-----BEGIN PGP SIGNED MESSAGE-----

===========================================================================
             AUSCERT External Security Bulletin Redistribution

            ESB-2004.0014 -- Debian Security Advisory DSA 414-1
                 New jabber packages fix denial of service
                              07 January 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:                jabber
Publisher:              Debian
Operating System:       Debian GNU/Linux 3.0
                        Linux
Impact:                 Denial of Service
Access Required:        Remote
CVE Names:              CAN-2004-0013

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - --------------------------------------------------------------------------
Debian Security Advisory DSA 414-1                     security@debian.org
http://www.debian.org/security/                             Matt Zimmerman
January 6th, 2004                       http://www.debian.org/security/faq
- - --------------------------------------------------------------------------

Package        : jabber
Vulnerability  : denial of service
Problem-Type   : remote
Debian-specific: no
CVE Ids        : CAN-2004-0013

A vulnerability was discovered in jabber, an instant messaging server,
whereby a bug in the handling of SSL connections could cause the
server process to crash, resulting in a denial of service.

For the current stable distribution (woody) this problem has been
fixed in version 1.4.2a-1.1woody1.

For the unstable distribution (sid) this problem has been fixed in
version 1.4.3-1.

We recommend that you update your jabber package.

Upgrade Instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 3.0 alias woody
- - --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1.dsc
      Size/MD5 checksum:      580 efa342add13e86c05cb394604aab89d0
    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1.diff.gz
      Size/MD5 checksum:    61467 d8b19d51fc83095db7132e1c5abc651c
    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a.orig.tar.gz
      Size/MD5 checksum:   690217 10780dbdb93926ea5bb360e1186b939c

  Alpha architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_alpha.deb
      Size/MD5 checksum:   241262 e1dfb66863a3392f0e078503fc070ba3

  ARM architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_arm.deb
      Size/MD5 checksum:   207750 4f6554511245c45dea401b767e60f8b8

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_i386.deb
      Size/MD5 checksum:   196148 522769b98c8daafcbc98248c41bce10c

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_ia64.deb
      Size/MD5 checksum:   356460 e30221687c1df3ce1e04d56f07e18073

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_hppa.deb
      Size/MD5 checksum:   226222 e62ee0c273d73f325339a954058a6836

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_m68k.deb
      Size/MD5 checksum:   200616 7dcda4e913787e0511eb4dc148ce61ea

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_mips.deb
      Size/MD5 checksum:   203188 7124007a61770fc8146eaa7969757dd2

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_mipsel.deb
      Size/MD5 checksum:   202356 31d39182928dca472a77a516fab60698

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_powerpc.deb
      Size/MD5 checksum:   205032 6a4ea17882063074292b7682abeb032a

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_s390.deb
      Size/MD5 checksum:   210494 d631c49818c85f5b6b003c115b36b7cf

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/j/jabber/jabber_1.4.2a-1.1woody1_sparc.deb
      Size/MD5 checksum:   224836 90d74ff4bc33673515d47e8ede21f6fa

  These files will probably be moved into the stable distribution on
  its next revision.

- - ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQE/+1oJArxCt0PiXR4RAmFKAKDZhlXQeKTrcNiLMhF3RGJCd1avZwCdEFmk
g1JNGOzrB5wplcMLf6xtzo8=
=8CXB
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business 
                hours which are GMT+10:00 (AEST).  On call after hours 
                for member emergencies only.
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBP/tcTCh9+71yA2DNAQEN/AP/VcnLIARFK1xowcKsY9HMlVhQFbo9Aq4Y
548zcGPwmZmeUx5SOnycmNNatppf9q69yri/IRu1Kk7wcerQMsqRi0HWDo9CTft2
8Vb3pPyrI8l0Qf29SZG84HayzliEL3wmOf7SpYC3kJ9vMmnP+nQtkiOqJcPNspOV
LnLxZTdoXjM=
=9rig
-----END PGP SIGNATURE-----