[SECURITY] [DSA 1716-1] New vnc4 packages fix remote code execution
From: Florian Weimer <fw@deneb.enyo.de.>
Date: Sat, 31 Jan 2009 22:26:15 +0100
Subject: [SECURITY] [DSA 1716-1] New vnc4 packages fix remote code execution
Priority: urgent
Resent-Message-ID: <S57KvMtd2O.A.bpH.LIMhJB@liszt.>
Reply-To: [email protected]
Mail-Followup-To: [email protected]
To: [email protected]
Resent-Date: Sat, 31 Jan 2009 21:26:35 +0000 (UTC)
Resent-From: [email protected] (Mailing List Manager)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1716-1 [email protected]
http://www.debian.org/security/ Steffen Joeris
January 31, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------
Package : vnc4
Vulnerability : integer overflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2008-4770
Debian Bug : 513531
It was discovered that xvnc4viewer, a virtual network computing client
software for X, is prone to an integer overflow via a malicious
encoding value that could lead to arbitrary code execution.
For the stable distribution (etch) this problem has been fixed in
version 4.1.1+X4.3.0-21+etch1.
For the unstable (sid) distribution this problem has been fixed in
version 4.1.1+X4.3.0-31.
For the testing (lenny) distribution this problem will be fixed soon.
We recommend that you upgrade your vnc4 packages.
Upgrade instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 4.0 alias etch
- -------------------------------
Source archives:
http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0-21+etch1.diff.gz
Size/MD5 checksum: 50904 55c92400d7949023c3488dcec680d613
http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0.orig.tar.gz
Size/MD5 checksum: 31536534 b28c43385fe574d612ddbd0b645082f7
http://security.debian.org/pool/updates/main/v/vnc4/vnc4_4.1.1+X4.3.0-21+etch1.dsc
Size/MD5 checksum: 696 0d0f0e7f58c6440481b8bfa83af8cd63
alpha architecture (DEC Alpha)
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_alpha.deb
Size/MD5 checksum: 19868 56d083c639e24961fcbbf98cec86dd11
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_alpha.deb
Size/MD5 checksum: 172424 ec5afb4bf93d6988859e0dca63b922a4
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_alpha.deb
Size/MD5 checksum: 2682410 e2ad2547dda085010c318900786ee935
amd64 architecture (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_amd64.deb
Size/MD5 checksum: 2169248 27b31d7391acb4b7d4e98a97a341bcf3
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_amd64.deb
Size/MD5 checksum: 144462 097687a2626960fcda86fa8df3831151
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_amd64.deb
Size/MD5 checksum: 18778 68843484c257b04314e141a1bc370443
hppa architecture (HP PA RISC)
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_hppa.deb
Size/MD5 checksum: 181264 ca3758fa85fb049fdd8f965d3e67ed40
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_hppa.deb
Size/MD5 checksum: 2294922 00482f651a2008cd66f4588ac403cba2
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_hppa.deb
Size/MD5 checksum: 19490 07ac277452d42f3f5ac8144700109c06
i386 architecture (Intel ia32)
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_i386.deb
Size/MD5 checksum: 2015342 a1e67da97e85e0ca290e3644b551c686
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_i386.deb
Size/MD5 checksum: 18640 27cf156a68540519f9efd4b81fd51dff
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_i386.deb
Size/MD5 checksum: 147628 9cedf57dd52455c76332f585f6c52dc8
ia64 architecture (Intel ia64)
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_ia64.deb
Size/MD5 checksum: 20850 1bc4cf4b52eae3f4df103ef36b13f156
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_ia64.deb
Size/MD5 checksum: 210896 9f611bbc3397c02056f51b7f3dc7a190
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_ia64.deb
Size/MD5 checksum: 3436446 a80497194bfa083efc7abb605d63e8e5
mips architecture (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_mips.deb
Size/MD5 checksum: 167956 a675e51fa9e97a06161aa1a39a0a40e0
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_mips.deb
Size/MD5 checksum: 19334 ba9c0e77f3127023fb804771bbc02be1
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_mips.deb
Size/MD5 checksum: 2219206 26797854e72b6e37ae36b3ab25fe9f81
mipsel architecture (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_mipsel.deb
Size/MD5 checksum: 166658 f65eb37aac9e5999bfe8357cc5fa6d1a
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_mipsel.deb
Size/MD5 checksum: 19364 8756098357f1d940067ba336f5fd2412
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_mipsel.deb
Size/MD5 checksum: 2216976 511790cec54a6fbb4d82b7264faa828c
powerpc architecture (PowerPC)
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_powerpc.deb
Size/MD5 checksum: 18964 dc9aaf61e3ed3af75ec6721a34837e91
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_powerpc.deb
Size/MD5 checksum: 150726 72aec061f31ca36cde5de15155566267
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_powerpc.deb
Size/MD5 checksum: 2175212 dd3910238f15e0b3e5217156fb7a82b1
s390 architecture (IBM S/390)
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_s390.deb
Size/MD5 checksum: 146930 3944bd5e31b674d5f61df09bf559da7a
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_s390.deb
Size/MD5 checksum: 18962 9be75dac3eb47ad7fcd3cdf2f791ef29
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_s390.deb
Size/MD5 checksum: 2037162 90f5428057526f8ddd3597b68640278a
sparc architecture (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/v/vnc4/xvnc4viewer_4.1.1+X4.3.0-21+etch1_sparc.deb
Size/MD5 checksum: 140638 8c079b90ee4f3fe80b2ce7eac796b2d0
http://security.debian.org/pool/updates/main/v/vnc4/vnc4server_4.1.1+X4.3.0-21+etch1_sparc.deb
Size/MD5 checksum: 1976152 695f3eca91cd7f4a8b15546fb9f53e97
http://security.debian.org/pool/updates/main/v/vnc4/vnc4-common_4.1.1+X4.3.0-21+etch1_sparc.deb
Size/MD5 checksum: 18334 b5aa41215f8d4d90849bd7e17e6f3720
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iQEcBAEBAgAGBQJJhMIiAAoJEL97/wQC1SS+BIAH/ipPRaeinnmPvVCyw3BO/Efq
hMxAIaJrm+DJL+KoaDimilf6ZQKg7KKoMJ9E8+WWuXtoQTxoipJqsoKeM3OeRglG
O31n3Q5QmA2J1V5H9pwjniyE54J3On1FeXqgc3zAlHZ6Ec6SjQAXQ4OUJXs2ZDci
jnBRcECSeLPlUujM3P6V8IOesFfSFiTb1+7di3CGrJFOCzjnZtgSUzmkWAY8soYq
fn4LXpTUCAkpRTwd/U8y7FPR5DKHtYrb15TE84yixoFRO6E5ynjfllw1az0a6BPO
/0yxdVLDioFIYoyZSmmVayyHWdCpD8KUyUrpNA5mM3467kaHA0fhMoxBgkdafzc=
=BUkF
-----END PGP SIGNATURE-----
