| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <1277146129.14388.45.camel@mdlinux.technorage.com>
Date: Mon, 21 Jun 2010 14:48:49 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-953-1] fastjar vulnerability
===========================================================
Ubuntu Security Notice USN-953-1 June 21, 2010
fastjar vulnerability
CVE-2010-0831
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 9.04
Ubuntu 9.10
Ubuntu 10.04 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
fastjar 2:0.95-1ubuntu2.1
Ubuntu 9.04:
fastjar 2:0.97-3ubuntu0.1
Ubuntu 9.10:
fastjar 2:0.98-1ubuntu0.9.10.1
Ubuntu 10.04 LTS:
fastjar 2:0.98-1ubuntu0.10.04.1
In general, a standard system update will make all the necessary changes.
Details follow:
Dan Rosenberg discovered that fastjar incorrectly handled file paths
containing ".." when unpacking archives. If a user or an automated system
were tricked into unpacking a specially crafted jar file, arbitrary files
could be overwritten with user privileges.
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1.diff.gz
Size/MD5: 14652 0bbecbfd445a41af5fac64225180626f
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1.dsc
Size/MD5: 688 37c0afbe767cd560f19f444c518f9e9a
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95.orig.tar.gz
Size/MD5: 593955 92a70f9e56223b653bce0f58f90cf950
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_amd64.deb
Size/MD5: 84840 92c639fcce37474a468a243a26a9ead6
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_i386.deb
Size/MD5: 45128 b0d21c6467fe96f13ed0b6c71c96fd76
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_lpia.deb
Size/MD5: 45394 082ac97eca4af7ed2e04576027240d98
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_powerpc.deb
Size/MD5: 47688 b5b71b34bd0d6933356e0f667be92d34
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_sparc.deb
Size/MD5: 46654 cd6104ab543567ea3b9d3af71812cb64
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1.diff.gz
Size/MD5: 4303 f685e7715cc6ef5f819cb1408d4fadba
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1.dsc
Size/MD5: 1077 4ea02be4634886678ad56803e595a74c
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97.orig.tar.gz
Size/MD5: 676393 2659f09c2e43ef8b7d4406321753f1b2
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_amd64.deb
Size/MD5: 91000 834e980e9d7f6f58ee0a861f96a374f2
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_i386.deb
Size/MD5: 48910 416f5950f1d5f679aaf69977bdf3e893
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_lpia.deb
Size/MD5: 49010 4d5680c65c5b00559cfd11eb3d05ab18
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_powerpc.deb
Size/MD5: 50538 e2dca54f24d0c4a0adc6f8b56639a7f4
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_sparc.deb
Size/MD5: 50536 6d85158ea3212a93e5dc36ee9829d5e1
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1.diff.gz
Size/MD5: 4095 fa64ab3ca694288d157c37b4571a1781
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1.dsc
Size/MD5: 1097 85d8021aa363a9a2ca0025b994408139
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98.orig.tar.gz
Size/MD5: 717984 d2d264d343d4d0e1575832cc1023c3bf
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_amd64.deb
Size/MD5: 91004 ed7dedc416f0c2f94c9a941cbffb8f98
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_i386.deb
Size/MD5: 48924 338dd4ba551b8217917e36846ef6e199
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_lpia.deb
Size/MD5: 49194 1cd1de1d62b913a4ceca1a7f9837d8c0
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_powerpc.deb
Size/MD5: 50286 4b43f23dbac8b065e984e23906328671
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_sparc.deb
Size/MD5: 50428 30ff3e7a9e9a88383d2113fcd38a9f1a
Updated packages for Ubuntu 10.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1.diff.gz
Size/MD5: 4192 d1079eedbcf9a0bfb3fd270a91e49fb9
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1.dsc
Size/MD5: 1101 feeaadc1dc54e396da69a69ade68116a
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98.orig.tar.gz
Size/MD5: 717984 d2d264d343d4d0e1575832cc1023c3bf
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_amd64.deb
Size/MD5: 90958 a088a28e94c4d3240ffa5394d3ead692
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_i386.deb
Size/MD5: 49018 567ebb9983b24d76b7e0149f8a03a959
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_powerpc.deb
Size/MD5: 50532 47cf2e79000cb83f550d01e9748eedfc
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_sparc.deb
Size/MD5: 51216 8ce8b35ae84d7f33fb499a99432ffb64
Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists