drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in devscripts (Aktualisierung)
Name: |
Ausführen beliebiger Kommandos in devscripts (Aktualisierung) |
|
ID: |
USN-847-2 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 6.06 |
|
Datum: |
Fr, 9. Oktober 2009, 16:38 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2946 |
|
Applikationen: |
devscripts |
|
Update von: |
Ausführen beliebiger Kommandos in Devscripts |
|
Originalnachricht |
--===============2014536290710939652== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="DqhR8hV3EnoxUkKN" Content-Disposition: inline
--DqhR8hV3EnoxUkKN Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-847-2 October 09, 2009 devscripts vulnerability CVE-2009-2946 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 6.06 LTS: devscripts 2.9.10-0ubuntu0.1
In general, a standard system upgrade is sufficient to effect the necessary changes.
Details follow:
USN-847-1 fixed vulnerabilities in devscripts. This update provides the corresponding updates for Ubuntu 6.06 LTS.
Original advisory details:
Raphael Geissert discovered that uscan, a part of devscripts, did not properly sanitize its input when processing pathnames. If uscan processed a crafted filename for a file on a remote server, an attacker could execute arbitrary code with the privileges of the user invoking the program.
Updated packages for Ubuntu 6.06 LTS:
Source archives:
devscripts_2.9.10-0ubuntu0.1.dsc Size/MD5: 715 46fa68657534c79a7742a7561d149764 devscripts_2.9.10-0ubuntu0.1.tar.gz Size/MD5: 341732 84e4aacdd4495ad4df1e5ec2742bbc7e
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
devscripts_2.9.10-0ubuntu0.1_amd64.deb Size/MD5: 296176 c136944ba913bad8591d288ad78ac856
i386 architecture (x86 compatible Intel/AMD):
devscripts_2.9.10-0ubuntu0.1_i386.deb Size/MD5: 295818 44d8620d6604b9ac51f52e4d4cd0c7dc
powerpc architecture (Apple Macintosh G3/G4/G5):
devscripts_2.9.10-0ubuntu0.1_powerpc.deb Size/MD5: 298350 a0bdd4a041737e983350b94cae6273d3
sparc architecture (Sun SPARC/UltraSPARC):
devscripts_2.9.10-0ubuntu0.1_sparc.deb Size/MD5: 296218 613ed8459d8ac5ad221d71ec24c08464
--DqhR8hV3EnoxUkKN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkrPSU4ACgkQW0JvuRdL8BocAwCfQxe4wqG2buhpovapj7T+8yt0 wLwAn3hkPKsRlSkAzir7WQaAyQaojasY =3R8c -----END PGP SIGNATURE-----
--DqhR8hV3EnoxUkKN--
--===============2014536290710939652== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============2014536290710939652==--
|
|
|
|