[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:42583] [Translate] [SECURITY] [DSA 650-1] New sword packages fix arbitrary command execution

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:42583] [Translate] [SECURITY] [DSA 650-1] New sword packages fix arbitrary command execution
Date: Fri, 21 Jan 2005 21:41:33 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-original-to: debian-users@debian.or.jp
X-spam-level:
X-spam-status: No, hits=0.4 required=10.0 tests=EIGHTBIT_BODY,ISO2022JP_BODY,ISO2022JP_CHARSET, SIGNATURE_SHORT_DENSE,SPAM_PHRASE_00_01 version=2.44
Message-id: <p0432041ebe16a8c7e28b@[192.168.200.6]>
X-mail-count: 42583
X-mailer: Macintosh Eudora Version 4.3.2-J

かねこです。
URL 等は元記事を確認ください。

------>8------------>8------------>8------------>8------------>8
- --------------------------------------------------------------------------
Debian Security Advisory DSA 650-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
January 20th, 2005                         http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : sword
Vulnerability  : 入力のサニタイズ漏れ
Problem-Type   : リモート
Debian-specific: いいえ
CVE ID         : CAN-2005-0015

Ulf H&auml;rnhammar さんが bible ウェブサイトの作成とブラウズを行う CGI 
スクリプトの diatheke に入力のサニタイズ漏れを発見しました。特別な形式の
URL を作成することで任意のコマンドの実行が可能です。

安定版 (stable) ディストリビューション (woody) では、この問題はバージョン
1.5.3-3woody2 で修正されています。

不安定版 (unstable) ディストリビューション (sid) では、この問題は近く修正
予定です。

直ぐに sword パッケージをアップグレードすることを勧めます。

アップグレード手順
------------------

wget url
	でファイルを取得できます。
dpkg -i file.deb
        で参照されたファイルをインストールできます。

を用いて、apt-get パッケージマネージャに以下記載の sources.list を与えて
次のコマンドを使ってください。

apt-get update
        これは内部データベースを更新します。
apt-get upgrade
        これで修正されたパッケージをインストールします。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。

Debian GNU/Linux 3.0 愛称 woody
- ------------------------------------

  ソースアーカイブ:


    http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3-3woody2.dsc
      Size/MD5 checksum:      612 9204579e3a264d7d43297c1b7bf98438
    http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3-3woody2.diff.gz
      Size/MD5 checksum:    21169 c355f97deb2ef2c39b82aec857b15a21
    http://security.debian.org/pool/updates/main/s/sword/sword_1.5.3.orig.tar.gz
      Size/MD5 checksum:  2389613 055f9c1e7c081a667674d9f4112abf11

  Alpha architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_alpha.deb
      Size/MD5 checksum:    82154 2c73838e4e5d1112ded21365df2578a3
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_alpha.deb
      Size/MD5 checksum:  1712920 e3914e31b0b0217ac8f227f8730c0ace
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_alpha.deb
      Size/MD5 checksum:    13312 29c89888a4b51b5aa555ff55b0a410ad
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_alpha.deb
      Size/MD5 checksum:   601828 dfcf6f97b2b3eead528e92b5dc387fe6

  ARM architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_arm.deb
      Size/MD5 checksum:    56756 0a83537894f73c59aac38b8698d68dc8
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_arm.deb
      Size/MD5 checksum:   989694 18f31fc2d82aec5b342a62822f6421d8
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_arm.deb
      Size/MD5 checksum:    13326 f8a405bc39b9e73d84cb42448144b4ec
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_arm.deb
      Size/MD5 checksum:   298826 53df2455c33de26ddc7f661f1ff74a43

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_i386.deb
      Size/MD5 checksum:    54788 7329737ccfe2988b667bf1cf4d0b684d
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_i386.deb
      Size/MD5 checksum:   923510 87cbc45e59453e36004331d8a1ba4950
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_i386.deb
      Size/MD5 checksum:    13320 190147bb90a295003c9bf6ad0e0a48d4
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_i386.deb
      Size/MD5 checksum:   281460 c0c5beeb00046e67a6fa9089e9d43d14

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_ia64.deb
      Size/MD5 checksum:    62174 fbf8fac6dfc7d61a739b3bdb3f499566
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_ia64.deb
      Size/MD5 checksum:  1291474 d38e91788454487c3fc8b40e017fc682
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_ia64.deb
      Size/MD5 checksum:    13308 b24742b3c41724e34669d0b921cb3d27
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_ia64.deb
      Size/MD5 checksum:   333424 7aaaaf076026a95ac0d0bdbe488777fb

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_hppa.deb
      Size/MD5 checksum:    62118 2504df74d92b6adb4910a6a4f3452183
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_hppa.deb
      Size/MD5 checksum:  1104178 07328cd8ee7dde27dfed04296e3ae908
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_hppa.deb
      Size/MD5 checksum:    13320 d62ee10092df4e13ad703662fd5ffdda
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_hppa.deb
      Size/MD5 checksum:   321394 ab1a13bf24f55ca743a8c760adebc8e9

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_m68k.deb
      Size/MD5 checksum:    53082 39829e678361864e1da30406d34b63eb
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_m68k.deb
      Size/MD5 checksum:   932564 a1189885065e93581e8467cc85b270cd
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_m68k.deb
      Size/MD5 checksum:    13340 2b3407e4e1f8e272f86d297d6ff73738
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_m68k.deb
      Size/MD5 checksum:   298670 47ec4a13a6a9492deaa50d841366458d

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_mips.deb
      Size/MD5 checksum:    52350 e4c719c9a0dda7691232f30eef22dbde
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_mips.deb
      Size/MD5 checksum:  1109974 878366a171bca33b56ee9710119412c9
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_mips.deb
      Size/MD5 checksum:    13332 91fe931443f5ae22621628db2deef543
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_mips.deb
      Size/MD5 checksum:   256508 82fb17f0ff951a96d406d1f65eac8a26

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_mipsel.deb
      Size/MD5 checksum:    52126 5e61bca3b51666582fbb182398f0f9bd
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_mipsel.deb
      Size/MD5 checksum:  1099316 5de4d4a7a89bc24bb3e50f4bf6edf740
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_mipsel.deb
      Size/MD5 checksum:    13346 f0fcbee29448cd9c32d906ecdee962f3
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_mipsel.deb
      Size/MD5 checksum:   240420 b71294049ac28ea1fafe85968b6499de

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_powerpc.deb
      Size/MD5 checksum:    53026 4063714e63bb48f93c16c70be949d2c1
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_powerpc.deb
      Size/MD5 checksum:  1000066 7eda6d983cd89dee3543b6db26a3bdfe
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_powerpc.deb
      Size/MD5 checksum:    13318 3687a1d751652c987d9e658463e71e9a
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_powerpc.deb
      Size/MD5 checksum:   306722 8d01c00d9235925512c46b5e4efe5bfe

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_s390.deb
      Size/MD5 checksum:    50260 6dafccc1e39907a9852bb8f73be90c30
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_s390.deb
      Size/MD5 checksum:   889972 dc0a114eb6df20568623173363c34fab
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_s390.deb
      Size/MD5 checksum:    13322 520de046e8134166d87d0ea4eb699d1f
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_s390.deb
      Size/MD5 checksum:   278278 9fcd920f31203c18884a74d3e2b208ad

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/s/sword/diatheke_1.5.3-3woody2_sparc.deb
      Size/MD5 checksum:    53248 ed0cafc23539322dd589c13d74fef525
    http://security.debian.org/pool/updates/main/s/sword/libsword-dev_1.5.3-3woody2_sparc.deb
      Size/MD5 checksum:   953876 862ce2d7c89eeb445a1348158439838f
    http://security.debian.org/pool/updates/main/s/sword/libsword-runtime_1.5.3-3woody2_sparc.deb
      Size/MD5 checksum:    13322 d7db9daeb609981e322caa1549b84015
    http://security.debian.org/pool/updates/main/s/sword/libsword1_1.5.3-3woody2_sparc.deb
      Size/MD5 checksum:   281526 2d918e10ef4eba590d5185410e11340d


  これらのファイルは次の版の安定版リリース時そちらに移されます。

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
------>8------------>8------------>8------------>8------------>8
-- 
Seiji Kaneko                         skaneko@xxxxxxxxxxxx
---------------------------------------------------------

Prev by Date: [debian-users:42582] Re: alsa
Next by Date: [debian-users:42584] [Translate] [SECURITY] [DSA 651-1] New squid packages fix denial of service
Previous by thread: [debian-users:42580] Re: 固定IPアドレスについて
Next by thread: [debian-users:42584] [Translate] [SECURITY] [DSA 651-1] New squid packages fix denial of service
Index(es):
- Date
- Thread