Bug 13959

Summary:	distcc new security issue CVE-2014-4607
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	normal
Priority:	Normal	CC:	damyan.dimitrov, rverschelde, sysadmin-bugs
Version:	4	Keywords:	validated_update
Target Milestone:	---
Hardware:	i586
OS:	Linux
URL:	http://lwn.net/Vulnerabilities/604237/
Whiteboard:	MGA3TOO has_procedure advisory MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK
Source RPM:	distcc-3.2rc1-5.mga4.src.rpm	CVE:
Status comment:
Bug Depends on:
Bug Blocks:	13943

Description David Walser 2014-08-20 22:07:57 CEST

distcc bundles minilzo, which is affected by the CVE-2014-4607 issue from the LZO library.

Patched packages uploaded for Mageia 3, Mageia 4, and Cauldron.

Advisory:
========================

Updated distcc packages fix security vulnerability:

An integer overflow in liblzo before 2.07 allows attackers to cause a denial
of service or possibly code execution in applications using performing LZO
decompression on a compressed payload from the attacker (CVE-2014-4607).

The distcc package is built with a bundled copy of minilzo, which is a
part of liblzo containing the vulnerable code.

References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4607
http://advisories.mageia.org/MGASA-2014-0290.html
========================

Updated packages in core/updates_testing:
========================
distcc-3.2rc1-3.1.mga3
distcc-server-3.2rc1-3.1.mga3
distcc-3.2rc1-5.1.mga4
distcc-server-3.2rc1-5.1.mga4

from SRPMS:
distcc-3.2rc1-3.1.mga3.src.rpm
distcc-3.2rc1-5.1.mga4.src.rpm

Reproducible: 

Steps to Reproduce:

David Walser 2014-08-20 22:08:05 CEST

Blocks: (none) => 13943
Whiteboard: (none) => MGA3TOO

Comment 1 Rémi Verschelde 2014-08-23 14:03:55 CEST

distcc is a tool to distribution a compilation over a network. So to test it one needs at least two machines connected to each other.

Some instructions on how to set it up: http://distcc.googlecode.com/svn/trunk/doc/web/index.html

CC: (none) => remi

Comment 2 Damyan Dimitrov 2014-08-29 14:03:48 CEST

The packages distcc and distcc-server are updating cleanly on both releases and both architectures.

CC: (none) => damyan.dimitrov
Whiteboard: MGA3TOO => MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK

Comment 3 claire robinson 2014-08-30 15:31:28 CEST

Well done Damyan. Don't forget to validate any which is ready.

Validating this one now. Advisory uploaded.

Could sysadmin please push to 3 & 4 updates

Thanks

Keywords: (none) => validated_update
Whiteboard: MGA3TOO MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK => MGA3TOO has_procedure advisory MGA3-32-OK MGA3-64-OK MGA4-32-OK MGA4-64-OK
CC: (none) => sysadmin-bugs

Comment 4 Mageia Robot 2014-09-01 12:44:39 CEST

An update for this issue has been pushed to Mageia Updates repository.

http://advisories.mageia.org/MGASA-2014-0362.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED