Attachment 28796 Details for Bug 66448

vendor-sec discussion

uim.txt (text/plain), 14.14 KB, created by Thomas Biege on 2005-02-24 10:08:55 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2005-02-24 10:08:55 UTC

Size: 14.14 KB

patch

obsolete

>From vendor-sec-admin@lst.de  Wed Feb 23 18:32:34 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: thomas@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 7DC7721362D
>	for <thomas@wotan.suse.de>; Wed, 23 Feb 2005 18:32:34 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id 6AB9B13E903; Wed, 23 Feb 2005 18:32:34 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id 5A83913D824; Wed, 23 Feb 2005 18:32:34 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 01773-02; Wed, 23 Feb 2005 18:32:31 +0100 (CET)
>Received: from Cantor.suse.de (news.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id D610E12D2BD; Wed, 23 Feb 2005 18:32:31 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id AC15314E28F8;
>	Wed, 23 Feb 2005 18:32:31 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1NHW86s007456;
>	Wed, 23 Feb 2005 18:32:08 +0100
>Received: from hades.annvix.org (dsl-bev-208-38-9-180-edm.nucleus.com [208.38.9.180])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1NHVP6t007436
>	(version=TLSv1/SSLv3 cipher=EDH-RSA-DES-CBC3-SHA bits=168 verify=NO)
>	for <vendor-sec@lst.de>; Wed, 23 Feb 2005 18:31:26 +0100
>Received: from s010600055dff8ed9.ed.shawcable.net ([68.149.32.85] helo=[10.0.5.13])
>	by hades.annvix.org with esmtpsa (TLSv1:RC4-SHA:128)
>	(Exim 4.44)
>	id 1D40M7-00084L-TM
>	for vendor-sec@lst.de; Wed, 23 Feb 2005 10:31:24 -0700
>Mime-Version: 1.0 (Apple Message framework v619.2)
>Message-Id: <b3b2f40c15123ce585890d3f99630934@mandrakesoft.com>
>To: vendor-sec List <vendor-sec@lst.de>
>From: Vincent Danen <vdanen@mandrakesoft.com>
>X-Pgp-Agent: GPGMail 1.0.2
>X-Mailer: Apple Mail (2.619.2)
>X-SA-Exim-Connect-IP: 68.149.32.85
>X-SA-Exim-Mail-From: vdanen@mandrakesoft.com
>Content-Transfer-Encoding: 7bit
>Content-Type: multipart/signed; protocol="application/pgp-signature"; micalg=pgp-sha1; boundary="Apple-Mail-4--123819812"
>X-SA-Exim-Version: 4.1 (built Wed, 02 Feb 2005 21:38:53 -0500)
>X-SA-Exim-Scanned: Yes (on hades.annvix.org)
>Subject: [vendor-sec] vulnerability in uim
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Wed, 23 Feb 2005 10:31:22 -0700
>Date: Wed, 23 Feb 2005 10:31:22 -0700
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=0.0 tagged_above=-20.0 required=5.0 tests=
>X-Spam-Level: 
>Status: RO
>Content-Length: 1479
>Lines: 43
>
>
>--Apple-Mail-4--123819812
>Content-Transfer-Encoding: 7bit
>Content-Type: text/plain; charset=US-ASCII; format=flowed
>
>Not sure if anyone other than us ships this (it's a multilingual input 
>method library), but there was a vulnerability fixed in new versions of 
>uim that could allow certain suid/sgid apps linked against libuim to be 
>exploited for a local privilege escalation.  Announcement of the new 
>versions is here:
>
>http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html
>
>Since this is public, we'll be doing an advisory for this soon, but I 
>thought I'd give a heads up in case anyone else ships with this.  As 
>well, if any of you CVE-carrying gentlemen could assign a CVE name to 
>this, that would be wonderful.
>
>-- 
>"lynx -source http://linsec.ca/vdanen.asc | gpg --import"
>{FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
>
>--Apple-Mail-4--123819812
>content-type: application/pgp-signature; x-mac-type=70674453;
>	name=PGP.sig
>content-description: This is a digitally signed message part
>content-disposition: inline; filename=PGP.sig
>content-transfer-encoding: 7bit
>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.2.3 (Darwin)
>
>iD8DBQFCHL3qLrxeMv7jCtQRAnYRAJ9FbMvE2Bvvqs4jec+dzfGUTQtMfgCeL51q
>zNS7QLdQThYbc/oJdL4+S9o=
>=VIn4
>-----END PGP SIGNATURE-----
>
>--Apple-Mail-4--123819812--
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From vendor-sec-admin@lst.de  Wed Feb 23 21:02:52 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: thomas@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 1F7B8211EDA
