Red Carpet allows malicious mirror administrators to remotely run commands as root.

Severity: Security
Product: redcarpet
Keywords: Red Carpet mirror distribution detection libpng png
References: 
  CAN-2002-1363
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1363

At startup, Red Carpet downloads a number of configuration files. One of
these configuration files instructs Red Carpet to run a local command on
the system. Because this command will be run as root, malicious mirror
administrators could alter this configuration file to execute harmful or
subversive programs on a client machine.

Red Carpet is also statically linked to libpng which has recently been
found to have this problem:

Unpatched versions of libpng 1.2.1 and earlier do not correctly
calculate offsets, which leads to a buffer overflow and the possibility
of arbitrary code execution. This could be exploited by an attacker
creating a carefully crafted PNG file which could execute arbitrary code
when the victim views it.

This means that a mirror administrator could create an image file which
forces Red Carpet to crash or run untrusted code on your computer.

You should update to the latest version of Red Carpet. If you don't
trust your mirror administrator, you can download the latest version at:
http://www.ximian.com/products/redcarpet/download.html or you can use
the links below to get the latest version.

Packages for other platforms will be available as distributions update
their versions of libpng to correct the security problem.

Redhat 7.1
ftp://ftp.ximian.com/pub/redcarpet/redhat-71-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

Redhat 7.2
ftp://ftp.ximian.com/pub/redcarpet/redhat-72-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

Redhat 7.3
ftp://ftp.ximian.com/pub/redcarpet/redhat-73-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

Redhat 8.0
ftp://ftp.ximian.com/pub/redcarpet/redhat-80-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

SuSE 7.3
ftp://ftp.ximian.com/pub/redcarpet/suse-73-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

SuSE 8.0
ftp://ftp.ximian.com/pub/redcarpet/suse-80-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm

SuSE 8.1
ftp://ftp.ximian.com/pub/redcarpet/suse-81-i386/red-carpet-1.4.2-1.ximian.6.i386.rpm




_______________________________________________
updates maillist  -  [email protected]
To unsubscribe from this list, or to change your subscription options, follow the link below:
http://lists.ximian.com/mailman/listinfo/updates