[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[debian-users:50245] [Translate] [Translate] [SECURITY] [DSA 1521-1] New lighttpd packages fix arbitrary file disclosure

From: Seiji Kaneko <skaneko@xxxxxxxxxxxx>
Subject: [debian-users:50245] [Translate] [Translate] [SECURITY] [DSA 1521-1] New lighttpd packages fix arbitrary file disclosure
Date: Mon, 17 Mar 2008 22:50:24 +0900
List-help: <mailto:debian-users-ctl@debian.or.jp?body=help>
List-id: debian-users.debian.or.jp
List-owner: <mailto:debian-users-admin@debian.or.jp>
List-post: <mailto:debian-users@debian.or.jp>
List-software: fml [fml 4.0.3 release (20011202/4.0.3)]
List-unsubscribe: <mailto:debian-users-ctl@debian.or.jp?body=unsubscribe>
X-ml-info: If you have a question, send e-mail with the body "help" (without quotes) to the address debian-users-ctl@debian.or.jp; help=<mailto:debian-users-ctl@debian.or.jp?body=help>
X-ml-name: debian-users
X-mlserver: fml [fml 4.0.3 release (20011202/4.0.3)]; post only (only members can post)
X-spam-checker-version: SpamAssassin 3.1.7-deb (2006-10-05) on osdn.debian.or.jp
X-spam-level:
X-spam-status: No, score=-2.4 required=10.0 tests=KI autolearn=disabled version=3.1.7-deb
Message-id: <47DE7718.1060200@xxxxxxxxxxxx>
X-mail-count: 50245
User-agent: Thunderbird 2.0.0.12 (Macintosh/20080213)

かねこです。
URL 等は Debian-security-announce メーリングリストの元記事を確認
ください。
------>8------------>8------------>8------------>8------------>8-

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1521-1                  security@debian.org
http://www.debian.org/security/                               Steve Kemp
March 16, 2008                        http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : lighttpd
Vulnerability  : ファイル漏洩
Problem type   : リモート
Debian-specific: いいえ
CVE Id(s)      : CVE-2008-1270

Julien Cayzac さんにより、最小のメモリフットプリントで動作する高速なウェ
ブサーバ lighttpd が、特定の条件下でシステムの任意のファイルの読み出しが
可能であることが発見されました。この問題は、標準でない設定のもとでのみ攻
撃可能です。

安定版 (stable) ディストリビューション (etch) では、この問題はバージョン
1.4.13-4etch6 で修正されています。

直ぐに lighttpd パッケージをアップグレードすることを勧めます。



アップグレード手順
------------------

wget url
        	でファイルを取得できます。
dpkg -i file.deb
                で参照されたファイルをインストールできます。

apt-get パッケージマネージャを用いている場合には、本メールのフッタ記載の
行を sources.list に加えて、

apt-get update
        を実行して内部データベースを更新し、
apt-get upgrade
        によって修正されたパッケージをインストールしてください。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。


Debian GNU/Linux 4.0 alias etch
- -------------------------------

ソースアーカイブ:

  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6.dsc
    Size/MD5 checksum:     1098 3e5a62a7162734998177e8707d2dba02
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6.diff.gz
    Size/MD5 checksum:    37066 853e653e4b56e0065b7d072bfdb038b9

アーキテクチャに依存しないパッケージ:


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-doc_1.4.13-4etch6_all.deb
    Size/MD5 checksum:    99510 38af003d4b49531a371c58eec8c92797

alpha architecture (DEC Alpha)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:    61252 f9a572ac4ece6cda80883e9ece59cf99

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:    64492 6d0802043b33391abf217b605ade53c6

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:   318848 64225fd5e10a77386763b28a3fa6b310

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:    71726 8797d97bd147f2f502741d790d42781e

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:    59494 5537c07a1bf16c607d42cbb24af35b0e

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_alpha.deb
    Size/MD5 checksum:    64924 e179a9988bc2b04a0188301040f7eb02

amd64 architecture (AMD x86_64 (AMD64))


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:    60662 281bac93cddf6ed6fcd907dac5eb0720

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:    69818 74394f7d4528636f962133efa4a738da

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:    63506 b336b9d3d1836d2d06c5feaaefb8366e

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:    63806 6613f85008260c83222a2b5a8d183d50

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:   297130 9a00e9837f11cb5647491e28bf8da877

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_amd64.deb
    Size/MD5 checksum:    59060 1b1864819d7892f9dc1834ece83ba39f

arm architecture (ARM)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:    62786 e91afeac0b95ae32d9c346bf8b56ff2b

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:    69506 928bd56baa76d302d2637c3edafa966a

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:    58604 e060ddc287c0f62485c3b450f781a9c5
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:   286248 6915b4c299334a0aa608e69016579947

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:    60736 c1dba99fad76965ea148addcedbe8d1e

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_arm.deb
    Size/MD5 checksum:    62996 441fe045d312d83cd9c0abfea000fd04

hppa architecture (HP PA RISC)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:    65382 9891f2e251cba3716cc7318244f12191

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:    64926 32155b4baafa529b01f8fa93d35c1016
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:   324246 b391c9f49db494a231b2c6bbe6b0a17c

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:    61704 a445b749e09728bbcc7aa2810262c316

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:    72912 f1b011512b9ffe681684aedc1100fd96

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_hppa.deb
    Size/MD5 checksum:    59856 e4d9e12d39cedc57301dec75d3f0f9bc

i386 architecture (Intel ia32)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:    70858 38d84f5a4dc0b5e98d8c4d8753720721

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:    59004 e89b0b96998623b78e0e756ecb5c64e5

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:    63614 3f91b5416bade664bac825c5f55b1760

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:    63810 f5c6a0fe13e228a2c97f7c0f9134139f
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:   288986 020ae1cd38f72be751c3d2339322e37d

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_i386.deb
    Size/MD5 checksum:    60764 6a866a4be8bb00bc89a19fd923892ac3

ia64 architecture (Intel ia64)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:    67428 8057dbf996587a0dab7dfb830149596a

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:    67270 47e8df0e90b8a94399140f8e094cf193

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:    76970 3ec5566bf7884996d3b2c1cff05934d3

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:    62972 9eba69d6fbceecf7ab25847fe6123d45
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:   403368 49e9eeff7722157ec9240b693bdd7a8b

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_ia64.deb
    Size/MD5 checksum:    61096 a431a7e8cc1ed5e7c03a986062a71cb6

mips architecture (MIPS (Big Endian))


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:    59854 8a771e4cf424fc2db2ea32cc2e51e97b
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:   296016 08c0da736b8529d6a76cfc3cd482b2e9

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:    62442 8f42b63450914e64e2eee69b4bdbfe90

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:    69146 2bc52d53fb5fe04fb1252c31b280a418

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:    62562 bd6ea27d76c2c61e3c744b4f9bdb00ce

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_mips.deb
    Size/MD5 checksum:    58480 939cbd552f397780de40b834908b7130

mipsel architecture (MIPS (Little Endian))


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:    69928 9ac409e25d6e7b9e4b1cb4ad13ed9632

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:    60680 343e11ab45cab336396806f7f221945d

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:    63286 886e4bc3478309c1656f7d6bd977f2ed

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:    59192 e4cc8d162b281518d52a739eb318f041

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:   297128 89cdce8b7cd2690e28b95c3d783c9154

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_mipsel.deb
    Size/MD5 checksum:    63450 36f870435ee48223a8ced7e6613a169d

powerpc architecture (PowerPC)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:    60566 d4b1ad36213cbdf6065f239aa472b498

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:    65034 845332f6d09f3f0692a6d18963dcfcc4

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:    62380 6466c3be37fe7fe26f7e83b3c2ead222

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:    65306 aaaefd16bdf02e178aee3343c18cc17d

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:    71682 a4bb5ec71a26f40b0a5cef12bb850a40

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_powerpc.deb
    Size/MD5 checksum:   323712 eb5edc0b82555ec99996121925c4d0ab

s390 architecture (IBM S/390)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:    60994 4f546530cae504799f369f806d00eb51
  http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:   307112 25b76d9b1971949e8091e2c4c0430c58

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:    64160 30ad6c09af94176abd6fb010ee66bb25

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:    64548 c03eed9df63c727831ff4993703b98c0

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:    71274 b8a2712beb266769a25219bcaccceeac

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_s390.deb
    Size/MD5 checksum:    59486 706725ae2ff5257a52467e7db30c0a14

sparc architecture (Sun SPARC/UltraSPARC)


http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-webdav_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:    69798 d85012884750a5d423d2761f62dd2ec9

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-trigger-b4-dl_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:    60434 cad01450236fec8a2a57504aea63426c

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-cml_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:    63344 ebf4c95b0d1cfc06e3d37afad107afd4

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-mysql-vhost_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:    58776 76a058d44cef9963903648eefef0fa7a

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd-mod-magnet_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:    63322 5d433e4a4b0801256be2170bf0ba3931

http://security.debian.org/pool/updates/main/l/lighttpd/lighttpd_1.4.13-4etch6_sparc.deb
    Size/MD5 checksum:   284060 2c0aafcaa9c5490e8ae9f8e73d7b7a22


  これらのファイルは次の版の安定版リリース時そちらに移されます。


- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
------>8------------>8------------>8------------>8------------>8-
--
Seiji Kaneko

Prev by Date: [debian-users:50244] 2/17 マイナーリビジョンアップ後、VMwareサーバでエラー
Next by Date: [debian-users:50246] [Translate] [SECURITY] [DSA 1493-2] New sdl-image1.2 packages fix arbitrary code execution
Previous by thread: [debian-users:50275] Re: 2/17マイナーリビジョンアップ後、VMwareサーバでエラー
Next by thread: [debian-users:50246] [Translate] [SECURITY] [DSA 1493-2] New sdl-image1.2 packages fix arbitrary code execution
Index(es):
- Date
- Thread