[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:44503] [Translate] [SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution

From: NAKANO Takeo <nakano@xxxxxxxxxxxxxxx>
Subject: [debian-users:44503] [Translate] [SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution
Date: Tue, 23 Aug 2005 21:59:18 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-original-to: debian-users@debian.or.jp
X-sender: NAKANO Takeo <nakano@xxxxxxxxxxxxxxxxxxxx>
Message-id: <050823215917.M0232698@xxxxxxxxxxxxxxxxxxxx>
X-mail-count: 44503
X-mailer: mnews [version 1.22PL6] 2002-07/03(Wed)

中野です。

URL 等は Debian-security-announce メーリングリストの元記事を
確認してください。

--------------------------------------------------------------------------
Debian Security Advisory DSA 782-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
August 23rd, 2005                       http://www.debian.org/security/faq
--------------------------------------------------------------------------

Package        : bluez-utils
Vulnerability  : 入力のサニタイズの欠落
Problem-Type   : ローカル
Debian-specific: いいえ
CVE ID         : CAN-2005-2547
Debian Bug     : 323365

Henryk Ploetz は Bluetooth のツールおよびデーモンである bluez-utils
に脆弱性を発見しました。入力のサニタイズが無いため、攻撃者はリモート
のデバイスから、デバイス名に任意のコマンドを与えて実行させることが
できていました。

前安定版 (old stable) ディストリビューション (woody) には、
bluez-utils パッケージは含まれていないので、この問題は
ありません。

安定版  (stable) ディストリビューション (sarge) では、この問題は
バージョン 2.15-1.1 で修正されています。

不安定版 (unstable) ディストリビューション (sid) では、この問題は
バージョン 2.19-1 で修正されています。

直ちに bluez-utils パッケージをアップグレードすることを勧めます。


アップグレード手順
------------------

wget url
        でファイルを取得できます。
dpkg -i file.deb
        で参照されたファイルをインストールできます。

を用いて、apt-get パッケージマネージャに以下記載の sources.list を与えて
次のコマンドを使ってください。

apt-get update
        これは内部データベースを更新します。
apt-get upgrade
        これで修正されたパッケージをインストールします。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。


Debian GNU/Linux 3.1 愛称 sarge
--------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1.dsc
      Size/MD5 checksum:      714 2491914f1cbc13f0ab28dec7e837e424
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1.diff.gz
      Size/MD5 checksum:    21489 43758255ed6bf5a46a3958f19cc083de
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15.orig.tar.gz
      Size/MD5 checksum:   299709 4e86dfd4449ff49e82696d8a3b254002

  Alpha architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_alpha.deb
      Size/MD5 checksum:    17100 ad86005f878483c8cd5ea2593604c9b6
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_alpha.deb
      Size/MD5 checksum:    19900 816b04f618adbe2ba4ea7bb79a8d7157
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_alpha.deb
      Size/MD5 checksum:    13908 fa9bd6ebdbd4704f2cdc58a23776ce1d
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_alpha.deb
      Size/MD5 checksum:   191032 3ab7545f8baf93b0f1d0c37b03fd60d0

  AMD64 architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_amd64.deb
      Size/MD5 checksum:    16614 a12b51e1eeef5c00d7979fccb6347556
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_amd64.deb
      Size/MD5 checksum:    18440 524a61c61424bb8878a4d481a4f96639
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_amd64.deb
      Size/MD5 checksum:   163404 f1de25ec8a42140ff0fd5981f106b446

  ARM architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_arm.deb
      Size/MD5 checksum:    16350 7f5b07579302c70fe368a8fe879baf64
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_arm.deb
      Size/MD5 checksum:    18020 410fa646ed25f2e4bf769b80627b8319
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_arm.deb
      Size/MD5 checksum:    13908 75eca9861302d04cfa3030bcc6cc2e8d
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_arm.deb
      Size/MD5 checksum:   149058 de5dd73485032ba33405681e38019bd2

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_i386.deb
      Size/MD5 checksum:    16294 e95efa30d455f23acc78913f46f8754b
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_i386.deb
      Size/MD5 checksum:    18006 339294a5b115f1df8460657c044f82a0
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_i386.deb
      Size/MD5 checksum:    13890 5751fcbe540495b01a2888586a144617
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_i386.deb
      Size/MD5 checksum:   149220 43e516a0d3a73e11de96a3293ab99e26

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_ia64.deb
      Size/MD5 checksum:    17742 5372690843eaed6b19925710c48ad440
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_ia64.deb
      Size/MD5 checksum:    20610 38b221b3769bb7567d85ff88fd8eb00b
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_ia64.deb
      Size/MD5 checksum:    13904 38d8f9c631776fdf07befbc8010b51d7
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_ia64.deb
      Size/MD5 checksum:   213568 14322f997ac251b5c19663d9c8f8aafb

  HP Precision architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_hppa.deb
      Size/MD5 checksum:    17000 1e61a7ef4218ebf09854b28d6f281573
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_hppa.deb
      Size/MD5 checksum:    18800 396815069f599b99b1fc45b75f32a2cd
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_hppa.deb
      Size/MD5 checksum:    13908 9b30a8217fcd43466139c1487532e3a8
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_hppa.deb
      Size/MD5 checksum:   165964 42c6010d54d86b92aa550b3299423098

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_m68k.deb
      Size/MD5 checksum:    16320 25bf3588642aa1040fd39f22c12f5697
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_m68k.deb
      Size/MD5 checksum:    17706 797c282ecdaa447fa9082b7406eee5ff
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_m68k.deb
      Size/MD5 checksum:    13924 8d35a46404b9ee45d2a0aab68f48d3e1
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_m68k.deb
      Size/MD5 checksum:   140002 c665c81408c4022e81d7132e4e7a3522

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_mips.deb
      Size/MD5 checksum:    17070 2f3f4dc62239a17b174bf057e7d2dcf2
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_mips.deb
      Size/MD5 checksum:    18746 d4e753008478ff9501fdd7b39efcb3ce
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_mips.deb
      Size/MD5 checksum:    13914 05fe887d123e34eab6843adb3d808c51
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_mips.deb
      Size/MD5 checksum:   173706 fe02dcad2eb60b6db3032dc14e138342

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_mipsel.deb
      Size/MD5 checksum:    17092 ecb402ed2303d3e68fedc7f23fb47bb2
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_mipsel.deb
      Size/MD5 checksum:    18762 282f97232f45e0dadb904d881e1d24c8
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_mipsel.deb
      Size/MD5 checksum:    13908 60ab63b402731440a44d6b9dc756d4f2
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_mipsel.deb
      Size/MD5 checksum:   173960 abb2d7193c2698b703a56b71890531f6

  PowerPC architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_powerpc.deb
      Size/MD5 checksum:    18160 7ed57b2c8f87e9dfdcc5401ce96d5028
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_powerpc.deb
      Size/MD5 checksum:    19714 da7edeba354bec413084b310805f2277
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_powerpc.deb
      Size/MD5 checksum:    13908 c2c98f3732799d08c29f2c8fe048b47f
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_powerpc.deb
      Size/MD5 checksum:   170292 db67afaaccde1cb6f5ac6de30527634d

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_s390.deb
      Size/MD5 checksum:    16796 003612d4408414aad7028aca96a076e7
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_s390.deb
      Size/MD5 checksum:    18246 ac2b0a2ce0099e60adf1adebf38092e8
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_s390.deb
      Size/MD5 checksum:   157826 a54bb7d77b422d1cdd66fb647bfa2198

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/contrib/b/bluez-utils/bluez-bcm203x_2.15-1.1_sparc.deb
      Size/MD5 checksum:    16400 8f3da8e4a00cb7c1986a3c5bf06946ad
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-cups_2.15-1.1_sparc.deb
      Size/MD5 checksum:    17792 e1ef13fe1345cf554a65490430605040
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-pcmcia-support_2.15-1.1_sparc.deb
      Size/MD5 checksum:    13908 5863ca5e69542f659f30e4623abf07bf
    http://security.debian.org/pool/updates/main/b/bluez-utils/bluez-utils_2.15-1.1_sparc.deb
      Size/MD5 checksum:   146742 7e7a54e5b793f702e9432480c1a4bdfe


  これらのファイルは次の版の安定版リリース時そちらに移されます。

---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

References:
- [debian-users:44500] Forward: [SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution
  - From: Kenshi Muto

Prev by Date: [debian-users:44502] [Translate] [SECURITY] [DSA 781-1] New Mozilla Thunderbird packages fix several vulnerabilities
Next by Date: [debian-users:44504] [Q]Nautilus上でのファイル名変更について
Previous by thread: [debian-users:44500] Forward: [SECURITY] [DSA 782-1] New bluez-utils packages fix arbitrary command execution
Next by thread: [debian-users:44501] Forward: [SECURITY] [DSA 781-1] New Mozilla Thunderbird packages fix several vulnerabilities
Index(es):
- Date
- Thread