Unsichere Permissions des PID-Files von apcupsd
ID: | MDKSA-2000:077 |
Distribution: | Mandrake |
Plattformen: | Mandrake 7.2 |
Datum: | Di, 12. Dezember 2000, 12:00 |
Referenzen: | Keine Angabe |
Applikationen: | apcupsd |
Originalnachricht |
|
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ________________________________________________________________________ Linux-Mandrake Security Update Advisory ________________________________________________________________________ Package name: apcupsd Date: December 12th, 2000 Advisory ID: MDKSA-2000:077 Affected versions: 7.2 ________________________________________________________________________ Problem Description: A problem exists with the apcupsd daemon. During startup, apcupsd creates a PID file in /var/run with the ID of the daemon process. This file is used by the shutdown script to kill the daemon process. The /var/run/apcupsd.pid file is created with mode 666 permissions, meaning it is world-writeable. A malicious user can overwrite the file with arbitrary process IDs and those proceses will be killed instead of the apcupsd process during the restart or stop of the apcupsd daemon. ________________________________________________________________________ Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command: rpm --checksig package.rpm You can get the GPG public key of the Linux-Mandrake Security Team at http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS If you use MandrakeUpdate, the verification of md5 checksum and GPG signature is performed automatically for you. Linux-Mandrake 7.2: 13d0d7582dc9539fd43165caea173bc0 7.2/RPMS/apcupsd-3.8.0-1.1mdk.i586.rpm 4312c2eea1bc86e720c05be44555bd83 7.2/SRPMS/apcupsd-3.8.0-1.1mdk.src.rpm ________________________________________________________________________ To upgrade automatically, use =AB MandrakeUpdate =BB. If you want to upgrade manually, download the updated package from one of our FTP server mirrors and uprade with "rpm -Fvh *.rpm". You can download the updates directly from one of the mirror sites listed at: http://www.linux-mandrake.com/en/ftp.php3. Updated packages are available in the "updates/[ver]/RPMS/" directory. For example, if you are looking for an updated RPM package for Linux-Mandrake 7.2, look for it in "updates/7.2/RPMS/". Updated source RPMs are available as well, but you generally do not need to download them. Please be aware that sometimes it takes the mirrors a few hours to update. You can view other security advisories for Linux-Mandrake at: http://www.linux-mandrake.com/en/security/ If you want to report vulnerabilities, please contact security@linux-mandrake.com ________________________________________________________________________ Linux-Mandrake has two security-related mailing list services that anyone can subscribe to: security-announce@linux-mandrake.com Linux-Mandrake's security announcements mailing list. Only announcements are sent to this list and it is read-only. security-discuss@linux-mandrake.com Linux-Mandrake's security discussion mailing list. This list is open to anyone to discuss Linux-Mandrake security specifically and Linux security in general. To subscribe to either list, send a message to sympa@linux-mandrake.com with "subscribe [listname]" in the body of the message. To remove yourself from either list, send a message to sympa@linux-mandrake.com with "unsubscribe [listname]" in the body of the message. To get more information on either list, send a message to sympa@linux-mandrake.com with "info [listname]" in the body of the message. Optionally, you can use the web interface to subscribe to or unsubscribe from either list: http://www.linux-mandrake.com/en/flists.php3#security ________________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team |