Debians sikkerhedsbulletin

DSA-1177-1 usermin -- programmeringsfejl

Rapporteret den:
15. sep 2006
Berørte pakker:
usermin
Sårbar:
Ja
Referencer i sikkerhedsdatabaser:
I Debians fejlsporingssystem: Fejl 374609.
I Mitres CVE-ordbog: CVE-2006-4246.
Yderligere oplysninger:

Hendrik Weimer har opdaget at det var muligt for almindelige brugere at slå loginskallen til root-kontoen fra gennem usermin, et webbaseret administrationsværktøj.

I den stabile distribution (sarge) er dette problem rettet i version 1.110-3.1.

I opstrømsdistributionen er dette problem rettet i version 1.220.

Vi anbefaler at du opgraderer din usermin-pakke.

Rettet i:

Debian GNU/Linux 3.1 (sarge)

Kildekode:
http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.dsc
http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.diff.gz
http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110.orig.tar.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/u/usermin/usermin-at_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-changepass_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-chfn_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-commands_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-cron_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-cshrc_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-fetchmail_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-forward_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-gnupg_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-htaccess_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-htpasswd_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-mailbox_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-man_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-mysql_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-plan_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-postgresql_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-proc_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-procmail_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-quota_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-schedule_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-shell_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-spamassassin_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-ssh_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-tunnel_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-updown_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin-usermount_1.110-3.1_all.deb
http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1_all.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.