| 1 |
-----------------------------------------------------------------------------
|
| 2 |
Debian Testing Security Advisory DTSA-6-1 http://secure-testing.debian.net
|
| 3 |
secure-testing-team@lists.alioth.debian.org Neil McGovern
|
| 4 |
August 28th, 2005
|
| 5 |
-----------------------------------------------------------------------------
|
| 6 |
|
| 7 |
Package : cgiwrap
|
| 8 |
Vulnerability : multiple vulnerabilities
|
| 9 |
Problem-Type : remote
|
| 10 |
Debian-specific: yes,no
|
| 11 |
|
| 12 |
Javier Fernández-Sanguino Peña discovered various vulnerabilities in cgiwrap:
|
| 13 |
|
| 14 |
Minimum UID does not include all system users
|
| 15 |
|
| 16 |
The CGIwrap program will not seteuid itself to uids below the 'minimum' uid
|
| 17 |
to prevent scripts from being misused to compromise the system. However,
|
| 18 |
the Debian package sets the minimum uid to 100 when it should be 1000.
|
| 19 |
|
| 20 |
CGIs can be used to disclose system information
|
| 21 |
|
| 22 |
The cgiwrap (and php-cgiwrap) package installs some debugging CGIs
|
| 23 |
(actually symbolink links, which link to cgiwrap and are called 'cgiwrap'
|
| 24 |
and 'nph-cgiwrap' or link to php-cgiwrap). These CGIs should not be
|
| 25 |
installed in production environments as they disclose internal and
|
| 26 |
potentially sensible information.
|
| 27 |
|
| 28 |
For the testing distribution (etch) this is fixed in version
|
| 29 |
3.9-3.0etch1.
|
| 30 |
|
| 31 |
For the unstable distribution (sid) this is fixed in version
|
| 32 |
3.9-3.1.
|
| 33 |
|
| 34 |
This upgrade is encouraged if you use cgiwrap.
|
| 35 |
|
| 36 |
The Debian testing security team does not track security issues for the
|
| 37 |
stable distribution (woody). If stable is vulnerable, the Debian security
|
| 38 |
team will make an announcement once a fix is ready.
|
| 39 |
|
| 40 |
Upgrade Instructions
|
| 41 |
--------------------
|
| 42 |
|
| 43 |
To use the Debian testing security archive, add the following lines to
|
| 44 |
your /etc/apt/sources.list:
|
| 45 |
|
| 46 |
deb http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free
|
| 47 |
deb-src http://secure-testing.debian.net/debian-security-updates etch-proposed-updates/security-updates main contrib non-free
|
| 48 |
|
| 49 |
The archive signing key can be downloaded from
|
| 50 |
http://secure-testing.debian.net/ziyi-2005-7.asc
|
| 51 |
|
| 52 |
To install the update, run this command as root:
|
| 53 |
If you use cgiwrap:
|
| 54 |
apt-get update && apt-get install cgiwrap
|
| 55 |
If you use php-cgiwrap:
|
| 56 |
apt-get update && apt-get install php-cgiwrap
|
| 57 |
|
| 58 |
For further information about the Debian testing security team, please refer
|
| 59 |
to http://secure-testing.debian.net/
|
| 60 |
|
Parent Directory
| 
Revision Log