Your message dated Fri, 16 Dec 2005 19:17:06 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#276865: fixed in cyrus-sasl2-mit 2.1.19-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 17 Oct 2004 03:48:59 +0000
>From [EMAIL PROTECTED] Sat Oct 16 20:48:59 2004
Return-path: <[EMAIL PROTECTED]>
Received: from master.debian.org [146.82.138.7]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CJ22V-0001mn-00; Sat, 16 Oct 2004 20:48:59 -0700
Received: from rcm-200-220-132-60.nipnet.net.br (khazad-dum.debian.net)
[200.220.132.60]
by master.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1CJ22U-0007i3-00; Sat, 16 Oct 2004 22:48:58 -0500
Received: from localhost (localhost [127.0.0.1])
by localhost.khazad-dum.debian.net (Postfix) with ESMTP id 34D48205D04;
Sun, 17 Oct 2004 00:48:57 -0300 (BRT)
Received: from khazad-dum.debian.net ([127.0.0.1])
by localhost (khazad-dum [127.0.0.1]) (amavisd-new, port 10024)
with LMTP id 07572-02; Sun, 17 Oct 2004 00:48:52 -0300 (BRT)
Received: by khazad-dum.debian.net (Postfix, from userid 1000)
id D1CBC208E16; Sun, 17 Oct 2004 00:48:52 -0300 (BRT)
Date: Sun, 17 Oct 2004 00:48:52 -0300
From: Henrique de Moraes Holschuh <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: cyrus-sasl2-mit: Local privilege escalation on setuid environment
(CAN-2004-0884)
Message-ID: <[EMAIL PROTECTED]>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
X-Reportbug-Version: 2.99.5
X-GPG-Fingerprint-1: 1024D/128D36EE 50AC 661A 7963 0BBA 8155 43D5 6EF7 F36B
128D 36EE
X-GPG-Fingerprint-2: 1024D/1CDB0FE3 5422 5C61 F6B7 06FB 7E04 3738 EE25 DE3F
1CDB 0FE3
User-Agent: Mutt/1.5.6+20040907i
X-Virus-Scanned: by amavisd-new-20030616-p10 (Debian) at khazad-dum.debian.net
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2004_03_25
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2004_03_25
X-Spam-Level:
Package: cyrus-sasl2-mit
Severity: critical
Tags: security sarge sid
Justification: root security hole
See:
http://security.gentoo.org/glsa/glsa-200410-05.xml
https://bugzilla.andrew.cmu.edu/cgi-bin/cvsweb.cgi/src/sasl/lib/common.c.diff?r1=1.103&r2=1.104
http://lwn.net/Articles/105693/
I will upload a NMU shortly, bringing it in sync with
cyrus-sasl2 2.1.19-1.5.
I didn't notice at the time I filled the bugs against cyrus-sasl and
cyrus-sasl2 that the -mit packages also needed to be fixed because
lib/common.c is statically linked into the plugins.
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (990, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.28-pre3-debian5+skas+lmsensors+3c59xvlan
Locale: LANG=pt_BR, LC_CTYPE=pt_BR
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
---------------------------------------
Received: (at 276865-close) by bugs.debian.org; 17 Dec 2005 03:20:57 +0000
>From [EMAIL PROTECTED] Fri Dec 16 19:20:57 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 4.50)
id 1EnSZG-0005Ce-1z; Fri, 16 Dec 2005 19:17:06 -0800
From: Sam Hartman <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.60 $
Subject: Bug#276865: fixed in cyrus-sasl2-mit 2.1.19-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Fri, 16 Dec 2005 19:17:06 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-CrossAssassin-Score: 2
Source: cyrus-sasl2-mit
Source-Version: 2.1.19-2
We believe that the bug you reported is fixed in the latest version of
cyrus-sasl2-mit, which is due to be installed in the Debian FTP archive:
cyrus-sasl2-mit_2.1.19-2.diff.gz
to pool/main/c/cyrus-sasl2-mit/cyrus-sasl2-mit_2.1.19-2.diff.gz
cyrus-sasl2-mit_2.1.19-2.dsc
to pool/main/c/cyrus-sasl2-mit/cyrus-sasl2-mit_2.1.19-2.dsc
libsasl2-gssapi-mit_2.1.19-2_i386.deb
to pool/main/c/cyrus-sasl2-mit/libsasl2-gssapi-mit_2.1.19-2_i386.deb
libsasl2-krb4-mit_2.1.19-2_i386.deb
to pool/main/c/cyrus-sasl2-mit/libsasl2-krb4-mit_2.1.19-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sam Hartman <[EMAIL PROTECTED]> (supplier of updated cyrus-sasl2-mit package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 16 Dec 2005 22:01:06 -0500
Source: cyrus-sasl2-mit
Binary: libsasl2-gssapi-mit libsasl2-krb4-mit
Architecture: source i386
Version: 2.1.19-2
Distribution: unstable
Urgency: emergency
Maintainer: Sam Hartman <[EMAIL PROTECTED]>
Changed-By: Sam Hartman <[EMAIL PROTECTED]>
Description:
libsasl2-gssapi-mit - GSSAPI module for SASL using MIT Kerberos
libsasl2-krb4-mit - Kerberos4 module for SASL using MIT Kerberos
Closes: 276865 285613
Changes:
cyrus-sasl2-mit (2.1.19-2) unstable; urgency=low
.
* Sync with 2.1.19-1.7
- Includes fix for FTBFS, Closes: #285613
* Include NMU from 2.1.19-1.1
* Disable gssapi library mutexes as we no longer need them.
.
cyrus-sasl2-mit (2.1.19-1.1) unstable; urgency=emergency
.
* NMU
* resync to cyrus-sasl2 2.1.19-1.5):
* SECURITY FIX: SASL_PATH environment variable must not be honoured on
setuid environments, otherwise we have a local privilege escalation
exploit (CVE: CAN-2004-0884), related advisories: RHSA-2004:546-02;
GLSA 200410-05 (closes: #276865)
* upstream CVS: lib/common.c: don't honor SASL_PATH in setuid
environment. from Gentoo (CVE CAN-2004-0884);
* Fix to upstream CVS security fix: initialize *path = NULL
* upstream CVS: plugins/kerberos4.c: document weirdness with openssl DES
* upstream CVS: plugins/cram.c,plugins/anonymous.c,plugins/login.c,
plugins/plain.c,plugins/sasldb.c: Fixed several 64 bit portability
warnings
* Forward port sasl_set_alloc locking patch from SASL 1.5, to avoid
problems with the braindead idea of globals SASL has, and with libraries
that think they can get around mucking with them (hello openldap!)
* Add Build-Conflicts: autoconf2.13, automake1.4
Files:
b3021859beb20f11f58466aa27e4c8d7 924 devel optional
cyrus-sasl2-mit_2.1.19-2.dsc
10e1a4dc0005dbf7127a7ae800b5c4ab 29804 devel optional
cyrus-sasl2-mit_2.1.19-2.diff.gz
6f37f12141dd49e2f84fc0b7c361dc03 47140 devel optional
libsasl2-gssapi-mit_2.1.19-2_i386.deb
73d6bf373291da2c6c7825390cd52317 46734 devel optional
libsasl2-krb4-mit_2.1.19-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDo4IL/I12czyGJg8RAshiAJ4kHzqn+8rV9JJqnMrWnD8UBuQ8ZgCg0Hz0
jsyGbPScyYyuFQw4NRWkxAY=
=NkFZ
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
