The Mail Fetch plugin in SquirrelMail 1.4.20 and earlier allows remote authenticated users to bypass firewall restrictions and use SquirrelMail as a proxy to scan internal networks via a modified POP3 port number.

Directory traversal vulnerability in slp.c in the MSN protocol plugin in libpurple in Pidgin 2.6.4 and Adium 1.3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in an application/x-msnmsgrp2p MSN emoticon (aka custom smiley) request, a related issue to CVE-2004-0122. NOTE: it could be argued that this is resultant from a vulnerability in which an emoticon download request is processed even without a preceding text/x-mms-emoticon message that announced availability of the emoticon.

The "distcheck" Makefile rule in coreutils 5.2.1 through to 8.1 did use unsafe (predictable) temporary directory location for performing own tasks. This might allow local attacker to conduct symlink attacks under certain circumstances.

Upstream patch: --------------- http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5

Credit: ------- Jim Meyering

CVE Request: ------------ http://www.openwall.com/lists/oss-security/2009/12/08/4

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

A security flaw was found in the WebKit's Cross-Origin Resource Sharing (CORS) implementation. Quoting exact details from the WebKit advisory:

Before allowing a page from one origin to access a resource in another origin, WebKit sends a preflight request, to determine if the origin server for the resource being accessed will allow the resource to be shared. WebKit includes custom HTTP headers specified by the requesting page in the preflight request. This can result in unexpected actions being initiated on the cross-origin site without user consent. This issue is addressed by dropping custom HTTP headers from preflight requests.

Upstream bug: ------------- https://bugs.webkit.org/showbug.cgi?id=28446

Upstream patch: --------------- http://trac.webkit.org/changeset/47494

Buffer underflow in src/http/ngxhttpparse.c in nginx 0.1.0 through 0.5.37, 0.6.x before 0.6.39, 0.7.x before 0.7.62, and 0.8.x before 0.8.15 allows remote attackers to execute arbitrary code via crafted HTTP requests.

Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and 3.0.12 through 3.0.36, as used in the SMB subsystem in Apple Mac OS X 10.5.8 when Windows File Sharing is enabled, Fedora 11, and other operating systems, does not properly handle errors in resolving pathnames, which allows remote authenticated users to bypass intended sharing restrictions, and read, create, or modify files, in certain circumstances involving user accounts that lack home directories.

A privilege escalation flaw was found in the way DeviceKit used to handle labels for pluggable storage devices. A local, unprivileged user could provide a specially-crafted string as a name, for the newly created / added system device, leading to escalation of his privileges.

Upstream bug report: -------------------- http://bugs.freedesktop.org/showbug.cgi?id=23235

Upstream patch: --------------- http://cgit.freedesktop.org/DeviceKit/DeviceKit-disks/commit/?id=62f883c7d38e75d0669c162529062a1e81d00da2

A certain Red Hat modification to the ChrootDirectory feature in OpenSSH 4.8, as used in sshd in OpenSSH 4.3 in Red Hat Enterprise Linux (RHEL) 5.4 and Fedora 11, allows local users to gain privileges via hard links to setuid programs that use configuration files within the chroot directory, related to requirements for directory ownership.

Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html

If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

Affected versions: 8.3, 8.2

Fixed in versions: 8.3.8, 8.2.14

Severity: A - A vulnerability that is exploitable for privilege escalation without requiring a prior login.

A Debian bug report [1] indicates that backintime chmods files to mode 0777 prior to removing them via removing a snapshot. What makes this worse is that if those files exist in subsequent snapshots, the permissions on those files is also mode 0777 which allows anyone to manipulate/delete the files in the backup.

Looking at this further, if I set the backintime backup directory to, say /srv/backups/$USER, and were to have multiple users on the system, each user would be able to see the other's backup files. Granted, permissions are mimicked from the source, so if a file is 0644 at the source, it will be in the backup as well. However, I think it might be prudent if /srv/backups/$USER was also owned $USER:$USER and mode 0700.

The file in question is common/snapshots.py which contains:

316 path = self.getsnapshotpath( snapshotid ) 317 cmd = "chmod -R a+rwx "%s"" % path 318 self.execute( cmd ) 319 cmd = "rm -rfv "%s"" % path 320 self.execute( cmd )

I'm not sure what the logic behind chmoding those files in the first place is. Obviously the user had to have read-permissions to get the files into the backup in the first place so they should all be owned by the user, meaning chmodding the files is relatively useless. The debian report suggests changing the chmod call to a find call and just changing the mode of directories, but I'm not convinced that's even necessary if the directories are owned by the user to begin with.

There are also two places where this call is made:

% grep -r 'chmod -R a+rwx' common/snapshots.py: cmd = "chmod -R a+rwx "%s"" % path common/snapshots.py: self.execute( "chmod -R a+rwx "%s"" % newsnapshotpath )

so the second invocation likely needs to be changed as well.

This would affect Fedora 10, Fedora 11, and rawhide.

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=543785

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

The execve function in the Linux kernel, possibly 2.6.30-rc6 and earlier, does not properly clear the current->clearchildtid pointer, which allows local users to cause a denial of service (memory corruption) or possibly gain privileges via a clone system call with CLONECHILDSETTID or CLONECHILDCLEARTID enabled, which is not properly handled during thread creation and exit.

Multiple use-after-free vulnerabilities in libxml2 2.5.10, 2.6.16, 2.6.26, 2.6.27, and 2.6.32, and libxml 1.8.17, allow context-dependent attackers to cause a denial of service (application crash) via crafted (1) Notation or (2) Enumeration attribute types in an XML file, as demonstrated by the Codenomicon XML fuzzing framework.

End of life: 6/25/2010, Latest version: 11