[SECURITY] [DSA 1374-1] New jffnms packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

• ------------------------------------------------------------------------ Debian Security Advisory DSA 1374-1 security@debian.org http://www.debian.org/security/ Steve Kemp September 11, 2007 http://www.debian.org/security/faq
• ------------------------------------------------------------------------

Package        : jffnms
Vulnerability  : several vulnerabilities
Problem type   : remote
Debian-specific: no
CVE Id(s)      : CVE-2007-3189, CVE-2007-3190, CVE-2007-3191

Several vulnerabilities have been discovered in jffnms, a web-based Network Management System for IP networks. The Common Vulnerabilities and Exposures project identifies the following problems:

CVE-2007-3189     Cross-site scripting (XSS) vulnerability in auth.php, which allows     a remote attacker to inject arbitrary web script or HTML via the     user parameter.

CVE-2007-3190     Multiple SQL injection vulnerabilities in auth.php, which allow     remote attackers to execute arbitrary SQL commands via the     user and password parameters.

CVE-2007-3192     Direct requests to URLs make it possible for remote attackers to     access configuration information, bypassing login restrictions.

For the stable distribution (etch), these problems have been fixed in version 0.8.3dfsg.1-2.1etch1

For the unstable distribution (sid), these problems have been fixed in version 0.8.3dfsg.1-4.

We recommend that you upgrade your jffnms package.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

Upgrade instructions

- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for sources.list as given below:

apt-get update

        will update the internal database apt-get upgrade

        will install corrected packages

You may use an automated update by adding the resources from the footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch

- -------------------------------

Source archives:

  
http://security.debian.org/pool/updates/main/j/jffnms/jffnms_0.8.3dfsg.1.orig.tar.gz
    Size/MD5 checksum:   547656 6be7ef656cf0eea1d133a0bc71a4bba2
  
http://security.debian.org/pool/updates/main/j/jffnms/jffnms_0.8.3dfsg.1-2.1etch1.dsc
    Size/MD5 checksum:      609 7a46a6cdefe38535235aa87dd8e6279c
  
http://security.debian.org/pool/updates/main/j/jffnms/jffnms_0.8.3dfsg.1-2.1etch1.diff.gz
    Size/MD5 checksum:    76283 cf3fd349e3012b93a4d20711730b26f6

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.debian.org Links debian-announce debian-apache debian-arm-changes debian-beowulf debian-boot debian-cd debian-cd-vendors debian-changes debian-changes-digest debian-isp debian-kde debian-laptop debian-mirrors-announce debian-news debian-security debian-security-announce debian-testing debian-user debian-user-digest Request more information about Pantek

Architecture independent packages:

  http://security.debian.org/pool/updates/main/j/jffnms/jffnms_0.8.3dfsg.1-2.1etch1_all.deb     Size/MD5 checksum: 550292 94ec8551e3eaa20ae277a5aab47043ee

  These files will probably be moved into the stable distribution on   its next update.

• --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
  -----BEGIN PGP SIGNATURE-----
  Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFG5uT5wM/Gs81MDZ0RAmvgAJ9voKojLJmyMF+VaB1B/aJNbbcTdwCfa/30 75t+GVJbnAqEuMHkj3xYZgQ=
=yEl5
-----END PGP SIGNATURE-----

-- 
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org