Message-ID: <20100823101246.GA6512@SD6-Casa.iuculano.it>
Date: Mon, 23 Aug 2010 12:12:46 +0200
From: Giuseppe Iuculano <iuculano@...ian.org>
To: debian-security-announce@...ts.debian.org
Subject: [SECURITY] [DSA 2095-1] New lvm2 packages fix
	denial of service

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2095-1                  security@...ian.org
http://www.debian.org/security/                        Giuseppe Iuculano
August 23, 2010                       http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : lvm2
Vulnerability  : insecure communication protocol
Problem type   : local
Debian-specific: no
CVE Id         : CVE-2010-2526
Debian Bug     : 591204


Alasdair Kergon discovered that the cluster logical volume manager daemon
(clvmd) in lvm2, The Linux Logical Volume Manager, does not verify client
credentials upon a socket connection, which allows local users to cause a
denial of service.

For the stable distribution (lenny), this problem has been fixed in
version 2.02.39-8

For the testing distribution (squeeze), and the unstable distribution (sid),
this problem has been fixed in version 2.02.66-3


We recommend that you upgrade your lvm2 package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8.diff.gz
    Size/MD5 checksum:    17393 fb9151fdf32540e15eb245389d9d5903
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39.orig.tar.gz
    Size/MD5 checksum:   594342 1450ae55a89ea98e4ea51ad7f4ba22d4
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8.dsc
    Size/MD5 checksum:     1132 a0c84982012567f3ca824e7bdeae7637

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_alpha.deb
    Size/MD5 checksum:   256566 c326b8e851c0f32cbe8691b01cc11984
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_alpha.deb
    Size/MD5 checksum:   384348 8d1385a4f8337c5526f3304c6fec1f51
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_alpha.udeb
    Size/MD5 checksum:   245390 e462d169578ba15401c90dd77760b38d

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_amd64.udeb
    Size/MD5 checksum:   225468 8c8e5331e9ddb80e616ae52e766007fd
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_amd64.deb
    Size/MD5 checksum:   237884 a0125354fa125136d2f9ec3de006cdc2
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_amd64.deb
    Size/MD5 checksum:   365790 dcc943057cd272357b6650f1eefac73a

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_armel.udeb
    Size/MD5 checksum:   234540 b88dd34c0908a28233d5eadd04f85efa
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_armel.deb
    Size/MD5 checksum:   366242 4c76f36b042cf9623f0083bb805133f6
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_armel.deb
    Size/MD5 checksum:   237448 c8da5e5304588fc15c99b544f04e146c

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_hppa.deb
    Size/MD5 checksum:   392908 6b16252cf68e7059f1e30a9e476f94e8
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_hppa.deb
    Size/MD5 checksum:   260256 091ed1a82e45c00754a95caa6b0baa6f
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_hppa.udeb
    Size/MD5 checksum:   255674 2637ecd324df5ea0fc623feb19d1d306

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_i386.deb
    Size/MD5 checksum:   355436 9d02ac68e55be8eef8d0ea1ce6b20b43
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_i386.deb
    Size/MD5 checksum:   226510 f52a7348863979ed12844154c4573c10
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_i386.udeb
    Size/MD5 checksum:   208860 df9af70565f01b89e4b2739352f78222

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_ia64.udeb
    Size/MD5 checksum:   322386 5ae8fba02689e5b9a694aef1dbb13057
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_ia64.deb
    Size/MD5 checksum:   480774 2c556d7af51ddab5a44b2d6e5d6b3bd7
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_ia64.deb
    Size/MD5 checksum:   329042 f7942af707e8751aa0b4839405e82483

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_mips.deb
    Size/MD5 checksum:   232164 9fe857ac073303976e7fc855381564ac
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_mips.udeb
    Size/MD5 checksum:   225760 f714be0414b5a2da553723bcbf86936d
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_mips.deb
    Size/MD5 checksum:   356294 5e61467dee584f182c860a32c2d307b9

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_mipsel.deb
    Size/MD5 checksum:   354690 47619b026ff026c16b4cc140bc6c94d0
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_mipsel.udeb
    Size/MD5 checksum:   225336 cee7c70a03aab11246400022a122e250
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_mipsel.deb
    Size/MD5 checksum:   231334 5a661a87a3d8ec350616d7d248567272

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_powerpc.deb
    Size/MD5 checksum:   245820 ef94fd14b4386668bf0ab1e76fb661ce
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_powerpc.udeb
    Size/MD5 checksum:   223004 da5e2c560409f2463fe5032640accd17
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_powerpc.deb
    Size/MD5 checksum:   372636 8514f410e8a3a6060d4cf4f9798f0918

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_s390.deb
    Size/MD5 checksum:   381192 4c81fd3daec2c429851d8e697351fce6
  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_s390.deb
    Size/MD5 checksum:   251920 413ae367df9f54c8f27f79287f0aa75d
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_s390.udeb
    Size/MD5 checksum:   247930 75c9a32ada8454709f9696fb2c18109f

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_sparc.deb
    Size/MD5 checksum:   229496 e5858c5018f21cd34b0d2d27accb8042
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_sparc.deb
    Size/MD5 checksum:   353842 06efa3d5cb736deb80499c2ed393902e
  http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_sparc.udeb
    Size/MD5 checksum:   223984 76a8e6c8de5400c6a41e8923b7f12509


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkxySZ4ACgkQNxpp46476aoAZwCeLmcVjsWjLPYmpJz07DvQMgmt
1V4AmgMo7TPPgWDXRMM21CyRYFlCrP/1
=qQuw
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists