full-disclosure - [ MDVSA-2011:102 ] rdesktop

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 28 May 2011 17:33:00 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2011:102 ] rdesktop

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2011:102
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : rdesktop
 Date    : May 28, 2011
 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been identified and fixed in rdesktop:
 
 Directory traversal vulnerability in the disk_create function in
 disk.c in rdesktop before 1.7.0, when disk redirection is enabled,
 allows remote RDP servers to read or overwrite arbitrary files via
 a .. (dot dot) in a pathname (CVE-2011-1595).
 
 Packages for 2009.0 are provided as of the Extended Maintenance
 Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php\?cPath=149\&amp;products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1595
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2009.0:
 918cfba3795494f163c9d6ee5729a500  2009.0/i586/rdesktop-1.6.0-4.1mdv2009.0.i586.rpm 
 4510e318899bc8e082c1d2425a669fd7  2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 d2822a3d35f810b358303524f5b8b59e  2009.0/x86_64/rdesktop-1.6.0-4.1mdv2009.0.x86_64.rpm 
 4510e318899bc8e082c1d2425a669fd7  2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm

 Mandriva Linux 2010.1:
 4993b0be42653f8a24ea1b9e2cbfe02c  2010.1/i586/rdesktop-1.6.0-11.1mdv2010.2.i586.rpm 
 25e8f153a3cd642e9993cdabae897b62  2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm

 Mandriva Linux 2010.1/X86_64:
 c591e1214b1c5f92b7188b388c7cea16  2010.1/x86_64/rdesktop-1.6.0-11.1mdv2010.2.x86_64.rpm 
 25e8f153a3cd642e9993cdabae897b62  2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm

 Corporate 4.0:
 440e2625f77de1c862bf4babf1f6e8ba  corporate/4.0/i586/rdesktop-1.4.1-1.2.20060mlcs4.i586.rpm 
 3771560586bffcfe6fa7a833127c5068  corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 301f64a655c16678069e43c7d999e6fa  corporate/4.0/x86_64/rdesktop-1.4.1-1.2.20060mlcs4.x86_64.rpm 
 3771560586bffcfe6fa7a833127c5068  corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm

 Mandriva Enterprise Server 5:
 c2f395818fad39c475aadc8884ce664e  mes5/i586/rdesktop-1.6.0-4.1mdvmes5.2.i586.rpm 
 85f0ac66db03e44f2bf03434786cda8e  mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 bfdfb7a5e8818e6f7a250b849dc1f45e  mes5/x86_64/rdesktop-1.6.0-4.1mdvmes5.2.x86_64.rpm 
 85f0ac66db03e44f2bf03434786cda8e  mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFN4OWImqjQ0CJFipgRArj2AKDIaAayNWXXIbLGYPY9/n4zPYFc3gCgj9WT
5TEdWZTfsdYs7XBjHGSKfAk=
=Gffu
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/