432518480ccdc7eed168bb 2008.0/x86_64/wpa_supplicant-0.6.0-1.1mdv2008.0.x86_64.rpm
> 18581ca13cf1758016bfaf52a0ea4992 2008.0/SRPMS/wpa_supplicant-0.6.0-1.1mdv2008.0.src.rpm
> _______________________________________________________________________
>
> To upgrade automatically use MandrivaUpdate or urpmi. The verification
> of md5 checksums and GPG signatures is performed automatically for you.
>
> All packages are signed by Mandriva for security. You can obtain the
> GPG public key of the Mandriva Security Team by executing:
>
> gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
>
> You can view other update advisories for Mandriva Linux at:
>
> http://www.mandriva.com/security/advisories
>
> If you want to report vulnerabilities, please contact
>
> security_(at)_mandriva.com
> _______________________________________________________________________
>
> Type Bits/KeyID Date User ID
> pub 1024D/22458A98 2000-07-10 Mandriva Security Team
> <security*mandriva.com>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.7 (GNU/Linux)
>
> iD8DBQFHYXedmqjQ0CJFipgRAhPNAJsH5R9sOhbryDMXZr2ZidM6EofWewCg2CHm
> DI6aimKhL9T+IazFIlxpxkk=
> =Ue4m
> -----END PGP SIGNATURE-----
>
> --------------------------END INCLUDED TEXT--------------------
>
> You have received this e-mail bulletin as a result of your organisation's
> registration with AusCERT. The mailing list you are subscribed to is
> maintained within your organisation, so if you do not wish to continue
> receiving these bulletins you should contact your local IT manager. If
> you do not know who that is, please send an email to auscert at auscert.org.au
> and we will forward your request to the appropriate person.
>
> NOTE: Third Party Rights
> This security bulletin is provided as a service to AusCERT's members. As
> AusCERT did not write the document quoted above, AusCERT has had no control
> over its content. The decision to follow or act on information or advice
> contained in this security bulletin is the responsibility of each user or
> organisation, and should be considered in accordance with your organisation's
> site policies and procedures. AusCERT takes no responsibility for consequences
> which may arise from following or acting on information or advice contained in
> this security bulletin.
>
> NOTE: This is only the original release of the security bulletin. It may
> not be updated when updates to the original are made. If downloading at
> a later date, it is recommended that the bulletin is retrieved directly
> from the author's website to ensure that the information is still current.
>
> Contact information for the authors of the original document is included
> in the Security Bulletin above. If you have any questions or need further
> information, please contact them directly.
>
> Previous advisories and external security bulletins can be retrieved from:
>
> http://www.auscert.org.au/render.html?cid=1980
>
> If you believe that your computer system has been compromised or attacked in
> any way, we encourage you to let us know by completing the secure National IT
> Incident Reporting Form at:
>
> http://www.auscert.org.au/render.html?it=3192
>
> ===========================================================================
> Australian Computer Emergency Response Team
> The University of Queensland
> Brisbane
> Qld 4072
>
> Internet Email: auscert at auscert.org.au
> Facsimile: (07) 3365 7031
> Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
> AusCERT personnel answer during Queensland business hours
> which are GMT+10:00 (AEST).
> On call after hours for member emergencies only.
> ===========================================================================
>
>
> _______________________________________________
> atrpms-devel mailing list
> atrpms-devel at atrpms.net
> http://lists.atrpms.net/mailman/listinfo/atrpms-devel
--
Axel.Thimm at ATrpms.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.atrpms.net/pipermail/atrpms-devel/attachments/20071214/ca5135c3/attachment.bin
More information about the atrpms-devel
mailing list