Mandriva Security

MDVSA-2008:233: libcdaudio

A heap overflow was found in the CDDB retrieval code of libcdaudio,
which could result in the execution of arbitrary code (CVE-2008-5030).

In addition, the fixes for CVE-2005-0706 were not applied to newer
libcdaudio packages as shipped with Mandriva Linux, so the patch to fix
that issue has been applied to 2008.1 and 2009.0 (this was originally
fixed in MDKSA-2005:075). This issue is a buffer overflow flaw found
by Joseph VanAndel. Corporate 3.0 has this fix already applied.

The updated packages have been patched to prevent these issues.

MDVA-2008:177: lirc

The LIRC packages included with Mandriva Linux 2008 and Mandriva Linux
2008 Spring did not include the 'commandir' module, which is necessary
(along with the 'lirc_cmdir' module) to properly support CommandIR
remote controls.

These updated packages do include the module.

MDVSA-2008:232: dovecot

The ACL plugin in dovecot prior to version 1.1.4 treated negative
access rights as though they were positive access rights, which allowed
attackers to bypass intended access restrictions (CVE-2008-4577).

The ACL plugin in dovecot prior to version 1.1.4 allowed attackers to
bypass intended access restrictions by using the 'k' right to create
unauthorized 'parent/child/child' mailboxes (CVE-2008-4578).

In addition, two bugs were discovered in the dovecot package shipped
with Mandriva Linux 2009.0. The default permissions on the dovecot.conf
configuration file were too restrictive, which prevents the use of
dovecot's 'deliver' command as a non-root user. Secondly, dovecot
should not start until after ntpd, if ntpd is active, because if ntpd
corrects the time backwards while dovecot is running, dovecot will
quit automatically, with the log message 'Time just moved backwards
by X seconds. This might cause a lot of problems, so I'll just kill
myself now.' The update resolves both these problems. The default
permissions on dovecot.conf now allow the 'deliver' command to read the
file. Note that if you edited dovecot.conf at all prior to installing
the update, the new permissions may not be applied. If you find the
'deliver' command still does not work following the update, please
run these commands as root:

# chmod 0640 /etc/dovecot.conf
# chown root:mail /etc/dovecot.conf

Dovecot's initialization script now configures it to start after the
ntpd service, to ensure ntpd resetting the clock does not interfere
with Dovecot operation.

This package corrects the above-noted bugs and security issues by
upgrading to the latest dovecot 1.1.6, which also provides additional
bug fixes.

MDVSA-2008:220-1: kernel

Some vulnerabilities were discovered and corrected in the Linux
2.6 kernel:

The snd_seq_oss_synth_make_info function in
sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux
kernel before 2.6.27-rc2 does not verify that the device number is
within the range defined by max_synthdev before returning certain
data to the caller, which allows local users to obtain sensitive
information. (CVE-2008-3272)

Unspecified vulnerability in the 32-bit and 64-bit emulation in the
Linux kernel 2.6.9, 2.6.18, and probably other versions allows local
users to read uninitialized memory via unknown vectors involving a
crafted binary. (CVE-2008-0598)

The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c
in the vfs implementation in the Linux kernel before 2.6.25.15 does
not prevent creation of a child dentry for a deleted (aka S_DEAD)
directory, which allows local users to cause a denial of service
(overflow of the UBIFS orphan area) via a series of attempted file
creations within deleted directories. (CVE-2008-3275)

Integer overflow in the sctp_setsockopt_auth_key function in
net/sctp/socket.c in the Stream Control Transmission Protocol (sctp)
implementation in the Linux kernel 2.6.24-rc1 through 2.6.26.3 allows
remote attackers to cause a denial of service (panic) or possibly have
unspecified other impact via a crafted sca_keylength field associated
with the SCTP_AUTH_KEY option. (CVE-2008-3525)

fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23
does not properly zero out the dio struct, which allows local users
to cause a denial of service (OOPS), as demonstrated by a certain
fio test. (CVE-2007-6716)

fs/open.c in the Linux kernel before 2.6.22 does not properly strip
setuid and setgid bits when there is a write to a file, which allows
local users to gain the privileges of a different group, and obtain
sensitive information or possibly have unspecified other impact,
by creating an executable file in a setgid directory through the (1)
truncate or (2) ftruncate function in conjunction with memory-mapped
I/O. (CVE-2008-4210)

Additionaly, support for Intel's ICH9 controller was added, and 'tg3'
driver was updated to version 3.71b.

To update your kernel, please follow the directions located at:

http://www.mandriva.com/en/security/kernelupdate

Update:

Support for Intel's ICH9 controller and the updated 'tg3' driver were
actually missing in the previous update, this new update adds them.

MDVA-2008:176: mdadm

mdadm would crash during bootup when trying to activate several raid10
devices, dropping the system in maintenance mode, where you had to
manually reactivate the missing raid10 sets in order to continue
the boot.

The updated mdadm fixes this issue, allowing systems with raid10 to
boot normally.

MDVA-2008:175: urpmi

Since version 6.14.9 Urpmi would spontaneously un-ignore any updated
medias.

This update fixes that regression.

MDVA-2008:174: kbd

This update fixes errors in be-latin1, be2-latin1, ro-comma,
ro-academic, and gr-utf8 keymaps, shipped on Mandriva Linux 2008
Spring and Mandriva Linux 2009.

MDVA-2008:173: imwheel

Under certain conditions, imwheel would enter an infinite loop and
force the X server to consume a lot of CPU time, rendering the system
unusable.

This update fixes the issue.

MDVA-2008:172: kdebase

The kdeeject command did not work, which resulted in a user being
able to unmount, but not eject, removable devices. This package
update corrects the issue.

MDVSA-2008:231: libxml2

Drew Yao of the Apple Product Security Team found two flaws in libxml2.
The first is a denial of service flaw in libxml2's XML parser. If an
application linked against libxml2 were to process certain malformed
XML content, it cause the application to enter an infinite loop
(CVE-2008-4225).

The second is an integer overflow that caused a heap-based buffer
overflow in libxml2's XML parser. If an application linked against
libxml2 were to process certain malformed XML content, it could
cause the application to crash or possibly execute arbitrary code
(CVE-2008-4226).

The updated packages have been patched to correct these issues.