>	for <thomas@wotan.suse.de>; Wed, 23 Feb 2005 21:02:52 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id 1974D13DEA2; Wed, 23 Feb 2005 21:02:52 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id 0B6CD13D756; Wed, 23 Feb 2005 21:02:52 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 17098-01; Wed, 23 Feb 2005 21:02:49 +0100 (CET)
>Received: from Cantor.suse.de (mail-ex.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id 6D48013D748; Wed, 23 Feb 2005 21:02:49 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id 4916514E462B;
>	Wed, 23 Feb 2005 21:02:49 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1NK2F6s009792;
>	Wed, 23 Feb 2005 21:02:15 +0100
>Received: from smtp-bedford-dr.mitre.org (smtp-bedford-dr-x.mitre.org [192.160.51.65])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1NK1p6s009768
>	for <vendor-sec@lst.de>; Wed, 23 Feb 2005 21:01:52 +0100
>Received: from smtp-bedford-dr.mitre.org (localhost.localdomain [127.0.0.1])
>	by smtp-bedford-dr.mitre.org (8.11.6/8.11.6) with SMTP id j1NK1p729792
>	for <vendor-sec@lst.de>; Wed, 23 Feb 2005 15:01:51 -0500
>Received: from smtp-bedford-dr.mitre.org (localhost.localdomain [127.0.0.1])
>	by smtp-bedford-dr.mitre.org (Postfix) with ESMTP id DD0A34F8D7
>	for <vendor-sec@lst.de>; Wed, 23 Feb 2005 15:01:50 -0500 (EST)
>Received: from linus.mitre.org (linus.mitre.org [129.83.10.1])
>	by smtp-bedford-dr.mitre.org (8.11.6/8.11.6) with ESMTP id j1NK1oe29753;
>	Wed, 23 Feb 2005 15:01:50 -0500
>Received: from cairo.mitre.org (cairo.mitre.org [129.83.10.14])
>	by linus.mitre.org (8.12.10/8.12.10) with ESMTP id j1NK1ooK020689;
>	Wed, 23 Feb 2005 15:01:50 -0500 (EST)
>From: "Steven M. Christey" <coley@linus.mitre.org>
>X-X-Sender: coley@cairo.mitre.org
>To: Mark J Cox <mjc@redhat.com>
>Cc: vendor-sec List <vendor-sec@lst.de>,
>	"Steven M. Christey" <coley@linus.mitre.org>
>Subject: Re: [vendor-sec] vulnerability in uim (fwd)
>In-Reply-To: <0502231814290.15932@dell1.moose.awe.com>
>Message-ID: <Pine.GSO.4.51.0502231501020.4086@cairo.mitre.org>
>References: <0502231814290.15932@dell1.moose.awe.com>
>MIME-Version: 1.0
>Content-Type: TEXT/PLAIN; charset=US-ASCII
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Wed, 23 Feb 2005 15:01:50 -0500 (EST)
>Date: Wed, 23 Feb 2005 15:01:50 -0500 (EST)
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=0.0 tagged_above=-20.0 required=5.0 tests=
>X-Spam-Level: 
>Status: RO
>Content-Length: 850
>Lines: 25
>
>
>I just assigned CAN-2005-0503 to this issue the other day.  It's already
>on the CVE web site.
>
>- Steve
>
>======================================================
>Candidate: CAN-2005-0503
>URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0503
>Reference: MLIST:[uim] 20050220 uim 0.4.5.1 released
>Reference: URL:http://lists.freedesktop.org/archives/uim/2005-February/000996.html
>Reference: BID:12604
>Reference: URL:http://www.securityfocus.com/bid/12604
>Reference: SECUNIA:13981
>Reference: URL:http://secunia.com/advisories/13981
>
>uim before 0.4.5.1 trusts certain environment variables when libUIM is
>used in setuid or setgid applications, which allows local users to
>gain privileges.
>
>
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>From vendor-sec-admin@lst.de  Thu Feb 24 08:17:19 2005
>Return-Path: <vendor-sec-admin@lst.de>
>X-Original-To: thomas@wotan.suse.de
>Received: from hermes.suse.de (hermes.suse.de [149.44.160.1])
>	by wotan.suse.de (Postfix) with ESMTP id 911C121321B
>	for <thomas@wotan.suse.de>; Thu, 24 Feb 2005 08:17:19 +0100 (CET)
>Received: by hermes.suse.de (Postfix)
>	id 8096A13E903; Thu, 24 Feb 2005 08:17:19 +0100 (CET)
>Received: from scanhost.suse.de (scanhost.suse.de [149.44.160.36])
>	by hermes.suse.de (Postfix) with ESMTP
>	id 7289A1116C5; Thu, 24 Feb 2005 08:17:19 +0100 (CET)
>Received: from hermes.suse.de ([149.44.160.1])
> by scanhost.suse.de (scanhost [149.44.160.36]) (amavisd-new, port 10025)
> with ESMTP id 08197-08; Thu, 24 Feb 2005 08:17:16 +0100 (CET)
