Date: Thu, 19 Feb 2004 15:50:30 -0800 (PST)
From: [email protected]
To: [email protected], [email protected],
Subject: OpenLinux: Multiple vulnerabilities were discovered in the saned daemon
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenLinux: Multiple vulnerabilities were discovered in the saned daemon
Advisory number: CSSA-2004-005.0
Issue date: 2004 February 19
Cross reference: sr886093 fz528425 erg712466 CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778
______________________________________________________________________________
1. Problem Description
CAN-2003-0773 saned in sane-backends 1.0.7 and earlier does
not check the IP address of the connecting host during the
SANE_NET_INIT RPC call, which allows remote attackers to use that
call even if they are restricted in saned.conf.
CAN-2003-0774 saned in sane-backends 1.0.7 and earlier does not quickly
handle connection drops, which allows remote attackers to
cause a denial of service (segmentation fault) when invalid
memory is accessed.
CAN-2003-0775 saned in sane-backends 1.0.7
and earlier calls malloc with an arbitrary size value if a
connection is dropped before the size value has been sent, which
allows remote attackers to cause a denial of service (memory
consumption or crash).
CAN-2003-0776 saned in sane-backends
1.0.7 and earlier does not properly "check the validity of
the RPC numbers it gets before getting the parameters," with
unknown consequences.
CAN-2003-0777 saned in sane-backends 1.0.7
and earlier, when debug messages are enabled, does not properly
handle dropped connections, which can prevent strings from being
null terminated and cause a denial of service (segmentation
fault).
CAN-2003-0778 saned in sane-backends 1.0.7 and earlier,
and possibly later versions, does not properly allocate memory
in certain cases, which could allow attackers to cause a denial
of service (memory consumption).
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to sane-1.0.13-1.i386.rpm
prior to sane-devel-1.0.13-1.i386.rpm
OpenLinux 3.1.1 Workstation prior to sane-1.0.13-1.i386.rpm
prior to sane-devel-1.0.13-1.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-005.0/RPMS
4.2 Packages
551a28ff2aa0a74e086972d8bdba7657 sane-1.0.13-1.i386.rpm
3082901716b19a271fc14cc2b8356c7e sane-devel-1.0.13-1.i386.rpm
4.3 Installation
rpm -Fvh sane-1.0.13-1.i386.rpm
rpm -Fvh sane-devel-1.0.13-1.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-005.0/SRPMS
4.5 Source Packages
0be6d309556ddb7f588437c4435e1e42 sane-1.0.13-1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-005.0/RPMS
5.2 Packages
c9b9c0ee81ba3e2b09ca743703718007 sane-1.0.13-1.i386.rpm
a313dbf67a26110d3a3fae1a39ffd592 sane-devel-1.0.13-1.i386.rpm
5.3 Installation
rpm -Fvh sane-1.0.13-1.i386.rpm
rpm -Fvh sane-devel-1.0.13-1.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-005.0/SRPMS
5.5 Source Packages
6ccf84292c1decf88207c26bff0001f1 sane-1.0.13-1.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0773http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0774http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0775http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0776http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0777http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0778
SCO security resources:
http://sco.com/support/security/index.html
This security fix closes SCO incidents sr886093 fz528425
erg712466.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFANUjVbluZssSXDTERArQyAKC/MNrxbSJE17sFpY8lrLn5qpoisACfayHo
Dv9gADi2UYMpwjs+EP0EJ/0=
=gP+Z
-----END PGP SIGNATURE-----
