Alerta de Segurança Debian

DSA-174-1 heartbeat -- buffer overflow

Data do Alerta:
14 Out 2002
Pacotes Afetados:
heartbeat
Vulnerável:
Sim
Referência à base de dados de segurança:
No dicionário CVE do Mitre: CVE-2002-1215.
Informações adicionais:

Nathan Wallwork descobriu um buffer overflow no heartbeat, um subsistema para alta disponibilidade no Linux. Um atacante remoto pode enviar um pacote UCP alterado que causa um overflow no buffer, levando o heartbeat a executar código arbitrário como root.

Esse problema foi corrigido na versão 0.4.9.0l-7.2 para a atual distribuição estável (woody) e na versão 0.4.9.2-1 para a distribuição instável (sid). A antiga distribuição estável (potato) não possui esse pacote.

Nós recomendamos que você atualize seu pacote heartbeat imediatamente se seus servidores conectados a internet rodam o heartbeat.

Corrigido em:

Debian GNU/Linux 3.0 (woody)

Fonte:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2.dsc
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2.diff.gz
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l.orig.tar.gz
Componente independente de arquitetura:
http://security.debian.org/pool/updates/main/h/heartbeat/ldirectord_0.4.9.0l-7.2_all.deb
Alpha:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_alpha.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_alpha.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_alpha.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_arm.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_arm.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_arm.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_i386.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_i386.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_i386.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_ia64.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_ia64.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_ia64.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_ia64.deb
HP Precision:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_hppa.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_hppa.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_hppa.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_m68k.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_m68k.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_m68k.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_mips.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_mips.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_mips.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_mipsel.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_mipsel.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_mipsel.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_powerpc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_powerpc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_powerpc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_s390.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_s390.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_s390.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/h/heartbeat/heartbeat_0.4.9.0l-7.2_sparc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith-dev_0.4.9.0l-7.2_sparc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/libstonith0_0.4.9.0l-7.2_sparc.deb
http://security.debian.org/pool/updates/main/h/heartbeat/stonith_0.4.9.0l-7.2_sparc.deb

Checksums MD5 dos arquivos listados estão disponíveis no alerta original.