[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:50194] [Translate] [SECURITY] [DSA 1501-1] New dspam packages fix information disclosure

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:50194] [Translate] [SECURITY] [DSA 1501-1] New dspam packages fix information disclosure
Date: Fri, 22 Feb 2008 23:49:17 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-spam-checker-version: SpamAssassin 3.1.7-deb (2006-10-05) on osdn.debian.or.jp
X-spam-level:
X-spam-status: No, score=-2.4 required=10.0 tests=KI autolearn=disabled version=3.1.7-deb
Message-id: <47BEE0A9.4070508@xxxxxxxxxxxx>
X-mail-count: 50194
User-agent: Thunderbird 2.0.0.9 (Macintosh/20071031)

かねこです。
URL 等は Debian-security-announce メーリングリストの元記事を確認
ください。

------>8------------>8------------>8------------>8------------>8-
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1501-1                  security@debian.org
http://www.debian.org/security/                          Thijs Kinkhorst
February 21, 2008                     http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : dspam
Vulnerability  : プログラムミス
Problem type   : ローカル
Debian-specific: はい
CVE Id(s)      : CVE-2007-6418
Debian Bug     : 448519

Tobias Gruetzmacher さんにより、統計的スパムフィルタ dsapm で Debian パ
ッケージ時に追加された CRON スクリプトに MySQL バックエンドを使う場合の
データベースパスワードが記載されていることが発見されました。この欠陥がロ
ーカルユーザから攻撃可能で、email などのdspam データベースの内容を読み出
すことが可能です。

安定版 (stable) ディストリビューション (etch) では、この問題はバージョン
3.6.8-5etch1 で修正されています。mipsel アーキテクチャ向けのパッケージは
近く提供予定です。

旧安定版 (sarge) には dspam パッケージは収録されていません。

不安定版 (unstable) ディストリビューション (sid) では、この問題はバージョ
ン 3.6.8-5.1 で修正されています。

直ぐに dspam パッケージをアップグレードすることを勧めます。


アップグレード手順
------------------

wget url
        	でファイルを取得できます。
dpkg -i file.deb
                で参照されたファイルをインストールできます。

apt-get パッケージマネージャを用いている場合には、本メールのフッタ記載の
行を sources.list に加えて、

apt-get update
        を実行して内部データベースを更新し、
apt-get upgrade
        によって修正されたパッケージをインストールしてください。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。


Debian GNU/Linux 4.0 alias etch
- -------------------------------

ソースアーカイブ:

  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8.orig.tar.gz
    Size/MD5 checksum:   743275 c4b1a7079690ee16d8b0f36b2a2a90a4
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1.dsc
    Size/MD5 checksum:     1425 aca91c929ec1c4e3f575e7e8eb37ba55
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1.diff.gz
    Size/MD5 checksum:    53607 9e4fa44cfd9154eeea77a895d08e2952

アーキテクチャに依存しないパッケージ:

  http://security.debian.org/pool/updates/main/d/dspam/dspam-doc_3.6.8-5etch1_all.deb
    Size/MD5 checksum:    94508 22874dcda2fff6d04a0c644338dcf848

http://security.debian.org/pool/updates/main/d/dspam/dspam-webfrontend_3.6.8-5etch1_all.deb
    Size/MD5 checksum:   109488 2fcf87ed0a9d0a82b984f1d7a83fd92a

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:   116722 fbeea9d902b354bf94b0e8358b2e035f

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:    97600 426456f7a254c4deb9caa4fe46497006

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:   106284 07ce97c65711d9e45e6fff61424fcef4

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:   151074 565a30c4964601abdc3d7590e37df3cb

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:    71262 662cbe35889767f8cfa0628347c6f1f8
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:   360272 2ff991276cafa57e04843a93b5bc818d

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_alpha.deb
    Size/MD5 checksum:    86090 0bcb341c0d38afe2a6f91c5ccc89a7e6

amd64 architecture (AMD x86_64 (AMD64))


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:    85046 f116fad2f6a59b334548c1e410dca1b0

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:    71178 6791d5a9e01eec2014b9a2384f6ff72f
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:   335094 c95a6da6a5569a3bc93f146a8e4150b4

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:   104680 fabdcca6612f273a075e9b553c065cb6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:   132954 59b06e7c1a4f91a03fa29846adc31732
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:   112174 412daf4a7e2581b7f7039c6236ddd4c9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_amd64.deb
    Size/MD5 checksum:    97026 f53ca8975eb626cbcfdc85001a3c6bd3

arm architecture (ARM)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:    71198 173775fc14192d9b357799fa5603d57e
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:   316880 cd581369819fbf1cfa4e35cb98b9194e

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:    84516 fa6d6c6bfc9b1f9999cb1116d8bdc823

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:    95234 053bac8c1d149fb299ff8721cb177cd5

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:   101400 c8efedf650bb3b9eb19f08b06c85b1d6
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:   124638 cbeaf73c8faa223ad18fe00d0247b5bb
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_arm.deb
    Size/MD5 checksum:   108600 88eb7c6283e964f667219009a801eda8

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:   116800 26d4d2436a356933aec1981f29b6f568

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:   137502 3a81b440fb5d8eeaea6742a6dcba379b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:   106354 cb8d60fb47b5e3999ebb7d866968939e

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:    98318 6b2940e4faac890c71227b003a9c643b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:    71258 d5eea93cfce1a4b5e825c32f80b6574c
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:   344376 5ff6104afcdf01293a344579b060e9b6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_hppa.deb
    Size/MD5 checksum:    86434 e4e98427cbb27d7aae7a975646a77d11

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:   320328 b55be9404b573b18b0fc7c21bf0247e8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:    85084 655c55837cdccd7d70048f2ba74b6adc
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:   110686 5eb5bcf9b8cd0fdf7e5dbdeec8b052c5

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:   103912 85ceb515c9581c294060f78a50959cba

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:    71254 42ea48af401d4b1d1eaa2d0e5251c38b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:    96566 b96896e5ffc7617774a97fe968de4643

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_i386.deb
    Size/MD5 checksum:   126340 e2a75400b747b2bc6f06dcb5548ac6a9

ia64 architecture (Intel ia64)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:   114614 36e76fb73bf6b4d9f8fc3aec4cdfc120

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:   155566 6c76fa0488f0d0fc5f7cf1484d5c0095
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:   433272 f671ea16f0fd8d4114bdc26dcc2da4e6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:   103060 1c92ebd3cedf951a674a0161fbba0a26

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:    71262 9b2d4ac63622211ff0a3f4219ca7e237
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:   129946 8f1084a301a1f159a6e99b319decf32c

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_ia64.deb
    Size/MD5 checksum:    89500 dbf693b2e77b81f34836e1936bc1ac3c

mips architecture (MIPS (Big Endian))


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:    71270 3d073f7671fe4ae6d3d8f023b04c20c1

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:   103742 f66fdef7eba14fe018481880340265e7
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:   333494 92bacf8b342185f430f0274caa35eb8a

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:   139398 2d117739fc1fe541110ce781567327b3

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:    84574 775c0a7eff0fab5a01ae0596dc4610b2
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:   111290 3b797e3cb94fb594e26a00a9daea6a15

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_mips.deb
    Size/MD5 checksum:    96176 b34f2d6cf4ce87f7e5c9655327393ad1

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:   349508 770652e863d2fad63dabe283c32b69a1

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:    98430 8988ac11256aa92b0a7fe2b1e5c7c9b8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:   106846 2bd870d4457ccc4441c83db61f438cb6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:   133618 eec0027502c1a78fa3bb417869cd1ad0

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:    86758 e11afd83aebf1e47bf5e47cd9fa3a412
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:   114026 39d86f760518fcd914761d55711a5b50

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_powerpc.deb
    Size/MD5 checksum:    71268 76e90f478e1093960e658a52844866c8

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:   334940 4ef64b3bcb468e1fe5a2c909cfb4ddf8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:    97054 93905182ac8facaff277ba7742c6cfad

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:   104236 ad9aa683274dc8c4ee43ea56f543ee83

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:   130690 3628ccc4160671ae7509402e7b5a4415
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:   115260 dd4ffc92040a03a548995219c99bf86b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:    71262 de683f26a1b4bc8d27be7167443f3dc9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_s390.deb
    Size/MD5 checksum:    85662 e66dbbc0ea9701302cc1e773bd64220b

sparc architecture (Sun SPARC/UltraSPARC)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:    71264 dd8548615ee98c41fb901e9bfd492f8c

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:   128140 3edcf034fb65f79ee9d8d74e75ad3171

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:    84292 09b80a29ca25742211c8e2fbf2da1ef9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:   101926 2dbf682520915d0047a2afcec034d8b8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:    95530 c81ace7df7cce9a54d7d0aa344778062
  http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:   109928 68c35d2c16ca9e119e950e379a1df7f6
  http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_sparc.deb
    Size/MD5 checksum:   313106 ba1455bd0a08026a780270d26ba2ba38


  これらのファイルは次の版の安定版リリース時そちらに移されます。


- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
------>8------------>8------------>8------------>8------------>8-
-- 
Seiji Kaneko                         skaneko@xxxxxxxxxxxx
---------------------------------------------------------

Prev by Date: [debian-users:50193] [Translate] [SECURITY] [DSA 1500-1] New splitvt packages fix privilege escalation
Next by Date: [debian-users:50195] [Translate] [SECURITY] [DSA 1502-1] New wordpress packages fix multiple vulnerabilities
Previous by thread: [debian-users:50193] [Translate] [SECURITY] [DSA 1500-1] New splitvt packages fix privilege escalation
Next by thread: [debian-users:50195] [Translate] [SECURITY] [DSA 1502-1] New wordpress packages fix multiple vulnerabilities
Index(es):
- Date
- Thread