U radu programskog paketa libsndfile uočen je novi nedostatak koji može dovesti do rušenja ranjivog sustava ili potencijalnog pokretanja proizvoljnog programskog koda.
Paket:
libsndfile 1.x
Operacijski sustavi:
Mandriva Linux 2009.0, Mandriva Linux 2010.1, Mandriva Linux Corporate 4.0, Mandriva Linux Enterprise Server 5.0
Kritičnost:
4.3
Problem:
cjelobrojno prepisivanje
Iskorištavanje:
lokalno/udaljeno
Posljedica:
proizvoljno izvršavanje programskog koda
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-2696
Izvorni ID preporuke:
MDVSA-2011:119
Izvor:
Mandriva
Problem:
Problem se javlja zbog pojave cjelobrojnog prepisivanja koje vodi do prepisivanja na gomili prilikom obrade određenih PAF (eng. PARIS Audio Format) datoteka.
Posljedica:
Napadač može iskoristiti propust stvaranjem zlonamjerno oblikovanog PAF dokumenta koji prilikom otvaranja može srušiti ranjivu aplikaciju ili uzrokovati pokretanje proizvoljnog programskog koda s ovlastima korisnika koji pokreće aplikaciju.
Rješenje:
Svi se korisnici upućuju na korištenje dostupne programske nadogradnje.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2011:119
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libsndfile
Date : July 25, 2011
Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
A vulnerability was discovered and corrected in libsndfile:
An integer overflow flaw, leading to a heap-based buffer overflow,
was found in the way the libsndfile library processed certain
Ensoniq PARIS Audio Format (PAF) audio files. An attacker could
create a specially-crafted PAF file that, when opened, could cause
an application using libsndfile to crash or, potentially, execute
arbitrary code with the privileges of the user running the application
(CVE-2011-2696).
Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2696
http://secunia.com/advisories/45125/
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2009.0:
9383f6bd15e67d66d3319481274f242c
2009.0/i586/libsndfile1-1.0.18-2.pre22.1.4mdv2009.0.i586.rpm
683841acd0bd1f397a97f7f915922c53
2009.0/i586/libsndfile-devel-1.0.18-2.pre22.1.4mdv2009.0.i586.rpm
5e13dd7bad7f21406bea942ef09e5747
2009.0/i586/libsndfile-progs-1.0.18-2.pre22.1.4mdv2009.0.i586.rpm
35e9a17c4d60f91d26280b7777e4c083
2009.0/i586/libsndfile-static-devel-1.0.18-2.pre22.1.4mdv2009.0.i586.rpm
9ff14b6a740e38689cf287a8e16a4dae
2009.0/SRPMS/libsndfile-1.0.18-2.pre22.1.4mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
cf2a832f9bfd9859d93195793a5aad10
2009.0/x86_64/lib64sndfile1-1.0.18-2.pre22.1.4mdv2009.0.x86_64.rpm
8aedf342e07affdad07c15644795713b
2009.0/x86_64/lib64sndfile-devel-1.0.18-2.pre22.1.4mdv2009.0.x86_64.rpm
a6e1626f7392b9749578eff6e84a274b
2009.0/x86_64/lib64sndfile-static-devel-1.0.18-2.pre22.1.4mdv2009.0.x86_64.rpm
f68bcf560ba264813eebb8f0ff782baa
2009.0/x86_64/libsndfile-progs-1.0.18-2.pre22.1.4mdv2009.0.x86_64.rpm
9ff14b6a740e38689cf287a8e16a4dae
2009.0/SRPMS/libsndfile-1.0.18-2.pre22.1.4mdv2009.0.src.rpm
Mandriva Linux 2010.1:
fb657db5943e2dc482f5cfd263066d5e
2010.1/i586/libsndfile1-1.0.21-2.1mdv2010.2.i586.rpm
1c09960b6a09abb942892e52a3ab29af
2010.1/i586/libsndfile-devel-1.0.21-2.1mdv2010.2.i586.rpm
f3f41c43d977c6002fce9412ce9cf830
2010.1/i586/libsndfile-progs-1.0.21-2.1mdv2010.2.i586.rpm
e4fe76880b0a4deabc797a7871806baf
2010.1/i586/libsndfile-static-devel-1.0.21-2.1mdv2010.2.i586.rpm
0ead7914eda8fa83bfa99e3e05be29ce
2010.1/SRPMS/libsndfile-1.0.21-2.1mdv2010.2.src.rpm
Mandriva Linux 2010.1/X86_64:
05dc31ed72e63ac04fc5d69067369c93
2010.1/x86_64/lib64sndfile1-1.0.21-2.1mdv2010.2.x86_64.rpm
1dc1ce52163ea91aa5b2ad3635217635
2010.1/x86_64/lib64sndfile-devel-1.0.21-2.1mdv2010.2.x86_64.rpm
770ce057d9c276f15a10715782355fff
2010.1/x86_64/lib64sndfile-static-devel-1.0.21-2.1mdv2010.2.x86_64.rpm
bb1039622949ecc92974f9b1ca9a275b
2010.1/x86_64/libsndfile-progs-1.0.21-2.1mdv2010.2.x86_64.rpm
0ead7914eda8fa83bfa99e3e05be29ce
2010.1/SRPMS/libsndfile-1.0.21-2.1mdv2010.2.src.rpm
Corporate 4.0:
0878ddfb767aaaccbac23948f78ddea1
corporate/4.0/i586/libsndfile1-1.0.11-1.3.20060mlcs4.i586.rpm
dcf983bfa07ca4f6d4391f80cb645f5e
corporate/4.0/i586/libsndfile1-devel-1.0.11-1.3.20060mlcs4.i586.rpm
4f99c74a97354beed0443ea11dd1629a
corporate/4.0/i586/libsndfile1-static-devel-1.0.11-1.3.20060mlcs4.i586.rpm
34fa74c7ea214834e9d0575db01a8f40
corporate/4.0/i586/libsndfile-progs-1.0.11-1.3.20060mlcs4.i586.rpm
fa0424c0e169e1614666d7736756b031
corporate/4.0/SRPMS/libsndfile-1.0.11-1.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
087a22aa5bc3c5b4ea42d3ee53d047b2
corporate/4.0/x86_64/lib64sndfile1-1.0.11-1.3.20060mlcs4.x86_64.rpm
4bb229456d4f0c791a7528c9cb49bbb7
corporate/4.0/x86_64/lib64sndfile1-devel-1.0.11-1.3.20060mlcs4.x86_64.rpm
8871bdf19b7a8a3ab8a7fd567b6e5770
corporate/4.0/x86_64/lib64sndfile1-static-devel-1.0.11-1.3.20060mlcs4.x86_64.rpm
d203a707cbaba0d40735dfee35f45337
corporate/4.0/x86_64/libsndfile-progs-1.0.11-1.3.20060mlcs4.x86_64.rpm
fa0424c0e169e1614666d7736756b031
corporate/4.0/SRPMS/libsndfile-1.0.11-1.3.20060mlcs4.src.rpm
Mandriva Enterprise Server 5:
dffc2b02d4a2170064283ab09d22425d
mes5/i586/libsndfile1-1.0.18-2.pre22.1.4mdvmes5.2.i586.rpm
a1637a2915f1a3d2f0152f008cecfc70
mes5/i586/libsndfile-devel-1.0.18-2.pre22.1.4mdvmes5.2.i586.rpm
b85d2b9dc8b497da15696f559c14c1c5
mes5/i586/libsndfile-progs-1.0.18-2.pre22.1.4mdvmes5.2.i586.rpm
b5f58e41a413fd79fe280c59ea35cc3b
mes5/i586/libsndfile-static-devel-1.0.18-2.pre22.1.4mdvmes5.2.i586.rpm
ea4edf4a49507b9d52b38ade640afebf
mes5/SRPMS/libsndfile-1.0.18-2.pre22.1.4mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
b41d97a1fffb62568532d19479967616
mes5/x86_64/lib64sndfile1-1.0.18-2.pre22.1.4mdvmes5.2.x86_64.rpm
336081aa960401cbc63cee0cc9b979c4
mes5/x86_64/lib64sndfile-devel-1.0.18-2.pre22.1.4mdvmes5.2.x86_64.rpm
5286d2f3580b3e01c554da2fe727a3ee
mes5/x86_64/lib64sndfile-static-devel-1.0.18-2.pre22.1.4mdvmes5.2.x86_64.rpm
089e4c44779b913bca93b4b3c35ea2ab
mes5/x86_64/libsndfile-progs-1.0.18-2.pre22.1.4mdvmes5.2.x86_64.rpm
ea4edf4a49507b9d52b38ade640afebf
mes5/SRPMS/libsndfile-1.0.18-2.pre22.1.4mdvmes5.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFOLU+wmqjQ0CJFipgRApqdAKDP+TE3JfCP9LgI5wmZJl+eRMaBOwCgoGF6
aIqvPfLcHXFxS1PD1/x8Zxs=
=nMEX
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke