Ausführen beliebiger Kommandos in devscripts (Aktualisierung)
ID: | USN-847-2 |
Distribution: | Ubuntu |
Plattformen: | Ubuntu 6.06 |
Datum: | Fr, 9. Oktober 2009, 16:38 |
Referenzen: | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2946 |
Applikationen: | devscripts |
Update von: | Ausführen beliebiger Kommandos in Devscripts |
Originalnachricht |
|
--===============2014536290710939652== Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="DqhR8hV3EnoxUkKN" Content-Disposition: inline --DqhR8hV3EnoxUkKN Content-Type: text/plain; charset=us-ascii Content-Disposition: inline =========================================================== Ubuntu Security Notice USN-847-2 October 09, 2009 devscripts vulnerability CVE-2009-2946 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 6.06 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 6.06 LTS: devscripts 2.9.10-0ubuntu0.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: USN-847-1 fixed vulnerabilities in devscripts. This update provides the corresponding updates for Ubuntu 6.06 LTS. Original advisory details: Raphael Geissert discovered that uscan, a part of devscripts, did not properly sanitize its input when processing pathnames. If uscan processed a crafted filename for a file on a remote server, an attacker could execute arbitrary code with the privileges of the user invoking the program. Updated packages for Ubuntu 6.06 LTS: Source archives: http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1.dsc Size/MD5: 715 46fa68657534c79a7742a7561d149764 http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1.tar.gz Size/MD5: 341732 84e4aacdd4495ad4df1e5ec2742bbc7e amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1_amd64.deb Size/MD5: 296176 c136944ba913bad8591d288ad78ac856 i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1_i386.deb Size/MD5: 295818 44d8620d6604b9ac51f52e4d4cd0c7dc powerpc architecture (Apple Macintosh G3/G4/G5): http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1_powerpc.deb Size/MD5: 298350 a0bdd4a041737e983350b94cae6273d3 sparc architecture (Sun SPARC/UltraSPARC): http://security.ubuntu.com/ubuntu/pool/main/d/devscripts/devscripts_2.9.10-0ubuntu0.1_sparc.deb Size/MD5: 296218 613ed8459d8ac5ad221d71ec24c08464 --DqhR8hV3EnoxUkKN Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iEYEARECAAYFAkrPSU4ACgkQW0JvuRdL8BocAwCfQxe4wqG2buhpovapj7T+8yt0 wLwAn3hkPKsRlSkAzir7WQaAyQaojasY =3R8c -----END PGP SIGNATURE----- --DqhR8hV3EnoxUkKN-- --===============2014536290710939652== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce --===============2014536290710939652==-- |