[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:33858] Forward: [SECURITY] [DSA 137-1] New mm packages fix insecure temporary file creation

From: Kenshi Muto <kmuto@xxxxxxxxxxxxxxx>
Subject: [debian-users:33858] Forward: [SECURITY] [DSA 137-1] New mm packages fix insecure temporary file creation
Date: Wed, 31 Jul 2002 07:50:43 +0900
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 3.0pl#17]; post only (only members can post)
X-razor-id: 878754e5165ef6ac5ec2f7849a6c3a11768907a8
X-spam-level:
X-spam-status: No, hits=-2.6 required=10.0 tests=TO_LOCALPART_EQ_REAL,ISO2022JP_BODY,CASHCASHCASH, PGP_SIGNATURE version=2.31
X-virus-scanned: by AMaViS new-20020517
References: <m17Zagq-000okDC@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
Message-id: <20020730225036.A0C865380C@xxxxxxxxxxxxxxxxxxxxxx>
X-mail-count: 33858
User-agent: Wanderlust/2.9.13 (Unchained Melody) SEMI/1.14.3 (Ushinoya) FLIM/1.14.3 (Unebigory�mae) APEL/10.3 MULE XEmacs/21.4 (patch 8) (Honest Recruiter) (i386-debian-linux)

DSA-137です。potatoにも関連し、対策済みパッケージが出ています。

現在の Debian 安定版 (3.0 woody) にセキュリティに関する深刻な問題が発見
されました。

対象パッケージ: mm

対処済みのパッケージに更新するには、

deb http://security.debian.org/ stable/updates main contrib non-free

を /etc/apt/sources.list に追加し、

apt-get update ; apt-get upgrade

を実行してください。

詳細については添付のアナウンスをご覧ください。

--- Begin Message ---

From: joey@xxxxxxxxxxxx (Martin Schulze)
Subject: [SECURITY] [DSA 137-1] New mm packages fix insecure temporary file creation
Date: Tue, 30 Jul 2002 19:21:44 +0200 (CEST)
Content-disposition: inline
List-help: <mailto:debian-security-announce-request@lists.debian.org?subject=help>
List-post: <mailto:debian-security-announce@lists.debian.org>
List-subscribe: <mailto:debian-security-announce-request@lists.debian.org?subject=subscribe>
List-unsubscribe: <mailto:debian-security-announce-request@lists.debian.org?subject=unsubscribe>
Priority: urgent
Resent-date: Wed, 31 Jul 2002 02:34:41 +0900 (JST)
Resent-from: debian-security-announce@lists.debian.org
Resent-message-id: <XC9liB.A.DtD.eysR9@murphy>
Resent-sender: debian-security-announce-request@lists.debian.org
X-debian: PGP check passed for security officers
X-envelope-sender: joey@xxxxxxxxxxxx
X-loop: debian-security-announce@lists.debian.org
X-mailing-list: <debian-security-announce@lists.debian.org>
X-razor-id: 961de652c8e51d106f3169f761c49c0fd2fadbfb
X-spam-status: No, hits=-5.0 required=4.7 tests=PGP_SIGNATURE version=2.01
X-virus-scanned: by AMaViS new-20020517
Message-id: <m17Zagq-000okDC@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
User-agent: dpkg-mail-advisory $Revision: 1.6 $

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 137-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
July 30th, 2002   
- --------------------------------------------------------------------------

Package        : mm
Vulnerability  : insecure temporary files
Problem-Type   : local
Debian-specific: no
CVE Id         : CAN-2002-0658

Marcus Meissner and Sebastian Krahmer discovered and fixed a temporary
file vulnerability in the mm shared memory library.  This problem can
be exploited to gain root access to a machine running Apache which is
linked against this library, if shell access to the user ``www-data''
is already available (which could easily be triggered through PHP).

This problem has been fixed in the upstream version 1.2.0 of mm, which
will be uploaded to the unstable Debian distribution while this
advisory is released.  Fixed packages for potato (Debian 2.2) and
woody (Debian 3.0) are linked below.

We recommend that you upgrade your libmm packages immediately.

wget url
	will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- ------------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/m/mm/mm_1.0.11-1.2.dsc
      Size/MD5 checksum:      553 6bf8816fa3395bc685451501f203b60b
    http://security.debian.org/pool/updates/main/m/mm/mm_1.0.11.orig.tar.gz
      Size/MD5 checksum:   142893 e8f12c85582bd9994369ea4098c3424c
    http://security.debian.org/pool/updates/main/m/mm/mm_1.0.11-1.2.diff.gz
      Size/MD5 checksum:     5184 81bd3aaa499f029254fa64a7fc9a1660

  Alpha architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_alpha.deb
      Size/MD5 checksum:    13788 e45aec9dc3688a0a8500c88d04c49f33
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_alpha.deb
      Size/MD5 checksum:    32060 3a20277fd97bdf52afc511c5cf7a922a

  ARM architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_arm.deb
      Size/MD5 checksum:    11876 36bf40e33e1e58ab59bdbc7e6b27327a
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_arm.deb
      Size/MD5 checksum:    29194 eeba5fb89081bfc67cc1eb4c8ae7beaf

  Intel ia32 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_i386.deb
      Size/MD5 checksum:    12100 52a6b793c890790319b5d328ee1b7a0d
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_i386.deb
      Size/MD5 checksum:    28924 888a040a28f6c942424b609bb92ddc88

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_m68k.deb
      Size/MD5 checksum:    11560 f86c03c040087127c74f8ddb0ebb23b4
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_m68k.deb
      Size/MD5 checksum:    28752 aba689b014f669d0cadeefaa7720b9d7

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_powerpc.deb
      Size/MD5 checksum:    12286 159aa5cb4938fa844ad6b93990d125b3
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_powerpc.deb
      Size/MD5 checksum:    30340 785b5ed0a9cb5b00f4e3182b7a457b44

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm10_1.0.11-1.2_sparc.deb
      Size/MD5 checksum:    12170 f4f4911490dcec804e2215d8c6dcb373
    http://security.debian.org/pool/updates/main/m/mm/libmm10-dev_1.0.11-1.2_sparc.deb
      Size/MD5 checksum:    29664 fa63ddb6ab216e7d7d7caa09531a6967


Debian GNU/Linux 3.0 alias woody
- ------------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/m/mm/mm_1.1.3-6.1.dsc
      Size/MD5 checksum:      565 90c7910a97454ac9aa1abc0bc79cf316
    http://security.debian.org/pool/updates/main/m/mm/mm_1.1.3.orig.tar.gz
      Size/MD5 checksum:   137951 ba14a90239e26337eef079b698f35eae
    http://security.debian.org/pool/updates/main/m/mm/mm_1.1.3-6.1.diff.gz
      Size/MD5 checksum:     4300 44c3bd2710d53798f19228ffb4a32b78

  Alpha architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_alpha.deb
      Size/MD5 checksum:    15884 e95d9355d8c1ce4e67b057e9f7b644ed
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_alpha.deb
      Size/MD5 checksum:    35894 613548b6398dff2a72d8831dfa0bd405

  ARM architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_arm.deb
      Size/MD5 checksum:    14082 bc8d016410dc8ae21bd273239432e58e
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_arm.deb
      Size/MD5 checksum:    33312 e148f2ef714cc6cd7b4021ec75fb19e0

  Intel ia32 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_i386.deb
      Size/MD5 checksum:    14090 f118e324b0b4baf755e4b6c0532138f0
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_i386.deb
      Size/MD5 checksum:    32750 d089be8693d8c2dcaae3fb953d9eec54

  Intel ia64 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_ia64.deb
      Size/MD5 checksum:    18668 a2a7024d9f7fae7823bf6f4eb7d9f04d
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_ia64.deb
      Size/MD5 checksum:    37466 1b6a21155340aa8ba1a407ac3ca6f92e

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_hppa.deb
      Size/MD5 checksum:    15124 a727a96c2deaecc8744a38c2790dd3c6
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_hppa.deb
      Size/MD5 checksum:    34442 b3c909102201481260e990c879b0cbd4

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_m68k.deb
      Size/MD5 checksum:    13724 838d7d18852fdbb29d13b564810d123b
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_m68k.deb
      Size/MD5 checksum:    32642 1008ea0662fd538477e330af50eb24b0

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_mips.deb
      Size/MD5 checksum:    14526 4e6623322ddf327a785fd6ffe6b8ac53
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_mips.deb
      Size/MD5 checksum:    35110 ab27174539b582b6076bfd2e9c39f1c9

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_mipsel.deb
      Size/MD5 checksum:    14530 2964c06a127258d7e3fb877e52106566
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_mipsel.deb
      Size/MD5 checksum:    35138 6a6727101d30da5446b71cf8a17df09a

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_powerpc.deb
      Size/MD5 checksum:    14430 0926f90a07eb1fbd17a6f668b5a7fa5d
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_powerpc.deb
      Size/MD5 checksum:    34468 0ae6359e654bad4eab542318112185de

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_s390.deb
      Size/MD5 checksum:    14688 e9e1d8caaf6a92862ea416f05150c56b
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_s390.deb
      Size/MD5 checksum:    33184 9f493d157472503aed37bc8f40a3dcfa

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/m/mm/libmm11_1.1.3-6.1_sparc.deb
      Size/MD5 checksum:    14310 57a9315214fb39d0aacbf31a23393161
    http://security.debian.org/pool/updates/main/m/mm/libmm11-dev_1.1.3-6.1_sparc.deb
      Size/MD5 checksum:    33756 e0efa30728f179a3c201c29676786ef4


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9RssnW5ql+IAeqTIRAknDAJ9zA6qwER8CffT7Qn7UdO2OLplAJQCfZ8dA
O2Y3sVKbQIOW6LdmsaGIONE=
=2lhJ
-----END PGP SIGNATURE-----


-- 
To UNSUBSCRIBE, email to debian-security-announce-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

--- End Message ---

Prev by Date: [debian-users:33857] Forward: [SECURITY] [DSA-136-1] Multiple OpenSSL problems
Next by Date: [debian-users:33859] [Translate] [SECURITY] [DSA-136-1] Multiple OpenSSL problems
Previous by thread: [debian-users:33857] Forward: [SECURITY] [DSA-136-1] Multiple OpenSSL problems
Next by thread: [debian-users:33859] [Translate] [SECURITY] [DSA-136-1] Multiple OpenSSL problems
Index(es):
- Date
- Thread