Bug 149578 - <app-text/hyperestraier-1.3.3 has CSRF vulnerability (CVE-2006-3671)
Bug#: 149578 Product:  Gentoo Security Version: unspecified Platform: All
OS/Version: Linux Status: RESOLVED Severity: normal Priority: P2
Resolution: FIXED Assigned To: security@gentoo.org Reported By: matsuu@gentoo.org
Component: Vulnerabilities
URL: 
Summary: <app-text/hyperestraier-1.3.3 has CSRF vulnerability (CVE-2006-3671)
Keywords:  
Status Whiteboard: B4? [noglsa]
Opened: 2006-09-29 20:10 0000
Description:   Opened: 2006-09-29 20:10 0000
see http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3671

ppc and x86 archs: mark stable 1.4.0.

------- Comment #1 From Andrej Kacian (RETIRED) 2006-09-30 02:29:10 0000 -------
!!! All ebuilds that could satisfy ">=dev-db/qdbm-1.8.68" have been masked.

There is a security bug #140295 open for earlier versions of qdbm.

Also, qdbm has had a new release, which has been added to portage on Sep 3rd,
which (judging from version range in the description of above bug) fixes that
bug. 
I assume that under weight of two security bugs, you'll want qdbm-1.8.70
stabilized, to clear way for hyperestraier-1.4.0.

Security, can you confirm?

------- Comment #2 From Akinori Hattori 2006-09-30 05:00:49 0000 -------
dev-db/qdbm-1.8.70 and app-text/hyperestraier-1.4.0 use generation-2
(java-pkg-opt-2.eclass) for building java binding.
I'll modify them to use generation-1, please wait a moment.

------- Comment #3 From Akinori Hattori 2006-09-30 07:47:30 0000 -------
dev-db/qdbm and app-text/hyperestraier are ready.

generation-1:
  dev-db/qdbm-1.8.70-r1.ebuild
  app-text/hyperestraier-1.4.0-r1.ebuild

generation-2:
  dev-db/qdbm-1.8.70-r2.ebuild
  app-text/hyperestraier-1.4.0-r2.ebuild

-r1 for stabilization.

------- Comment #4 From Markus Meier 2006-10-01 05:39:45 0000 -------
dev-db/qdbm-1.8.70-r1
1.) emerges fine on x86
2.) passes collision test
3.) passes test suite

app-text/hyperestraier-1.4.0-r1
1.) emerges fine on x86
2.) passes collision test
3.) passes come kind of self checking
didn't do any further tests

emerge --info
Portage 2.1.1 (default-linux/x86/2006.1/desktop, gcc-4.1.1, glibc-2.4-r3,
2.6.17.13 i686)
=================================================================
System uname: 2.6.17.13 i686 AMD Athlon(TM) XP1800+
Gentoo Base System version 1.12.5
Last Sync: Sat, 30 Sep 2006 22:50:01 +0000
ccache version 2.3 [enabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.2.11-r1
dev-lang/python:     2.3.5-r3, 2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.3
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17-r1
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.5/env /usr/kde/3.5/share/config
/usr/kde/3.5/shutdown /usr/share/X11/xkb /usr/share/config"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/revdep-rebuild /etc/terminfo
/etc/texmf/web2c"
CXXFLAGS="-O2 -march=i686 -fomit-frame-pointer -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache collision-protect distlocks fixpackages
metadata-transfer parallel-fetch sandbox sfperms strict test userfetch userpriv
usersandbox"
GENTOO_MIRRORS="http://mirror.switch.ch/mirror/gentoo/ http://gentoo.inode.at/"
LANG="en_GB.utf8"
LINGUAS="en de en_GB"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
PORTDIR_OVERLAY="/usr/local/portage/normal /usr/local/portage/testing"
SYNC="rsync://192.168.2.1/gentoo-portage"
USE="x86 3dnow 3dnowext X a52 aac acpi alsa apache2 bash-completion berkdb
bitmap-fonts bzip2 cairo cdr cli crypt css cups dbus divx4linux dlloader dri
dts dvd dvdr dvdread elibc_glibc emboss exif fam ffmpeg firefox font-server
fortran gdbm gif gnome gphoto2 gpm gstreamer gtk gtk2 gtkhtml hal
input_devices_keyboard input_devices_mouse ipv6 isdnlog java jpeg kde
kernel_linux ldap libclamav libg++ linguas_de linguas_en linguas_en_GB
logitech-mouse mad mikmod mmx mmxext mono mozcalendar mozdevelop mozsvg mp3
mpeg ncurses network nls nptl nptlonly nvidia oav ogg opengl oss pam pcre perl
png ppds pppd python qt qt3 qt4 quicktime readline reflection samba sdl
seamonkey session spell spl ssl tcltk tcpd test tetex tiff truetype
truetype-fonts type1-fonts udev unicode usb userland_GNU vcd video_cards_none
video_cards_nv vorbis win32codecs xine xinerama xml xorg xorg-x11 xprint xv xvg
xvid zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS, MAKEOPTS,
PORTAGE_RSYNC_EXTRA_OPTS

------- Comment #5 From Joshua Jackson 2006-10-02 21:03:10 0000 -------
x86 stable ^.^

------- Comment #6 From Tobias Scherbaum 2006-10-05 10:40:26 0000 -------
ppc stable

------- Comment #7 From Matthias Geerdsen 2006-10-19 05:52:57 0000 -------
oops... this went under our radar

security please vote on GLSA publication

/me votes no

------- Comment #8 From Raphael Marichez 2006-10-24 03:12:01 0000 -------
no too and closing feelfreetoreopenifyoudisagree