RE: [ph.unimelb.edu.au #1013] AutoReply: [SECURITY] [DSA 675-1] New hztty packages fix local utmp exploit
Hey,
maybe someone should kick him off the list?
regards, Jasper
-----Oorspronkelijk bericht-----
Van: www-data namens Physics IT Support via RT
Verzonden: do 10-2-2005 18:22
Aan: debian-security@lists.debian.org
CC:
Onderwerp: [ph.unimelb.edu.au #1013] AutoReply: [SECURITY] [DSA 675-1] New hztty packages fix local utmp exploit
Hello,
Thank you for submitting your IT support request to School of Physics IT Support.
Request ID: [ph.unimelb.edu.au #1013]
Request Title: [SECURITY] [DSA 675-1] New hztty packages fix local utmp exploit
You will shortly receive another email indicating who will deal with your
request.
Ideally additional enquiries or information about your request should be
sent to us by responding to this email. However, please feel free to phone the person allocated to your request if you wish to discuss your request further.
Please also feel free to visit us between 11-1 if you want to talk face to
face with us.
Thank you,
support@ph.unimelb.edu.au
-------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
Debian Security Advisory DSA 675-1 security@debian.org
http://www.debian.org/security/ Martin Schulze
February 10th, 2005 http://www.debian.org/security/faq
- --------------------------------------------------------------------------
Package : hztty
Vulnerability : privilege escalation
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2005-0019
Erik Sjölund discovered that hztty, a converter for GB, Big5 and zW/HZ
Chinese encodings in a tty session, can be triggered to execute
arbitrary commands with group utmp privileges.
For the stable distribution (woody) this problem has been fixed in
version 2.0-5.2woody2.
For the unstable distribution (sid) this problem has been fixed in
version 2.0-6.1.
We recommend that you upgrade your hztty package.
Upgrade Instructions
- --------------------
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database
apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
- --------------------------------
Source archives:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2.dsc
Size/MD5 checksum: 560 921462207b6301fc73d8d2613fbaa856
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2.diff.gz
Size/MD5 checksum: 4158 910c17cb2807c3cd7d2df62d28f016a5
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0.orig.tar.gz
Size/MD5 checksum: 229189 7ec5907ad55825780274b8a77b217e21
Alpha architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_alpha.deb
Size/MD5 checksum: 153974 56ea5146bfcbed6392913a2dd697ac4d
ARM architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_arm.deb
Size/MD5 checksum: 149808 a509091afb9f413571030158d8e172d8
Intel IA-32 architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_i386.deb
Size/MD5 checksum: 149432 b5b290876059e43bf376d3f22546ad06
Intel IA-64 architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_ia64.deb
Size/MD5 checksum: 157178 652c2a0a544458bca793e3b26fe64cdc
HP Precision architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_hppa.deb
Size/MD5 checksum: 153452 ca39d351f20620a31679b21312bf5d57
Motorola 680x0 architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_m68k.deb
Size/MD5 checksum: 149214 b2a2faee53606c7a2599da89e7dc0779
Big endian MIPS architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_mips.deb
Size/MD5 checksum: 152704 2c94a83690bfaf39d26d5dadddfdd63e
Little endian MIPS architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_mipsel.deb
Size/MD5 checksum: 152788 3ef6e11ca5cec6b8e077c22b99552bc5
PowerPC architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_powerpc.deb
Size/MD5 checksum: 150376 a9742687aec8d26f95bef974bb4de317
IBM S/390 architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_s390.deb
Size/MD5 checksum: 151002 7607b570894e11c9d3eeb8c84bf5e009
Sun Sparc architecture:
http://security.debian.org/pool/updates/main/h/hztty/hztty_2.0-5.2woody2_sparc.deb
Size/MD5 checksum: 153880 3b8cc02ca85fcb1add110a01c700446f
These files will probably be moved into the stable distribution on
its next update.
- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCC5NOW5ql+IAeqTIRAiR9AKCvbXz4/JUd8Hj5t8ECR58wEU+rqACgi827
Pi/PLRfTp6jirqZuyEM0JTE=
=NcYY
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
--
To UNSUBSCRIBE, email to debian-security-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Reply to: