Alerta de Segurança Debian

DSA-243-1 kdemultimedia -- várias vulnerabilidades

Data do Alerta:
24 Jan 2003
Pacotes Afetados:
kdemultimedia
Vulnerável:
Sim
Referência à base de dados de segurança:
No dicionário CVE do Mitre: CVE-2002-1393.
Informações adicionais:

A equipe do KDE descobriu várias vulnerabilidades no ambiente do K Desktop. Em algumas instâncias o KDE falha em fazer o quote apropriado dos parâmetros e instruções passados a uma shell de comando para execução. Esses parâmetros podem incorporar dados como URLs, nomes de arquivos e endereços de e-mail, uma página web ou arquivos em um sistema de arquivos de rede ou de outra fonte não confiável.

Com esses dados cuidadosamente trabalhados um atacante pode conseguir executar comandos arbitrariamente em um sistema vulnerável usando a conta e os privilégios da vítima. O Projeto KDE não está ciente da existência de qualquer exploração dessas vulnerabilidades. Os patches também fornecem melhor segurança e checam os dados de fontes não confiáveis mais estritamente em múltiplos locais.

Para a atual distribuição estável (woody), esses problemas foram corrigidos na versão 2.2.2-8.2.

A antiga distribuição estável (potato) não contém os pacotes do KDE.

Para a distribuição instável (sid), esses problemas provavelmente não serão corrigidos mas novos pacotes para o KDE 3.1 para a sid são esperados para esse ano.

Nós recomendamos que você atualize seus pacotes do KDE.

Corrigido em:

Debian GNU/Linux 3.0 (woody)

Fonte:
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia_2.2.2-8.2.dsc
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia_2.2.2-8.2.diff.gz
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia_2.2.2.orig.tar.gz
Alpha:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_alpha.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_arm.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_i386.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_ia64.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_ia64.deb
HPPA:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_hppa.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_m68k.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_m68k.deb
PowerPC:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_powerpc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_s390.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/k/kdemultimedia/artsbuilder_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kdemultimedia-dev_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmid_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmidi_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kmix_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/kscd_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/libarts-mpeglib_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/mpeglib_2.2.2-8.2_sparc.deb
http://security.debian.org/pool/updates/main/k/kdemultimedia/noatun_2.2.2-8.2_sparc.deb

Checksums MD5 dos arquivos listados estão disponíveis no alerta original.