Your message dated Wed, 05 Apr 2006 03:32:04 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#360559: fixed in openvpn 2.0.6-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--- Begin Message ---
Package: openvpn
Version: 2.0.5-1
Severity: important
Tags: security
As described in http://www.osreviews.net/reviews/security/openvpn
OpenVPN contains a security hole that allows a malicious VPN server to
take over connected clients.
OpenVPN allows to push environment variables to a client via 'push
setenv ...'. Using LD_PRELOAD it is possible to run arbitrary code as
root. The only prerequisite is that the attacker needs to control a
file on the victim's computer, e.g. by returning a specially crafted
document upon web access.
A possible solution would be to prefix all pushed environment
variables with something like 'OPENVPN_'.
--- End Message ---
--- Begin Message ---
Source: openvpn
Source-Version: 2.0.6-1
We believe that the bug you reported is fixed in the latest version of
openvpn, which is due to be installed in the Debian FTP archive:
openvpn_2.0.6-1.diff.gz
to pool/main/o/openvpn/openvpn_2.0.6-1.diff.gz
openvpn_2.0.6-1.dsc
to pool/main/o/openvpn/openvpn_2.0.6-1.dsc
openvpn_2.0.6-1_i386.deb
to pool/main/o/openvpn/openvpn_2.0.6-1_i386.deb
openvpn_2.0.6.orig.tar.gz
to pool/main/o/openvpn/openvpn_2.0.6.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Alberto Gonzalez Iniesta <[EMAIL PROTECTED]> (supplier of updated openvpn
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 5 Apr 2006 12:17:26 +0200
Source: openvpn
Binary: openvpn
Architecture: source i386
Version: 2.0.6-1
Distribution: unstable
Urgency: high
Maintainer: Alberto Gonzalez Iniesta <[EMAIL PROTECTED]>
Changed-By: Alberto Gonzalez Iniesta <[EMAIL PROTECTED]>
Description:
openvpn - Virtual Private Network daemon
Closes: 360559
Changes:
openvpn (2.0.6-1) unstable; urgency=high
.
* New upstream release. Urgency high due to security fix.
- Disallow "setenv" to be pushed to clients from the server.
(Closes: #360559)
Files:
0f2e3c4c5242990924aaf293bc6d1142 623 net optional openvpn_2.0.6-1.dsc
8d2f95fa825e58363a676b25d4815aa7 664816 net optional openvpn_2.0.6.orig.tar.gz
5e7423c57c9428c5e88f04fb60227a56 58406 net optional openvpn_2.0.6-1.diff.gz
ac1ee7921f725b687eb48db59cfd1312 330058 net optional openvpn_2.0.6-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFEM5pXxRSvjkukAcMRAt0jAJ9KN9xcd+4486nlXq2tjZjWWiddgQCgh7Fs
URVMLJSGXGPbBYZSy/mf5pw=
=dUFH
-----END PGP SIGNATURE-----
--- End Message ---
