lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list] 
Message-ID: <m1Fa3gl-000omXC__15582.8599156395$1146507022$gmane$org@finlandia.Infodrom.North.DE>
Date: Sun, 30 Apr 2006 06:37:43 +0200 (CEST)
From: joey@...odrom.org (Martin Schulze)
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 1047-1] New resmgr packages fix unauthorised access


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Debian Security Advisory DSA 1047-1                    security@...ian.org
http://www.debian.org/security/                             Martin Schulze
April 30th, 2006                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : resmgr
Vulnerability  : programming error
Problem type   : local
Debian-specific: no

A problem has been discovered in resmgr, a resource manager library
daemon and PAM module, that allows local users to bypass access
control rules and open any USB device when access to one device was
granted.

the old stable distribution (woody) does not contain resmgr packages.

For the stable distribution (sarge) this problem has been fixed in
version 1.0-2sarge2.

For the unstable distribution (sid) this problem has been fixed in
version 1.0-4.

We recommend that you upgrade your resmgr package.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.1 alias sarge
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2.dsc
      Size/MD5 checksum:      614 9b90463431b3893f727ff080df0a5239
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2.diff.gz
      Size/MD5 checksum:     7976 52d70d8e9684ab80719d806d9088d067
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0.orig.tar.gz
      Size/MD5 checksum:    40970 c5d77b35fc30a7bead00ea2951c19a2f

  Alpha architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_alpha.deb
      Size/MD5 checksum:     4428 f20cb82298535193b9629c4811251192
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_alpha.deb
      Size/MD5 checksum:     8870 d0c6a5a4f04fa2258280cb4b6d60c0c9
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_alpha.deb
      Size/MD5 checksum:    36690 efb631c58b56a16c40d1a3152e9d4f8f

  AMD64 architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_amd64.deb
      Size/MD5 checksum:     4422 0ca68e35b937773dfa3b89dd8945281b
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_amd64.deb
      Size/MD5 checksum:     8194 0317c1c3ed93bd13aebe521949d4fda5
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_amd64.deb
      Size/MD5 checksum:    33304 2275f781d337907b87ad31d0779d1a0c

  ARM architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_arm.deb
      Size/MD5 checksum:     4428 13adf84fa226c83cf36ddc7014a413b8
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_arm.deb
      Size/MD5 checksum:     7058 8d0e935b6ca4425174490e7523bb86ab
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_arm.deb
      Size/MD5 checksum:    29328 21f2b68f8dc44be7b4304f66f3d080ae

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_i386.deb
      Size/MD5 checksum:     4422 852f6d951e3ed2fd4e8740e2bc8b1fa6
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_i386.deb
      Size/MD5 checksum:    25906 0f7831ec7b0382a6962cbddecfa2ef5c
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_i386.deb
      Size/MD5 checksum:    41224 d6df916c394f4c826b4d9e75434a261a

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_ia64.deb
      Size/MD5 checksum:     4414 39ad0549329d2dd0810d580c65629012
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_ia64.deb
      Size/MD5 checksum:    10196 031bad7b1ba99e6b7e337b7f506321c3
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_ia64.deb
      Size/MD5 checksum:    41210 47ba589e9bf7ee09769447dd759dbc0e

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_hppa.deb
      Size/MD5 checksum:     4436 4f9e59f8941fd2160002dfaac94ae756
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_hppa.deb
      Size/MD5 checksum:     8676 8a92ed14b17e608d4607b626af2948f4
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_hppa.deb
      Size/MD5 checksum:    33612 2dbb5089a1e6a6bcd8a202687ab2c826

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_m68k.deb
      Size/MD5 checksum:     4444 752f2adf6c0c977de1a346d8326ceea4
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_m68k.deb
      Size/MD5 checksum:     7238 1674a58df5be5d7d7a46dd8eca880b0d
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_m68k.deb
      Size/MD5 checksum:    28882 5c65ca27ee2816344da1a0e9289a9414

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_mips.deb
      Size/MD5 checksum:     4434 49b9292653d918bf6f94809322d8fb48
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_mips.deb
      Size/MD5 checksum:     7778 5246faae2986c92f6edf9b0cb518ed85
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_mips.deb
      Size/MD5 checksum:    34712 4817872f485e1b6c402caa019bf3fa62

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_mipsel.deb
      Size/MD5 checksum:     4432 c783ce5980d7d0b22aa1c69a66d89456
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_mipsel.deb
      Size/MD5 checksum:     7814 a5226c77b764b2c79b32211a67a0580e
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_mipsel.deb
      Size/MD5 checksum:    34668 00efd90689cce6b0874622a32ad687cd

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_powerpc.deb
      Size/MD5 checksum:     4442 2cb12a62b99ee151de15f62b01cd3cdb
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_powerpc.deb
      Size/MD5 checksum:     9474 4d7589e21c6604b0915cdcb13f64d66b
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_powerpc.deb
      Size/MD5 checksum:    36228 c7bb76f8eb7e08c1db19eb2b061e9a01

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_s390.deb
      Size/MD5 checksum:     4428 1f49b31b45334df4f298c96ce35b9b7d
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_s390.deb
      Size/MD5 checksum:     8302 6065fe66f9b5a41bbf6e7d23b4090d32
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_s390.deb
      Size/MD5 checksum:    33282 b3b1443b323c144c8f72e0b37f70546d

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr-dev_1.0-2sarge2_sparc.deb
      Size/MD5 checksum:     4434 27815a5a67681abf7ac81c6998de4c73
    http://security.debian.org/pool/updates/main/r/resmgr/libresmgr1_1.0-2sarge2_sparc.deb
      Size/MD5 checksum:     7296 9974ef49ba0e43ab99d4892876a66f0d
    http://security.debian.org/pool/updates/main/r/resmgr/resmgr_1.0-2sarge2_sparc.deb
      Size/MD5 checksum:    29564 b7255b27b8ea036030ffe9487b8da09d


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEVD8WW5ql+IAeqTIRAmRrAJ4hik3AcMzxIdBBchtDzY8WW3o2FgCgqY4q
rSGCksltLFJlZXdJedF/w/Y=
=7nGP
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