full-disclosure - [USN-968-1] Dell Latitude 2110 vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20100805194517.GW4138@outflux.net>
Date: Thu, 5 Aug 2010 12:45:17 -0700
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-968-1] Dell Latitude 2110 vulnerability

===========================================================
Ubuntu Security Notice USN-968-1            August 05, 2010
base-files vulnerability
CVE-2010-0834
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
  base-files                      5.0.0ubuntu7.1

Ubuntu 10.04 LTS:
  base-files                      5.0.0ubuntu20.10.04.2

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that the Ubuntu image shipped on some Dell Latitude
2110 systems was accidentally configured to allow unauthenticated package
installations. A remote attacker intercepting network communications or
a malicious archive mirror server could exploit this to trick the user
into installing unsigned packages, resulting in arbitrary code execution
with root privileges.


Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu7.1.dsc
      Size/MD5:      853 a699f7de48cd09591785129b4840ef56
    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu7.1.tar.gz
      Size/MD5:    74901 d802a9135ce2e49e065926b69e16e646

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/lsb-release-udeb_5.0.0ubuntu7.1_all.udeb
      Size/MD5:      788 558c290ae2250679a3836da80fa3ebc0

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu7.1_amd64.deb
      Size/MD5:    68358 67faf1b12530db1c708ba12994d88f60

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu7.1_i386.deb
      Size/MD5:    68354 ec91c2c47ba30e2a3f2c5ee3ef73d812

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1_lpia.deb
      Size/MD5:    68360 1feaa5345fd288eca0fdd180ee12e140

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1_powerpc.deb
      Size/MD5:    68364 4543aabd986eced6a2dadd78ab93daf9

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1_sparc.deb
      Size/MD5:    68366 2ccfbeddb349e6999d93d2505ed40a10

Updated packages for Ubuntu 10.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2.dsc
      Size/MD5:      876 9afddf09156582a48e57c76fab0cf4fa
    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2.tar.gz
      Size/MD5:    76356 d57362eab34a8e9f6cf27b595143c332

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/lsb-release-udeb_5.0.0ubuntu20.10.04.2_all.udeb
      Size/MD5:      788 3e937b94118602fc84aab4adbe3f9e97

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2_amd64.deb
      Size/MD5:    70240 2ecf9c810ef2f2315f63881068d8b839

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2_i386.deb
      Size/MD5:    70236 d780378cf42209eeb90ed2f68940b837

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2_powerpc.deb
      Size/MD5:    70230 3a5889ee074ddf43e7be7e6cbbc81c16

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu20.10.04.2_sparc.deb
      Size/MD5:    70236 c1fdeedbea2bcb8423ea745406ec3a05


Download attachment "signature.asc" of type "application/pgp-signature" (237 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/