Your message dated Wed, 05 Oct 2005 14:02:08 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#276277: fixed in distcc 2.18.3-3
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 13 Oct 2004 03:50:52 +0000
>From [EMAIL PROTECTED] Tue Oct 12 20:50:52 2004
Return-path: <[EMAIL PROTECTED]>
Received: from adsl-216-102-91-59.dsl.snfc21.pacbell.net (localhost)
[216.102.91.59] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CHaA8-0003a5-00; Tue, 12 Oct 2004 20:50:52 -0700
Received: from misha by localhost with local (Exim 3.36 #1 (Debian))
id 1CHa9u-0005Pk-00; Tue, 12 Oct 2004 20:50:38 -0700
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Misha Nasledov <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: distcc: does not warn of security concerns
X-Mailer: reportbug 2.62
Date: Tue, 12 Oct 2004 20:50:38 -0700
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
Package: distcc
Version: 2.17-1
Severity: wishlist
I recently found my distccd user running "sh", "./str", and "./ftpd" (on
port 12000). Upon further investigation, I discovered that any version
of distcc is exploitable by this and that the solution is either using
SSH or its built in --allow option. The problem was not severe as they
merely gained access to my distcc user and I do not believe they were
able to inject any malicious code into my binaries as I have not used my
distcc daemon in a long time. The debconf dialog upon installation of
distcc asks the user if they would like distccd automatically started,
and merely hints that if in doubt, it should not be automatically
started.
I believe that you should add a warning regarding the security concern
and perhaps add an input field for allowed addresses/subnets. Perhaps it
also might be a good idea to set the default of the field to 127.0.0.1.
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.3
Locale: LANG=C, LC_CTYPE=C
Versions of packages distcc depends on:
ii adduser 3.57 Add and remove users and groups
ii debconf 1.4.29 Debian configuration management sy
ii libc6 2.3.2.ds1-13 GNU C Library: Shared libraries an
ii libpopt0 1.7-4 lib for parsing cmdline parameters
ii netbase 4.17 Basic TCP/IP networking system
-- debconf information:
* distcc/daemon: true
---------------------------------------
Received: (at 276277-close) by bugs.debian.org; 5 Oct 2005 21:08:48 +0000
>From [EMAIL PROTECTED] Wed Oct 05 14:08:48 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1ENGOu-0001I5-00; Wed, 05 Oct 2005 14:02:08 -0700
From: Carsten Wolff <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#276277: fixed in distcc 2.18.3-3
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Wed, 05 Oct 2005 14:02:08 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-CrossAssassin-Score: 2
Source: distcc
Source-Version: 2.18.3-3
We believe that the bug you reported is fixed in the latest version of
distcc, which is due to be installed in the Debian FTP archive:
distcc_2.18.3-3.diff.gz
to pool/main/d/distcc/distcc_2.18.3-3.diff.gz
distcc_2.18.3-3.dsc
to pool/main/d/distcc/distcc_2.18.3-3.dsc
distcc_2.18.3-3_i386.deb
to pool/main/d/distcc/distcc_2.18.3-3_i386.deb
distccmon-gnome_2.18.3-3_i386.deb
to pool/main/d/distcc/distccmon-gnome_2.18.3-3_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Carsten Wolff <[EMAIL PROTECTED]> (supplier of updated distcc package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 5 Oct 2005 20:35:16 +0200
Source: distcc
Binary: distcc distccmon-gnome
Architecture: source i386
Version: 2.18.3-3
Distribution: unstable
Urgency: low
Maintainer: Carsten Wolff <[EMAIL PROTECTED]>
Changed-By: Carsten Wolff <[EMAIL PROTECTED]>
Description:
distcc - Simple distributed compiler client and server
distccmon-gnome - GTK monitor for distcc a distributed client and server
Closes: 217924 276277 298489 298929 313561 315826 323308 330754 330822 331804
Changes:
distcc (2.18.3-3) unstable; urgency=low
.
* added dependency-alternative on debconf-2.0
(closes: Bug#331804)
* added version to adduser dependency
(closes: Bug#330822)
* only remove user in postrm, if the user exists and deluser is available
(closes: Bug#330754)
(closes: Bug#298489)
* added Vietnamese and Czech debconf template translations
thanks to Clytie Siddall and Miroslav Kure
(closes: Bug#313561)
(closes: Bug#315826)
* added --listen option and some warnings about distccd and untrusted nets
(closes: Bug#323308)
(closes: Bug#276277)
(closes: BUg#298929)
* new standards version 3.6.2 (no changes)
* updated FSF's postal address in the copyright file
* corrected "possible-bashism-in-maintainer-script" in config
* added "masquerade" directory /usr/lib/distcc with symlinks to distcc,
named after debian's compilers
(closes: Bug#217924)
Files:
cdd65600dc48b06fdbf5a276bdc60301 655 devel optional distcc_2.18.3-3.dsc
571f75e47f170c54cbdcd82fe61d2d94 35096 devel optional distcc_2.18.3-3.diff.gz
97be6fca91b157a037bd31f9bc3e3174 142046 devel optional distcc_2.18.3-3_i386.deb
f1a53bea4b940ccfe989281346a14c6a 35876 devel optional
distccmon-gnome_2.18.3-3_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDRDoo9/DnDzB9Vu0RAhcVAJ9Bf/RdjLhR2K1tLvxes7CwZaJxeACfT96V
jCZaJYVgHDoy+YSRpOKSXgo=
=wBBG
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
