drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in Logwatch
Name: |
Ausführen beliebiger Kommandos in Logwatch |
|
ID: |
USN-1078-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 8.04 LTS, Ubuntu 9.10, Ubuntu 10.04 LTS, Ubuntu 10.10 |
|
Datum: |
Di, 1. März 2011, 08:18 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1018 |
|
Applikationen: |
Logwatch |
|
Originalnachricht |
--===============0612349278261034843== Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="HcccYpVZDxQ8hzPO" Content-Disposition: inline
--HcccYpVZDxQ8hzPO Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-1078-1 March 01, 2011 logwatch vulnerability CVE-2011-1018 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS Ubuntu 9.10 Ubuntu 10.04 LTS Ubuntu 10.10
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 8.04 LTS: logwatch 7.3.6-1ubuntu1.1
Ubuntu 9.10: logwatch 7.3.6.cvs20090906-1ubuntu1.1
Ubuntu 10.04 LTS: logwatch 7.3.6.cvs20090906-1ubuntu2.1
Ubuntu 10.10: logwatch 7.3.6.cvs20090906-1ubuntu3.1
In general, a standard system update will make all the necessary changes.
Details follow:
Dominik George discovered that logwatch did not properly sanitize log file names that were passed to the shell as part of a command. If a remote attacker were able to generate specially crafted filenames (for example, via Samba logging), they could execute arbitrary code with root privileges.
Updated packages for Ubuntu 8.04 LTS:
Source archives:
logwatch_7.3.6-1ubuntu1.1.diff.gz Size/MD5: 15656 31f40f13457aeb20f21c2cfd2ad460b8 logwatch_7.3.6-1ubuntu1.1.dsc Size/MD5: 1413 037612770004ad6b553b8c5b02840350 logwatch_7.3.6.orig.tar.gz Size/MD5: 297296 937d982006b2a76a83edfcfd2e5a9d7d
Architecture independent packages:
logwatch_7.3.6-1ubuntu1.1_all.deb Size/MD5: 307458 da69f492898cee9560bb752b87e8af1c
Updated packages for Ubuntu 9.10:
Source archives:
logwatch_7.3.6.cvs20090906-1ubuntu1.1.diff.gz Size/MD5: 87133 eb1efb5614967c87dcee5a0627db91a2 logwatch_7.3.6.cvs20090906-1ubuntu1.1.dsc Size/MD5: 1932 b32ef1d8ada8a539c73a6e8da732a7c8 logwatch_7.3.6.cvs20090906.orig.tar.gz Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40
Architecture independent packages:
logwatch_7.3.6.cvs20090906-1ubuntu1.1_all.deb Size/MD5: 400012 6a943f596ed79064930b328a7058357e
Updated packages for Ubuntu 10.04 LTS:
Source archives:
logwatch_7.3.6.cvs20090906-1ubuntu2.1.diff.gz Size/MD5: 87803 0bba6a4701307c1abb9fea16c15c11fd logwatch_7.3.6.cvs20090906-1ubuntu2.1.dsc Size/MD5: 1932 d87291a904f97e6c13dc15f0c996eeb4 logwatch_7.3.6.cvs20090906.orig.tar.gz Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40
Architecture independent packages:
logwatch_7.3.6.cvs20090906-1ubuntu2.1_all.deb Size/MD5: 401512 d68a24ddbbfde6880fdbff79290bf344
Updated packages for Ubuntu 10.10:
Source archives:
logwatch_7.3.6.cvs20090906-1ubuntu3.1.diff.gz Size/MD5: 90181 971dda35e4fa086a1bab9b9d7814a0df logwatch_7.3.6.cvs20090906-1ubuntu3.1.dsc Size/MD5: 1932 388d1296df12dc1f46d0ddebfe6bf6ae logwatch_7.3.6.cvs20090906.orig.tar.gz Size/MD5: 338115 b12229916e0a5891a8c1da59afb61e40
Architecture independent packages:
logwatch_7.3.6.cvs20090906-1ubuntu3.1_all.deb Size/MD5: 398960 d7967323e366778cc5c79701aa1dc156
--HcccYpVZDxQ8hzPO Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux)
iQIcBAEBCgAGBQJNbFE+AAoJEC8Jno0AXoH0/4AP/1Yqx+29G0wNZ18sIuNNOqbx EDX4Hxo6pzXaq+FwkWr1FSP1YywS4Z+YfXVikMOsLSv37+irLQJySKfhWl7Drm9o iru16qN0jn5VeJFsKOQpxLzCXnsBrpy7JxPgfZp4b5q4cfbKDJIl6tNCjDfrUlsQ XLEwEn/q12XY6855Df2j0ECibbvhyCnG/HXbuNVKaHYJUSvEWUsocELjgq0FeQug HFiGmGAeYKMxwrnuTK5HAF0WH+Op5/5mZFqBvMd8hksgaOT6hy42J6Iqiq9/99Yz 4or/mdeNmyF5mLXRvP0YH5HzPhfAjUTpPG+gCkg0cQHRRlDEXiTRpc5lxQQ5G+ph 31g6WpDpLEbFnDo1q+6+i8o4oXUOc8NUZ762OjvfX1xJ2XmLFvjz13Sut/muYIZ4 4q4JBDctCsuyjeELrMIJdaeRNARSuQtUIec61WRx01Js/wox0S3ETowaUjVjPtqy aKBGMn6VgTjn1D6WBD069Q+1Oy85iwoOSocnKrjFrfZ/gH0oeeT0fiIiRA4DjO9+ TbQ1FqDwKgHuAlgL65MP6IqsfM2Luh4ydPpGTNiqH/W0SQXazpMgGjJePQdmU5Mx Lqt1CwtbSURDN3d44mpUepQB8Md4kxz+vjQ4NQIBpnUAQiw6uoXLmbFj7lNxOdtb d9/dYC0Vk2Zl2CB9SXSB =ktO5 -----END PGP SIGNATURE-----
--HcccYpVZDxQ8hzPO--
--===============0612349278261034843== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============0612349278261034843==--
|
|
|
|