Säkerhetsbulletin från Debian
DSA-835-1 cfengine -- osäkra temporära filer
- Rapporterat den:
- 2005-10-01
- Berörda paket:
- cfengine
- Sårbara:
- Ja
- Referenser i säkerhetsdatabaser:
- I Mitres CVE-förteckning: CVE-2005-2960, CVE-2005-3137.
- Ytterligare information:
-
Javier Fernández-Sanguino Peña upptäckte flera platser där osäkra temporära filer används i cfengine, ett verktyg för att konfigurera och underhålla maskiner i ett nätverk, vilket kunde utnyttjas genom att angripa symboliska länkar för att skriva över godtyckliga filer som ägs av användaren som kör cfengine, troligtvis root.
För den gamla stabila utgåvan (Woody) har dessa problem rättats i 1.6.3-9woody1.
För den stabila utgåvan (Sarge) har dessa problem rättats i 1.6.5-1sarge1.
För den instabila utgåvan (Sid) kommer dessa problem att rättas inom kort.
Vi rekommenderar att ni uppgraderar ert cfengine-paket.
- Rättat i:
-
Debian GNU/Linux 3.0 (woody)
- Källkod:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.dsc
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.diff.gz
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3.orig.tar.gz
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1.diff.gz
- Arkitekturoberoende komponent:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine-doc_1.6.3-9woody1_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_alpha.deb
- ARM:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.3-9woody1_sparc.deb
Debian GNU/Linux 3.1 (sarge)
- Källkod:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1.dsc
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1.diff.gz
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5.orig.tar.gz
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1.diff.gz
- Arkitekturoberoende komponent:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine-doc_1.6.5-1sarge1_all.deb
- Alpha:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_alpha.deb
- AMD64:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_amd64.deb
- ARM:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_arm.deb
- Intel IA-32:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_i386.deb
- Intel IA-64:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_ia64.deb
- HPPA:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_hppa.deb
- Motorola 680x0:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_m68k.deb
- Big endian MIPS:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_mips.deb
- Little endian MIPS:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_mipsel.deb
- PowerPC:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_powerpc.deb
- IBM S/390:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_s390.deb
- Sun Sparc:
- http://security.debian.org/pool/updates/main/c/cfengine/cfengine_1.6.5-1sarge1_sparc.deb
MD5-kontrollsummor för dessa filer finns i originalbulletinen.