| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20050919111447.GA23427@piware.de>
Date: Mon Sep 19 12:17:29 2005
From: martin.pitt at canonical.com (Martin Pitt)
Subject: [USN-184-1] umount vulnerability
===========================================================
Ubuntu Security Notice USN-184-1 September 19, 2005
util-linux vulnerability
CAN-2005-2876
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
mount
The problem can be corrected by upgrading the affected package to
version 2.12-7ubuntu6.1 (for Ubuntu 4.10), or 2.12p-2ubuntu2.2 (for
Ubuntu 5.04). In general, a standard system upgrade is sufficient to
effect the necessary changes.
Details follow:
David Watson discovered that "umount -r" removed some restrictive
mount options like the "nosuid" flag. If /etc/fstab contains
user-mountable removable devices which specify the "nosuid" flag
(which is common practice for such devices), a local attacker could
exploit this to execute arbitrary programs with root privileges by
calling "umount -r" on a removable device.
This does not affect the default Ubuntu configuration. Since Ubuntu
mounts removable devices automatically, there is normally no need to
configure them manually in /etc/fstab.
Updated packages for Ubuntu 4.10 (Warty Warthog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1.diff.gz
Size/MD5: 109678 0f53c5d6208be9e3cff6aeddc8c425a0
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1.dsc
Size/MD5: 684 9eeee328200d97c7061c26f6282a8546
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12.orig.tar.gz
Size/MD5: 1857871 997adf78b98d9d1c5db4f37ea982acff
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux-locales_2.12-7ubuntu6.1_all.deb
Size/MD5: 1003200 ed3311f9aa0a7e56c23577d047c319fd
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 64334 6882395e415054b701c2e70bdb67ee0e
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_amd64.udeb
Size/MD5: 482704 f9a48c8a7375e9f8074c065aabdd6838
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 141548 9eb9d95d01f993f448ad7ca939c111f4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 397282 ff8ef6b3bbd984d6dede6354541aaff7
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_i386.deb
Size/MD5: 62742 f704e179423d77e77af3d00870fe8167
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_i386.udeb
Size/MD5: 474138 a8ca30bfa696161380b877670c4d9419
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_i386.deb
Size/MD5: 135724 00e352bc778a4dda0f03501c96f747ab
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_i386.deb
Size/MD5: 373882 a66f10929e0ccd92428499e2406e6b50
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 63050 197f4dcd622e12c1e603a189dcb411d3
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_powerpc.udeb
Size/MD5: 487592 196015505a5781c9000686b0e3692d1f
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 137564 6844adb2e3b7e2688579d08db55a3bb0
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 399388 35f96a97db999cced0307bd0acb6897f
Updated packages for Ubuntu 5.04 (Hoary Hedgehog):
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.1.dsc
Size/MD5: 718 87d4453343f20f472d6c22f57f8f0024
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2.diff.gz
Size/MD5: 74592 09a577be3acfe5951136f6bcb969106b
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2.dsc
Size/MD5: 718 d3964d818741de394f6758e9b344d176
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p.orig.tar.gz
Size/MD5: 2001658 d47e820f6880c21c8b4c0c7e8a7376cc
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux-locales_2.12p-2ubuntu2.2_all.deb
Size/MD5: 1071916 dc0eceabc84f3d65ce6360fbeb557d2c
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 67510 587db10c31483770140574c96b088bb4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_amd64.udeb
Size/MD5: 550626 9ae6cb429953fc0540c854abaf2e6651
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 146380 a46a1901f8c9ec9bf9aa677f27bbc79c
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 401386 5ba3eb993cb8ea376d9570405c57730d
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 65744 e377676d6d4a1d7442b7eb4c79356dd4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_i386.udeb
Size/MD5: 541066 7045bd2f3ebdec339c4f4fc8d68bc9be
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 140696 c5156a184a4d9fc45a80a3688ef10d89
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 377960 ed0dd2a6803e2163aad3d13b15ca46e4
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 66254 75c8f28f2d50a2f27bcaf2808d7ae4f7
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_powerpc.udeb
Size/MD5: 556402 e4a18ea0ff5552fa8c341e077cf87bdc
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 147474 d03bf255994b756f8a80485ee28a3460
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 406646 92f63f8884ae854e9f6f7c2f0d9df731
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050919/ec986222/attachment.bin
Powered by blists - more mailing lists