| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20110330233712.GW3946@nxnw.org>
Date: Wed, 30 Mar 2011 16:37:12 -0700
From: Steve Beattie <sbeattie@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-1099-1] GDM vulnerability
===========================================================
Ubuntu Security Notice USN-1099-1 March 30, 2011
gdm vulnerability
CVE-2011-0727
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 9.10:
gdm 2.28.1-0ubuntu2.3
Ubuntu 10.04 LTS:
gdm 2.30.2.is.2.30.0-0ubuntu5.1
Ubuntu 10.10:
gdm 2.30.5-0ubuntu4.1
After a standard system update you need to log out all desktop sessions
and restart GDM to make all the necessary changes.
Details follow:
Sebastian Krahmer discovered that GDM (GNOME Display Manager) did not
properly drop privileges when handling the cache directories used
to store users' dmrc and face icon files. This could allow a local
attacker to change the ownership of arbitrary files, thereby gaining
root privileges.
Updated packages for Ubuntu 9.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3.diff.gz
Size/MD5: 769588 17bc09f417591f1913940d47cec9cc35
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3.dsc
Size/MD5: 2168 09c46d7f6f577daa95f47643025ea67c
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1.orig.tar.gz
Size/MD5: 3661916 b8f101394aa73e4505bad4ed4f0a695c
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_amd64.deb
Size/MD5: 731002 0e00de9426edb0a1dd9cd74d86251548
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_i386.deb
Size/MD5: 672338 2e903d2e97356a7a7138f1da9c37c27a
armel architecture (ARM Architecture):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_armel.deb
Size/MD5: 662246 d6a5a00bc8e37ab1e8ab6faaec9efb42
lpia architecture (Low Power Intel Architecture):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_lpia.deb
Size/MD5: 669764 79d09e696d5ff527e86a263944cdf7db
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_powerpc.deb
Size/MD5: 697456 eff967e0f0206a299f68e93b76f48d13
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_sparc.deb
Size/MD5: 681890 23eec0f66ceb24635f86e3e4f3d06ade
Updated packages for Ubuntu 10.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1.diff.gz
Size/MD5: 795064 e314a75da58ead79bd79cac83730c057
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1.dsc
Size/MD5: 2223 ea497892c7cc53f86ea3769c78e75962
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0.orig.tar.gz
Size/MD5: 3725698 583f6e50936f085be268e8543905fb74
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_amd64.deb
Size/MD5: 798524 1e7b5dee40db568fcafa7d5f8c085c65
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_i386.deb
Size/MD5: 734446 1de50ebe2d1a869a3cc2a4ffb7136de9
armel architecture (ARM Architecture):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_armel.deb
Size/MD5: 725942 f443a1c4098e116c293ebd9bc153f661
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_powerpc.deb
Size/MD5: 760048 30592a26d7d20bc8b70d24543baf6182
sparc architecture (Sun SPARC/UltraSPARC):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_sparc.deb
Size/MD5: 753996 be562ec975b051a5e6909b394fc5cbc7
Updated packages for Ubuntu 10.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1.debian.tar.gz
Size/MD5: 112891 a3aee3567a60f658b826668807c4dc6e
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1.dsc
Size/MD5: 2187 07a449c1f9b1b1b393b92608f019cfd8
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5.orig.tar.gz
Size/MD5: 3784180 9d200a16d6bbab0ac41b93b9dbe6d508
amd64 architecture (Athlon64, Opteron, EM64T Xeon):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_amd64.deb
Size/MD5: 808788 c88e512ff6c1d9b0afe2553bca3aaa0c
i386 architecture (x86 compatible Intel/AMD):
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_i386.deb
Size/MD5: 741206 578f4738cc323ba2d636ad13ce9d328a
armel architecture (ARM Architecture):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_armel.deb
Size/MD5: 741478 b5b04d07aaa136f2412f38d4e71e2d81
powerpc architecture (Apple Macintosh G3/G4/G5):
http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_powerpc.deb
Size/MD5: 768424 e7227f70358590f88e12e801e10b85cb
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists