| 1 |
neilm |
1686 |
----------------------------------------------------------------------------- |
| 2 |
|
|
Debian Testing Security Advisory DTSA-6-1 http://secure-testing.debian.net |
| 3 |
|
|
secure-testing-team@lists.alioth.debian.org Neil McGovern |
| 4 |
|
|
August 28th, 2005 |
| 5 |
|
|
----------------------------------------------------------------------------- |
| 6 |
|
|
|
| 7 |
|
|
Package : cgiwrap |
| 8 |
|
|
Vulnerability : multiple vulnerabilities |
| 9 |
|
|
Problem-Type : remote |
| 10 |
|
|
Debian-specific: yes,no |
| 11 |
|
|
|
| 12 |
|
|
Javier Fernández-Sanguino Peña discovered various vulnerabilities in cgiwrap: |
| 13 |
|
|
|
| 14 |
|
|
Minimum UID does not include all system users |
| 15 |
|
|
|
| 16 |
|
|
The CGIwrap program will not seteuid itself to uids below the 'minimum' uid |
| 17 |
|
|
to prevent scripts from being misused to compromise the system. However, |
| 18 |
|
|
the Debian package sets the minimum uid to 100 when it should be 1000. |
| 19 |
|
|
|
| 20 |
|
|
CGIs can be used to disclose system information |
| 21 |
|
|
|
| 22 |
|
|
The cgiwrap (and php-cgiwrap) package installs some debugging CGIs |
| 23 |
|
|
(actually symbolink links, which link to cgiwrap and are called 'cgiwrap' |
| 24 |
|
|
and 'nph-cgiwrap' or link to php-cgiwrap). These CGIs should not be |
| 25 |
|
|
installed in production environments as they disclose internal and |
| 26 |
|
|
potentially sensible information. |
| 27 |
|
|
|
| 28 |
|
|
For the testing distribution (etch) this is fixed in version |
| 29 |
|
|
3.9-3.0etch1. |
| 30 |
|
|
|
| 31 |
|
|
For the unstable distribution (sid) this is fixed in version |
| 32 |
|
|
3.9-3.1. |
| 33 |
|
|
|
| 34 |
|
|
This upgrade is encouraged if you use cgiwrap. |
| 35 |
|
|
|
| 36 |
|
|
The Debian testing security team does not track security issues for the |
| 37 |
|
|
stable distribution (woody). If stable is vulnerable, the Debian security |
| 38 |
|
|
team will make an announcement once a fix is ready. |
| 39 |
|
|
|
| 40 |
|
|
Upgrade Instructions |
| 41 |
|
|
-------------------- |
| 42 |
|
|
|
| 43 |
|
|
To use the Debian testing security archive, add the following lines to |
| 44 |
|
|
your /etc/apt/sources.list: |
| 45 |
|
|
|
| 46 |
|
|
deb http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free |
| 47 |
|
|
deb-src http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free |
| 48 |
|
|
|
| 49 |
|
|
The archive signing key can be downloaded from |
| 50 |
|
|
http://secure-testing.debian.net/ziyi-2005-7.asc |
| 51 |
|
|
|
| 52 |
|
|
To install the update, run this command as root: |
| 53 |
|
|
If you use cgiwrap: |
| 54 |
|
|
apt-get update && apt-get install cgiwrap |
| 55 |
|
|
If you use php-cgiwrap: |
| 56 |
|
|
apt-get update && apt-get install php-cgiwrap |
| 57 |
|
|
|
| 58 |
|
|
For further information about the Debian testing security team, please refer |
| 59 |
|
|
to http://secure-testing.debian.net/ |
| 60 |
|
|
|
Parent Directory
| 
Revision Log