drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Ausführen beliebiger Kommandos in mountall
Name: |
Ausführen beliebiger Kommandos in mountall |
|
ID: |
USN-985-1 |
|
Distribution: |
Ubuntu |
|
Plattformen: |
Ubuntu 10.04 LTS |
|
Datum: |
Do, 9. September 2010, 09:37 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2961 |
|
Applikationen: |
mountall |
|
Originalnachricht |
--===============1114801473648466974== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="rwEMma7ioTxnRzrJ" Content-Disposition: inline
--rwEMma7ioTxnRzrJ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
=========================================================== Ubuntu Security Notice USN-985-1 September 08, 2010 mountall vulnerability CVE-2010-2961 ===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 10.04 LTS
This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the following package versions:
Ubuntu 10.04 LTS: mountall 2.15.2
In general, a standard system update will make all the necessary changes.
Details follow:
Alasdair MacGregor discovered that mountall created a udev rule file with world-writable permissions. A local attacker could exploit this under certain conditions to cause udev to execute arbitrary commands as the root user.
Updated packages for Ubuntu 10.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2.dsc Size/MD5: 972 92e488f0e51ab3c20ddf537fdc92fd24 mountall_2.15.2.tar.gz Size/MD5: 564582 036e6a108a9bc0c2155a7226ad5437c3
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
mountall_2.15.2_amd64.deb Size/MD5: 56016 76dc051afb8a20077f0c0b709369d6c0
i386 architecture (x86 compatible Intel/AMD):
mountall_2.15.2_i386.deb Size/MD5: 52384 42ebb3fa3f81ed1a08270d48a8f6b367
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/m/mountall/mountall_2.15.2_powerpc.deb Size/MD5: 55780 cf51c1268b9b188150f9d2131882d8bb
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/m/mountall/mountall_2.15.2_sparc.deb Size/MD5: 56758 276c85acaf4feaa54c53615f0a572b8b
--rwEMma7ioTxnRzrJ Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.10 (GNU/Linux) Comment: Kees Cook <kees@outflux.net>
iEYEARECAAYFAkyH8dMACgkQH/9LqRcGPm256QCfSuPFHy1Ur0SQ7XHsj+BohFR1 SM0AnRGXOZxQ5picFGhIWIZAIc1qpOtn =bPIQ -----END PGP SIGNATURE-----
--rwEMma7ioTxnRzrJ--
--===============1114801473648466974== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline
-- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
--===============1114801473648466974==--
|
|
|
|