Your message dated Tue, 18 Aug 2009 12:47:18 +0000
with message-id <[email protected]>
and subject line Bug#541995: fixed in ocsinventory-server 1.02.1-2
has caused the Debian Bug report #541995,
regarding ocsinventory-server: Sql injection in OCS Inventory NG Server 1.2.1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
541995: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=541995
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ocsinventory-server
Version: 1.02.1-1
Severity: serious
Justification: serious
http://seclists.org/fulldisclosure/2009/Aug/0143.html
http://www.ocsinventory-ng.org/index.php?mact=News,cntnt01,detail,0&cntnt01articleid=147&cntnt01returnid=15
Cheers,
Gonéri
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.31-rc3-686 (SMP w/1 CPU core)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) (ignored: LC_ALL
set to fr_FR.UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages ocsinventory-server depends on:
ii apache2 2.2.12-1 Apache HTTP Server metapackage
ii apache2-mpm-prefork [apache2] 2.2.12-1 Apache HTTP Server - traditional n
ii dbconfig-common 1.8.41 common framework for packaging dat
ii debconf [debconf-2.0] 1.5.27 Debian configuration management sy
ii libapache-dbi-perl 1.07-1 Connect apache server to database
ii libapache2-mod-perl2 2.0.4-5 Integration of perl with the Apach
ii libcompress-zlib-perl 2.015-1 Perl module for creation and manip
ii libdbd-mysql-perl 4.012-1 A Perl5 database interface to the
ii libdbi-perl 1.609-1 Perl Database Interface (DBI)
ii libnet-ip-perl 1.25-2 Perl extension for manipulating IP
ii libxml-simple-perl 2.18-2 Perl module for reading and writin
ii perl [libcompress-zlib-perl] 5.10.0-24 Larry Wall's Practical Extraction
ii ucf 3.0018 Update Configuration File: preserv
Versions of packages ocsinventory-server recommends:
ii ocsinventory-reports 1.02.1-1 Hardware and software inventory to
Versions of packages ocsinventory-server suggests:
ii libsoap-lite-perl 0.710.08-2 Client and server side SOAP implem
ii mysql-server-5.0 [mysql-serve 5.0.84-1 MySQL database server binaries
pn ocsinventory-agent <none> (no description available)
-- debconf information:
ocsinventory-server/internal/skip-preseed: false
ocsinventory-server/upgrade-error: abort
ocsinventory-server/remote/port:
ocsinventory-server/db/app-user: ocs
ocsinventory-server/mysql/admin-user: root
ocsinventory-server/remove-error: abort
ocsinventory-server/internal/reconfiguring: false
* ocsinventory-server/dbconfig-install: true
ocsinventory-server/dbconfig-upgrade: true
ocsinventory-server/upgrade-backup: true
ocsinventory-server/remote/host:
ocsinventory-server/dbconfig-remove:
ocsinventory-server/remote/newhost:
ocsinventory-server/install-error: abort
ocsinventory-server/passwords-do-not-match:
ocsinventory-server/mysql/method: unix socket
ocsinventory-server/database-type: mysql
ocsinventory-server/missing-db-package-error: abort
ocsinventory-server/purge: false
ocsinventory-server/dbconfig-reinstall: false
ocsinventory-server/db/dbname: ocsweb
--- End Message ---
--- Begin Message ---
Source: ocsinventory-server
Source-Version: 1.02.1-2
We believe that the bug you reported is fixed in the latest version of
ocsinventory-server, which is due to be installed in the Debian FTP archive:
ocsinventory-reports_1.02.1-2_all.deb
to pool/main/o/ocsinventory-server/ocsinventory-reports_1.02.1-2_all.deb
ocsinventory-server_1.02.1-2.diff.gz
to pool/main/o/ocsinventory-server/ocsinventory-server_1.02.1-2.diff.gz
ocsinventory-server_1.02.1-2.dsc
to pool/main/o/ocsinventory-server/ocsinventory-server_1.02.1-2.dsc
ocsinventory-server_1.02.1-2_all.deb
to pool/main/o/ocsinventory-server/ocsinventory-server_1.02.1-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Pierre Chifflier <[email protected]> (supplier of updated ocsinventory-server
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Tue, 18 Aug 2009 14:40:20 +0200
Source: ocsinventory-server
Binary: ocsinventory-server ocsinventory-reports
Architecture: source all
Version: 1.02.1-2
Distribution: unstable
Urgency: high
Maintainer: Pierre Chifflier <[email protected]>
Changed-By: Pierre Chifflier <[email protected]>
Description:
ocsinventory-reports - Hardware and software inventory tool (Administration
Console)
ocsinventory-server - Hardware and software inventory tool (Communication
Server)
Closes: 541995
Changes:
ocsinventory-server (1.02.1-2) unstable; urgency=high
.
* Security update: fix potential SQL injection in ocsreports/machine.php
- no CVE yet (see http://seclists.org/fulldisclosure/2009/Aug/0143.html)
- urgency high
- Closes: #541995
* Bump Standards Version to 3.8.2 (no changes)
Checksums-Sha1:
05f9c61d17e207929550d8fa0decdb7603ee181e 1184 ocsinventory-server_1.02.1-2.dsc
823b97ae2e6bef80a9794ddc25e75c7b4741aa37 29635
ocsinventory-server_1.02.1-2.diff.gz
34216213cedd59b5ba5ce1d295b59e003e12d47a 74164
ocsinventory-server_1.02.1-2_all.deb
8dd8e349ca364e20874193ce926db207de8498c8 1412760
ocsinventory-reports_1.02.1-2_all.deb
Checksums-Sha256:
971b8387799443d4efbc7a5403410644d132dd8110be8457ca5164c1b67eae80 1184
ocsinventory-server_1.02.1-2.dsc
11fc3145699e6dd9d8ba9dff19ea9a322211eae46ced9562fcfb6950ff045a64 29635
ocsinventory-server_1.02.1-2.diff.gz
900e03e67be3677c8d2cfac6815368984344e4bab74dcfdd414298a3860f55fe 74164
ocsinventory-server_1.02.1-2_all.deb
adba456d6bab824930be6ab04bfadeb8ac249a436c266435ac6b425565cd1984 1412760
ocsinventory-reports_1.02.1-2_all.deb
Files:
44044d3a19587e2563c7b032dbd21810 1184 web extra
ocsinventory-server_1.02.1-2.dsc
a48ae131b0d017a80c847f32fcd3e2f9 29635 web extra
ocsinventory-server_1.02.1-2.diff.gz
8e753faadfe33de11efbc12cc4c088fe 74164 web extra
ocsinventory-server_1.02.1-2_all.deb
bf6643c3428ff490cf4ca987c935a7aa 1412760 web extra
ocsinventory-reports_1.02.1-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFKiqHetwVrWo1fQMsRAgCUAKDlOWTfedfd5gkFteHFJ3Fa2z9KxQCeJF+g
f/aHOqy9OIbH0h1o8uEeEPw=
=7jrw
-----END PGP SIGNATURE-----
--- End Message ---
