=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

************************************************** *************************=
*********
Netwosix Linux Security Advisory #2004-0012 <http://www.netwosix.org>
=2D -----------------------------------------------------------------------=
=2D-----------

Package name: =A0 =A0neon
Summary: =A0 =A0 =A0 =A0 =A0Multiple format string vulnerabilities
Date: =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 2004-04-18
Affected versions: =A0Netwosix 1.0
=A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=A0Netwosix 1.1
************************************************** *************************=
*********

=2D - -> Package description:
=2D - ------------------------
neon is an HTTP and WebDAV client library for Unix systems, with a C langua=
ge=20
API. It provides high-level interfaces to HTTP/1.1 and WebDAV methods, and =
a=20
low-level interface to HTTP request/response handling, allowing new methods=
=20
to be easily implemented.


=2D - -> Problem description:
=2D - ------------------------

Multiple format string vulnerabilities in neon 0.24.4 and earlier, and the=
=20
cadaver client which uses neon, as used in OpenOffice, allow remote malicio=
us=20
WebDAV servers to execute arbitrary code.

=2D - -> Action:
=2D - ------------------------
=A0 We recommend that all systems with this package installed be upgraded.
=A0 Please note that if you do not need the functionality provided by this
=A0 package, you may want to remove it from your system.

=2D - -> Location:
=2D - ---------------------

=A0 You can download the latest version of this package in NEPOTE format fr=
om:
=A0 <http://download.netwosix.org/0012/nepote>

=2D - -> Nepote Update:
=2D - ---------------------

See this instructions to update the port of this package:

# cd /usr/ports/net/neon
# rm nepote
=A0 =A0 =A0 =A0 # wget http://download.netwosix.org/0012/nepote
=A0 =A0 =A0 =A0 # sh nepote (to install the new and updated package)

=2D - -> References
=2D - ---------------------

=A0 =A0 =A0 =A0 Specific references for this advisory:
=A0 =A0 =A0 =A0 =A0 =A0 =A0http://cve.mitre.org/cgi-bin/cvename.cgi?name=3D=
CAN-2004-0179


=2D - -> About Linux Netwosix:
=2D - ---------------------------------
Linux Netwosix is a powerful and optimized Linux distribution for servers
and Network Security related jobs. =A0It can also be used for special opera=
tions
such as penetration testing with its big collection of security oriented
software and sources. It's a light distribution created for the requirements
of every SysAdmin and it's very portable and highly configurable. Our
philosophy is to give greater liberty for =A0configuration to the SysAdmin.
Only in this way can he/she configure a powerful and stable server machine.
Linux Netwosix also has a powerful ports system (Nepote) similar to the xBSD
systems but more flexible and usable.


=2D - -> Questions?
=2D - ---------------------
=A0 Check out our mailing lists:
=A0 <http://www.netwosix.org/mailing.html>


=A0 The advisory itself is available at
=A0 <http://www.netwosix.org/adv12.html>
=2D - --------------------------------------------------

MD5sums of the packages:
=2D - - -------------------------------------------------------------------=
=2D------
9df8e061588541fe4da49e105af163a7 =A00012/nepote
=2D - - -------------------------------------------------------------------=
=2D------
=2D --=20
Vincenzo Ciaglia
Linux Netwosix Team - [ Keyid: 0x6BB3E24A]
Key fingerprint =3D 4B3E A25F 2A7A 0C19 1A97 616B EA3C FDA4 6BB3 E24A
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAgpqf6jz9pGuz4koRAtbnAJ4z4evd2n1ypyO7RYs1fP ZbmvqZxgCfUL/b
DfktW6St1ZYNCfi+dObyOyc=3D
=3DEYrQ
=2D----END PGP SIGNATURE-----