Säkerhetsbulletin från Debian
DSA-301-1 libgtop -- buffertspill
- Rapporterat den:
- 2003-05-07
- Berörda paket:
- libgtop
- Sårbara:
- Ja
- Referenser i säkerhetsdatabaser:
- I Bugtraq-databasen (hos SecurityFocus): BugTraq-id 3594.
I Mitres CVE-förteckning: CVE-2001-0928. - Ytterligare information:
-
Bakgrundsservern gtop, vilken används för att övervaka andra maskiner, innehåller ett buffertspill som kunde utnyttjas av en angripare till att exekvera godtycklig kod med serverprocessens privilegier. Om den startas som root släpper processen rootprivilegierna och väljer som standard uid och gid 99.
Detta fel rättades tidigare av DSA-098, men en av rättelserna kom inte med i senare versioner av libgtop.
För den stabila utgåvan (Woody) har detta problem rättats i version 1.0.13-3.1.
För den gamla stabila utgåvan (Potato) rättades detta problem i DSA-098.
För den instabila utgåvan (Sid) har detta problem rättats i version 1.0.13-4.
Vi rekommenderar att ni uppgraderar ert libgtop-paket.
- Rättat i:
-
Debian GNU/Linux 3.0 (woody)
- Källkod:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop_1.0.13-3.1.dsc
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop_1.0.13-3.1.diff.gz
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop_1.0.13.orig.tar.gz
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop_1.0.13-3.1.diff.gz
- Alpha:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_alpha.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_alpha.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_alpha.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_arm.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_arm.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_arm.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_i386.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_i386.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_i386.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_ia64.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_ia64.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_ia64.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_hppa.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_hppa.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_hppa.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_m68k.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_m68k.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_m68k.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_mips.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_mips.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_mips.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_mipsel.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_mipsel.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_mipsel.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_powerpc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_powerpc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_powerpc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_s390.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_s390.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_s390.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-daemon_1.0.13-3.1_sparc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_sparc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop1_1.0.13-3.1_sparc.deb
- http://security.debian.org/pool/updates/main/libg/libgtop/libgtop-dev_1.0.13-3.1_sparc.deb
MD5-kontrollsummor för dessa filer finns i originalbulletinen.
