[SECURITY] [DSA 1333-1] New libcurl3-gnutls packages fix certificate handling

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [SECURITY] [DSA 1333-1] New libcurl3-gnutls packages fix certificate handling
From: Steve Kemp <skx@xxxxxxxxxx>
Date: Wed, 18 Jul 2007 21:09:50 +0100
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mail-followup-to: bugtraq@xxxxxxxxxxxxxxxxx
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Old-return-path: <steve@xxxxxxxxxxxx>
Priority: urgent
Reply-to: listadmin@xxxxxxxxxxxxxxxxx
Resent-cc: recipient list not shown: ;
Resent-date: Wed, 18 Jul 2007 20:11:33 +0000 (UTC)
Resent-from: list@xxxxxxxxxxxxxxxxx (Mailing List Manager)
Resent-message-id: <ekjzd.A.i8F.1PnnGB@murphy>
User-agent: mutt-ng/devel-r804 (Debian)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1333                    security@xxxxxxxxxx
http://www.debian.org/security/                               Steve Kemp
July 18th, 2007
- ------------------------------------------------------------------------

Package        : libcurl3-gnutls
Vulnerability  : input validation
Problem type   : local and remote
Debian-specific: no
CVE Id(s)      : CVE-2007-3564

It has been discovered that the GnuTLS certificate verification methods
implemented in libcurl-gnutls, a solid, usable, and portable multi-protocol
file transfer library, did not check for expired or invalid dates.

For the stable distribution (etch), this problem has been fixed in
version 7.15.5-1etch1.

We recommend that you upgrade your libcurl3-gnutls package.


Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- --------------------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, 
mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.dsc
    Size/MD5 checksum:      948 1eacdb0c127ad12b860033f743563df8
  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5.orig.tar.gz
    Size/MD5 checksum:  1897973 61997c0d852d38c3a85b445f4fc02892
  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.diff.gz
    Size/MD5 checksum:    19029 cbd30d40f3026e020182e665a7f5d5be

Architecture independent packages:

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15.5-1etch1_all.deb
    Size/MD5 checksum:    22198 b6b9a429b9ae513c5e0c8472c6509907

alpha architecture (DEC Alpha)

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   811542 dbc6cd819cff1b717c46e11caa1dd331
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   815608 03e1eb1961a7e58e82e4ac2380aa8c8a
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   181660 30c703c8b17a42b63d2fbe575bafe562
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   823850 23eb2600b1da596a04bfd5043effc13d
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   166814 7a9f90444bd58d38c9452a44ff71ea98
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_alpha.deb
    Size/MD5 checksum:   175316 0167fc5805b8f8c363165dff64dafe98

amd64 architecture (AMD x86_64 (AMD64))

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   772978 675235b32ac91f3b91f86ee28e70d1e2
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   824246 a0547976a45ee4d4be2c43b179459404
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   767648 4852d415582c564eb50cb9f8cbc677f7
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   170008 ff8b0b14022f291265324243579abf2d
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   164638 ae44174a768af4786637cb6292800b21
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_amd64.deb
    Size/MD5 checksum:   163440 c7410d7b8efc16abf1e138c1bb7a5712

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   162094 001980ca743312ca37513877ad7d19f6
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   164634 436490a717543532135cfaafb4fb4a99
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   757356 3a74f9c27504a758b95dfb6ba5fb96a3
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   782328 40e1890d559f3efb927af1d0bc0c8c6e
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   750218 82456f7c8a985993fd50eb482f715a70
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_arm.deb
    Size/MD5 checksum:   159216 183adf1413dc30aab0e80c96e8b07d69

hppa architecture (HP PA RISC)

  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   164460 cb4b604568f5f67d219f42423a3871e5
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   183728 04b0a53a277f70ca365662ea80956012
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   177964 4e5610dee599cff8118ee190db9a632d
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   792842 1bdbcbc1a90f533c7a4937c61eb07097
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   811428 5028f1eb54b2eae003f97f38b06ee31e
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_hppa.deb
    Size/MD5 checksum:   786392 41a0d16e111efa9b7693b2ff4b49aae2

i386 architecture (Intel ia32)

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   759318 e028af09b03561cf80fba28e667619cc
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   797370 61890674b4ca3d63025aec44330d018a
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   163196 c4826f28c035963ba7c78bbf02e598fc
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   765284 dbb49ba6646ccf3b0545246d221727f6
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   162952 13ee79189c41390d6123d9f2eceb43d6
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_i386.deb
    Size/MD5 checksum:   168268 abfd5346cf785ff3c3575e0ff5f45fd3

ia64 architecture (Intel ia64)

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   217322 60b9e2ed439e2d25efd0a938fed85631
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   174406 3b2820551a8f73b6d0d2fd618611aa8d
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   847688 3067d35de833b8fc16bcbac066105fab
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   225286 33446e0073372cbf66d2478d931b4c20
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   811428 29c7c73f506b810299b99ec4aa546d23
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_ia64.deb
    Size/MD5 checksum:   837622 0539dc6328d28d866c60aabcc9a54c77

mipsel architecture (MIPS (Little Endian))

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   809808 74fb469f9dede8bc34e48a4a539e4358
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   163986 df1acd593c0eeed9a18c3ed8a8a0549e
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   791042 3608d4164968ecf0eb5761ccfa981efb
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   783344 5f6956f17a95ffa849c83847ca68125a
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   165370 2ff41d7e7856497bb33aaf1c42d0cc20
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_mipsel.deb
    Size/MD5 checksum:   170278 8d0e09a0bdaf30cd225e59d381c6966a

powerpc architecture (PowerPC)

  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   165070 a2a95f8b931dd24659e6c17ae6de57e0
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   840286 670575e9107d1665d0123d5b034b09c3
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   780710 f63c169d7ac0a594415ce06fc554d03a
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   173628 2ef64672347d6ec0f710bfc3c68fb188
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   168912 2b05b6937b6c6bb567e9d77dc1d13ea2
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_powerpc.deb
    Size/MD5 checksum:   773612 4292b8d1c968c17817ccd36149ddbc20

s390 architecture (IBM S/390)

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   835496 199f0660bb88bf2b5f8572209c4bbcaa
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   163122 4c84c66f773accf9da6e6585edcedcc7
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   773100 10a17910d3a30b7de38a138fd6c3e299
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   179504 e83ac479b8e9c5011e28db1f4d58fa14
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   768068 67cbdd360ed1dbb80824bb6738787c95
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_s390.deb
    Size/MD5 checksum:   172214 c187f5108f5a977f08abf0b4e37471e0

sparc architecture (Sun SPARC/UltraSPARC)

  
http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   165032 18e35286ceb1129fbbe7fa1be094c59d
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   758474 e5f75c8f4491dd628fa9005e4dfc5cbb
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   159890 69c90d7c3aaa79021cfa2ee5ca0c8ca7
  
http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   162360 de5df99405d29124dcd4b70e3aa60bf7
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   765156 963dd337e581b69c4663ade85a44755d
  
http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_sparc.deb
    Size/MD5 checksum:   787450 2ed6fb01f7babf43d9bf04aac8ed79d5


  These files will probably be moved into the stable distribution on
  its next update.

- 
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security 
dists/stable/updates/main
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGnnLYwM/Gs81MDZ0RAqEMAJ9SVwtkRq4InvjE1WxoZhNuNuBBMwCfTYFF
UsgKwdu++50iJM4A+60bNxs=
=ncFi
-----END PGP SIGNATURE-----

Prev by Date: [SECURITY] [DSA 1334-1] New freetype packages fix arbitary code execution
Next by Date: iDefense Security Advisory 07.18.07: Ipswitch IMail Server 2006 IMAP Search Command Buffer Overflow Vulnerability
Previous by thread: [SECURITY] [DSA 1334-1] New freetype packages fix arbitary code execution
Next by thread: iDefense Security Advisory 07.18.07: Ipswitch IMail Server 2006 IMAP Search Command Buffer Overflow Vulnerability
Index(es):
- Date
- Thread