>Received: from Cantor.suse.de (mail.suse.de [195.135.220.2])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by hermes.suse.de (Postfix) with ESMTP
>	id CE70113DBC9; Thu, 24 Feb 2005 08:17:15 +0100 (CET)
>Received: from mail.lst.de (verein.lst.de [213.95.11.210])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(No client certificate requested)
>	by Cantor.suse.de (Postfix) with ESMTP id CE1BE14E8CC2;
>	Thu, 24 Feb 2005 08:08:45 +0100 (CET)
>Received: from verein.lst.de (localhost [127.0.0.1])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1O78O6s018788;
>	Thu, 24 Feb 2005 08:08:24 +0100
>Received: from luonnotar.infodrom.org (luonnotar.infodrom.org [195.124.48.78])
>	by mail.lst.de (8.12.3/8.12.3/Debian-7.1) with ESMTP id j1O77k6s018766
>	for <vendor-sec@lst.de>; Thu, 24 Feb 2005 08:07:46 +0100
>Received: by luonnotar.infodrom.org (Postfix, from userid 10)
>	id 3F67F367984; Thu, 24 Feb 2005 08:07:41 +0100 (CET)
>Received: at Infodrom Oldenburg (/\##/\ Smail-3.2.0.102 1998-Aug-2 #2)
>	from infodrom.org by finlandia.Infodrom.North.DE
>	via smail from stdin
>	id <m1D4Cwa-000ojsC@finlandia.Infodrom.North.DE>
>	for coley@linus.mitre.org; Thu, 24 Feb 2005 07:57:52 +0100 (CET) 
>From: Martin Schulze <joey@infodrom.org>
>To: Mark J Cox <mjc@redhat.com>
>Cc: vendor-sec List <vendor-sec@lst.de>,
>	"Steven M. Christey" <coley@linus.mitre.org>
>Message-ID: <20050224065752.GK1666@finlandia.infodrom.north.de>
>References: <0502231814290.15932@dell1.moose.awe.com>
>Mime-Version: 1.0
>Content-Type: text/plain; charset=iso-8859-1
>Content-Disposition: inline
>Content-Transfer-Encoding: 8bit
>In-Reply-To: <0502231814290.15932@dell1.moose.awe.com>
>User-Agent: Mutt/1.5.6+20040907i
>Subject: [vendor-sec] Re: vulnerability in uim (fwd)
>Sender: vendor-sec-admin@lst.de
>Errors-To: vendor-sec-admin@lst.de
>X-BeenThere: vendor-sec@lst.de
>X-Mailman-Version: 2.0.11
>Precedence: bulk
>List-Help: <mailto:vendor-sec-request@lst.de?subject=help>
>List-Post: <mailto:vendor-sec@lst.de>
>List-Subscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=subscribe>
>List-Id: <vendor-sec.lst.de>
>List-Unsubscribe: <https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec>,
>	<mailto:vendor-sec-request@lst.de?subject=unsubscribe>
>List-Archive: <https://www.lst.de/cgi-bin/mailman/private/vendor-sec/>
>X-Original-Date: Thu, 24 Feb 2005 07:57:52 +0100
>Date: Thu, 24 Feb 2005 07:57:52 +0100
>X-Virus-Scanned: by amavisd-new at scanhost.suse.de
>X-Spam-Status: No, hits=-0.0 tagged_above=-20.0 required=5.0 tests=BAYES_44
>X-Spam-Level: 
>Status: RO
>Content-Length: 1535
>Lines: 39
>
>Mark J Cox wrote:
>> Vincent, for public issues just mail Steven at Mitre directly to request a 
>> CVE name (cc'd)
>
>Use CAN-2005-0503
>
>> ---------- Forwarded message ----------
>> Date: Wed, 23 Feb 2005 10:31:22 -0700
>> From: Vincent Danen <vdanen@mandrakesoft.com>
>> To: vendor-sec List <vendor-sec@lst.de>
>> Subject: [vendor-sec] vulnerability in uim
>> 
>> Not sure if anyone other than us ships this (it's a multilingual input 
>> method library), but there was a vulnerability fixed in new versions of uim 
>> that could allow certain suid/sgid apps linked against libuim to be 
>> exploited for a local privilege escalation.  Announcement of the new 
>> versions is here:
>> 
>> http://lists.freedesktop.org/pipermail/uim/2005-February/000996.html
>> 
>> Since this is public, we'll be doing an advisory for this soon, but I 
>> thought I'd give a heads up in case anyone else ships with this.  As well, 
>> if any of you CVE-carrying gentlemen could assign a CVE name to this, that 
>> would be wonderful.
>> 
>> -- 
>> "lynx -source http://linsec.ca/vdanen.asc | gpg --import"
>> {FEE30AD4 : 7F6C A60C 06C2 4811 FA1C  A2BC 2EBC 5E32 FEE3 0AD4}
>> _______________________________________________
>> Vendor Security mailing list
>> Vendor Security@lst.de
>> https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>
>-- 
>A mathematician is a machine for converting coffee into theorems.   Paul Erdös
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec
>

Actions: View

Attachments on bug 66448: 28796 | 39630