Vulnerability Bulletins |
Múltiples vulnerabilidades en Perl-Compatible Regular Expression |
|
Vulnerability classification |
|
| Property | Value |
| Confidence level | Oficial |
| Impact | Obtener acceso |
| Dificulty | Experto |
| Required attacker level | Acceso remoto sin cuenta a un servicio estandar |
System information |
|
| Property | Value |
| Affected manufacturer | GNU/Linux |
| Affected software |
Perl-Compatible Regular Expression < 7.0 Kazehakase |
Description |
|
|
Se han encontrado múltiples vulnerabilidades en Perl-Compatible Regular Expression. Las vulnerabilidades son descritas a continuación. - CVE-2006-7228: Se ha encontrado una vulnerabilidad del tipo desbordamiento de entero en la librería Perl-Compatible Regular Expression en las versiones anteriores a la 6.7. La vulnerabilidad reside en un cálculo incorrecto del tamaño. Un atacante remoto podría ejecutar código arbitrario mediante una expresión regular relacionada con valores grandes en min, max o duplength. - CVE-2006-7230: Se ha encontrado una vulnerabilidad en la librería Perl-Compatible Regular Expression en las versiones anteriores a la 7.0. La vulnerabilidad reside al no calcular de forma correcta la cantidad de memoria necesaria para el patrón de una expresión regular compilada cuando las opciones UTF-8 -x o -i son cambiadas junto el patrón. |
|
Solution |
|
|
Actualización de software Suse Linux Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux. Red Hat (RHSA-2007:1059-9) RHEL Desktop Workstation (v. 5 cliente) Red Hat Enterprise Linux (v. 5 servidor) Red Hat Enterprise Linux Desktop (v. 5 cliente) https://rhn.redhat.com/ Red Hat (RHSA-2007:1068-3) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ Red Hat (RHSA-2007:1063-4) Red Hat Desktop (v. 3) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux WS (v. 3) https://rhn.redhat.com/ Red Hat (RHSA-2007:1065-3) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor https://rhn.redhat.com/ Red Hat (RHSA-2007:1076-6) Red Hat Desktop (v. 3) Red Hat Desktop (v. 4) Red Hat Enterprise Linux AS (v. 3) Red Hat Enterprise Linux AS (v. 4) Red Hat Enterprise Linux ES (v. 3) Red Hat Enterprise Linux ES (v. 4) Red Hat Enterprise Linux WS (v. 3) Red Hat Enterprise Linux WS (v. 4) https://rhn.redhat.com/ Red Hat (RHSA-2007:1077-5) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor https://rhn.redhat.com/ Mandriva (MDVSA-2008:012) Corporate Server 3.0 corporate/3.0/i586/libpython2.3-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/libpython2.3-devel-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-base-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/python-docs-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/i586/tkinter-2.3.3-2.5.C30mdk.i586.rpm corporate/3.0/SRPMS/python-2.3.3-2.5.C30mdk.src.rpm X86_64 corporate/3.0/x86_64/lib64python2.3-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64python2.3-devel-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-base-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/python-docs-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/x86_64/tkinter-2.3.3-2.5.C30mdk.x86_64.rpm corporate/3.0/SRPMS/python-2.3.3-2.5.C30mdk.src.rpm Multi Network Firewall 2.0 mnf/2.0/i586/libpython2.3-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/libpython2.3-devel-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-base-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/python-docs-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/i586/tkinter-2.3.3-2.5.M20mdk.i586.rpm mnf/2.0/SRPMS/python-2.3.3-2.5.M20mdk.src.rpm Mandriva (MDVSA-2008:030) Corporate Server 3.0 corporate/3.0/i586/libpcre0-4.5-3.4.C30mdk.i586.rpm corporate/3.0/i586/libpcre0-devel-4.5-3.4.C30mdk.i586.rpm corporate/3.0/i586/pcre-4.5-3.4.C30mdk.i586.rpm corporate/3.0/SRPMS/pcre-4.5-3.4.C30mdk.src.rpm