Login
Newsletter
Werbung

Sicherheit: Unsichere Verwendung temporärer Dateien in audacity
Aktuelle Meldungen Distributionen
Name: Unsichere Verwendung temporärer Dateien in audacity
ID: MDVSA-2008:074
Distribution: Mandriva
Plattformen: Mandriva Corporate 3.0, Mandriva 2007.1, Mandriva 2008.0
Datum: Do, 20. März 2008, 23:40
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6061
Applikationen: Audacity

Originalnachricht

This is a multi-part message in MIME format...

------------=_1206052812-11275-1509


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:074
http://www.mandriva.com/security/
_______________________________________________________________________

Package : audacity
Date : March 20, 2008
Affected: 2007.1, 2008.0, Corporate 3.0
_______________________________________________________________________

Problem Description:

Audacity creates a temporary directory with a predictable name without
checking for previous existence of that directory, which allows local
users to cause a denial of service (recording deadlock) by creating
the directory before Audacity is run. This issue can also be leveraged
to delete arbitrary files or directories via a symlink attack.

The updated package fixes the issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6061
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.1:
5ebb4356f5e9410fb34fd13b1d9f52e0
2007.1/i586/audacity-1.3.2-4.1mdv2007.1.i586.rpm
b209fd344cd78af953a44187221e24b4
2007.1/SRPMS/audacity-1.3.2-4.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
495b67476845f9831c5aa509cb4fed56
2007.1/x86_64/audacity-1.3.2-4.1mdv2007.1.x86_64.rpm
b209fd344cd78af953a44187221e24b4
2007.1/SRPMS/audacity-1.3.2-4.1mdv2007.1.src.rpm

Mandriva Linux 2008.0:
ba5c283112363eb7a5ba759ee19db460
2008.0/i586/audacity-1.3.3-1.1mdv2008.0.i586.rpm
07e566b52f9c14b4fb457d317ace5132
2008.0/SRPMS/audacity-1.3.3-1.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
b6e400b8db075cb58e1a3d739fbcd45c
2008.0/x86_64/audacity-1.3.3-1.1mdv2008.0.x86_64.rpm
07e566b52f9c14b4fb457d317ace5132
2008.0/SRPMS/audacity-1.3.3-1.1mdv2008.0.src.rpm

Corporate 3.0:
8b6718bc8dfa06a369b56d4b54506c82
corporate/3.0/i586/audacity-1.2.0-1.1.C30mdk.i586.rpm
646559674bbb1a57cb867b8122a1794d
corporate/3.0/SRPMS/audacity-1.2.0-1.1.C30mdk.src.rpm

Corporate 3.0/X86_64:
de7a02ceda34724803ac961ba153523b
corporate/3.0/x86_64/audacity-1.2.0-1.1.C30mdk.x86_64.rpm
646559674bbb1a57cb867b8122a1794d
corporate/3.0/SRPMS/audacity-1.2.0-1.1.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFH4rwWmqjQ0CJFipgRArlcAKDsbLVqsjVq8eas/qTg0ldnlrWDvACg6EZB
535/VzbjQgKqHSk4AeGhRlA=
=2iVi
-----END PGP SIGNATURE-----


------------=_1206052812-11275-1509
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1206052812-11275-1509--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung