On 16 July 2008 21:18:32 Thijs Kinkhorst wrote: > ------------------------------------------------------------------------ > Debian Security Advisory DSA-1611-1 [EMAIL PROTECTED] > http://www.debian.org/security/ Thijs Kinkhorst > July 16, 2008 http://www.debian.org/security/faq > ------------------------------------------------------------------------ > > Package : afuse > Vulnerability : privilege escalation > Problem type : local > Debian-specific: no > CVE Id(s) : CVE-2008-2232 > Debian Bug : 490921 > > Anders Kaseorg discovered that afuse, an automounting file system > in user-space, did not properly escape meta characters in paths. > This allowed a local attacker with read access to the filesystem to > execute commands as the owner of the filesystem. > > For the stable distribution (etch), this problem has been fixed in > version 0.1.1-1+etch1. > > For the unstable distribution (sid), this problem has been fixed in > version 0.2-3. > > We recommend that you upgrade your afuse (0.1.1-1+etch1) package. > > Upgrade instructions > -------------------- > > wget url > will fetch the file for you > dpkg -i file.deb > will install the referenced file. > > If you are using the apt-get package manager, use the line for > sources.list as given below: > > apt-get update > will update the internal database > apt-get upgrade > will install corrected packages > > You may use an automated update by adding the resources from the > footer to the proper configuration. > > > Debian GNU/Linux 4.0 alias etch > ------------------------------- > > Source archives: > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.di >ff.gz Size/MD5 checksum: 3699 645246f8f338b76b6d6785fff9997c5a > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.ds >c Size/MD5 checksum: 657 fe408099626f3bad3bc68d2717df2a9b > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1.orig.tar.g >z Size/MD5 checksum: 98171 95cce7d6ed8e984d0ff2d650e6beb167 > > alpha architecture (DEC Alpha) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_al >pha.deb Size/MD5 checksum: 15476 465baebb172ecda5ed1e7bdd174fddac > > amd64 architecture (AMD x86_64 (AMD64)) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_am >d64.deb Size/MD5 checksum: 14224 5e5dca72cb191bf0d435f770c62e07f5 > > arm architecture (ARM) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ar >m.deb Size/MD5 checksum: 12448 f39bc75bceec2e8979a514bda07164d6 > > hppa architecture (HP PA RISC) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_hp >pa.deb Size/MD5 checksum: 14602 603022ee85f781d0c8c155936d432484 > > i386 architecture (Intel ia32) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_i3 >86.deb Size/MD5 checksum: 13086 b422ac9cb737dd1fb7827eb6ea222bba > > ia64 architecture (Intel ia64) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ia >64.deb Size/MD5 checksum: 17730 9fc41e69a8df1ddee15831b971ededb1 > > mips architecture (MIPS (Big Endian)) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mi >ps.deb Size/MD5 checksum: 14232 69ebaa63e04dd9a16ad8ff5a772dc576 > > mipsel architecture (MIPS (Little Endian)) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mi >psel.deb Size/MD5 checksum: 14282 9dabd8530851c9588c4927f53cf923d2 > > powerpc architecture (PowerPC) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_po >werpc.deb Size/MD5 checksum: 13582 c6c86e8600353b4ff4ed66c9608fd7d0 > > s390 architecture (IBM S/390) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_s3 >90.deb Size/MD5 checksum: 14154 b36cc8bab5a28d13430a18697bb4b85c > > sparc architecture (Sun SPARC/UltraSPARC) > > > http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_sp >arc.deb Size/MD5 checksum: 12562 ff0fd7531cc011d032f74c78ae17ca0e > > > These files will probably be moved into the stable distribution on > its next update. > > --------------------------------------------------------------------------- >------ For apt-get: deb http://security.debian.org/ stable/updates main > For dpkg-ftp: ftp://security.debian.org/debian-security > dists/stable/updates/main Mailing list: > [EMAIL PROTECTED] > Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