X86_64 corporate/3.0/x86_64/lib64pcre0-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/x86_64/lib64pcre0-devel-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/x86_64/pcre-4.5-3.4.C30mdk.x86_64.rpm corporate/3.0/SRPMS/pcre-4.5-3.4.C30mdk.src.rpm Multi Network Firewall 2.0 mnf/2.0/i586/libpcre0-4.5-3.4.M20mdk.i586.rpm mnf/2.0/i586/libpcre0-devel-4.5-3.4.M20mdk.i586.rpm mnf/2.0/i586/pcre-4.5-3.4.M20mdk.i586.rpm mnf/2.0/SRPMS/pcre-4.5-3.4.M20mdk.src.rpm Debian (DSA-1570-1) Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1.diff.gz http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2.orig.tar.gz http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1.dsc alpha (DEC Alpha) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_alpha.deb amd64 (AMD x86_64 (AMD64)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_amd64.deb arm (ARM) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_arm.deb hppa (HP PA RISC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_hppa.deb i386 (Intel ia32) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_i386.deb mips (MIPS (Big Endian)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_mips.deb mipsel (MIPS (Little Endian)) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_mipsel.deb powerpc (PowerPC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_powerpc.deb s390 (IBM S/390) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_s390.deb sparc (Sun SPARC/UltraSPARC) http://security.debian.org/pool/updates/main/k/kazehakase/kazehakase_0.4.2-1etch1_sparc.deb Red Hat (RHSA-2008:0546-3) Red Hat Enterprise Linux AS (v. 2.1) Red Hat Enterprise Linux ES (v. 2.1) Red Hat Enterprise Linux WS (v. 2.1) Red Hat Linux Advanced Workstation 2.1 para Itanium Processor https://rhn.redhat.com/ |
|
Standar resources |
|
| Property | Value |
| CVE |
CVE-2006-7228 CVE-2006-7230 |
| BID | 26462 |
Other resources |
|
|
SUSE Security Advisory (SUSE-SA:2007:062) http://www.novell.com/linux/security/advisories/2007_62_pcre.html SUSE Security Advisory (SUSE-SA:2008:004) http://www.novell.com/linux/security/advisories/2008_04_php.html Red Hat Security Advisory (RHSA-2007:1059-9) https://rhn.redhat.com/errata/RHSA-2007-1059.html Red Hat Security Advisory (RHSA-2007:1068-3) https://rhn.redhat.com/errata/RHSA-2007-1068.html Red Hat Security Advisory (RHSA-2007:1063-4) https://rhn.redhat.com/errata/RHSA-2007-1063.html Red Hat Security Advisory (RHSA-2007:1065-3) https://rhn.redhat.com/errata/RHSA-2007-1065.html Red Hat Security Advisory (RHSA-2007:1076-6) https://rhn.redhat.com/errata/RHSA-2007-1076.html Red Hat Security Advisory (RHSA-2007:1077-5) https://rhn.redhat.com/errata/RHSA-2007-1077.html Mandriva Security Advisory (MDVSA-2008:012) http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:012 Mandriva Security Advisory (MDVSA-2008:030) http://www.mandriva.com/en/security/advisories?name=MDVSA-2008:030 Debian Security Advisory (DSA-1570-1) http://lists.debian.org/debian-security-announce/2008/msg00146.html Red Hat Security Advisory (RHSA-2008:0546-3) https://rhn.redhat.com/errata/RHSA-2008-0546.html |
|
Version history |
||
| Version | Comments | Date |
| 1.0 | Aviso emitido | 2007-11-28 |
| 1.1 | Aviso emitido por Red Hat (RHSA-2007:1059-9), aviso emitido por Red Hat (RHSA-2007:1068-3), aviso emitido por Red Hat (RHSA-2007:1063-4), aviso emitido por Red Hat (RHSA-2007:1065-3) | 2007-11-30 |
| 1.2 | Aviso emitido por Red Hat (RHSA-2007:1076-6), aviso emitido por Red Hat (RHSA-2007:1077-5) | 2007-12-12 |
| 1.3 | Aviso emitido por Mandriva (MDVSA-2008:012) | 2008-01-22 |
| 1.4 | Aviso emitido por Suse (SUSE-SA:2008:004) | 2008-01-31 |
| 1.5 | Aviso emitido por Mandriva (MDVSA-2008:030) | 2008-02-01 |
| 1.6 | Aviso emitido por Debian (DSA-1570-1) | 2008-05-13 |
| 1.7 | Aviso emitido por Red Hat (RHSA-2008:0546-3) | 2008-07-17 |