-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2011-10718 2011-08-12 10:34:39 --------------------------------------------------------------------------------
Name : ecryptfs-utils Product : Fedora 14 Version : 90 Release : 1.fc14 URL : https://launchpad.net/ecryptfs Summary : The eCryptfs mount helper and support libraries Description : eCryptfs is a stacked cryptographic filesystem that ships in Linux kernel versions 2.6.19 and above. This package provides the mount helper and supporting libraries to perform key management and mount functions. Install ecryptfs-utils if you would like to mount eCryptfs. -------------------------------------------------------------------------------- Update Information: - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832) - race condition when checking source during mount (CVE-2011-1833) - mtab corruption via improper handling (CVE-2011-1834) - key poisoning via insecure temp directory handling (CVE-2011-1835) - information disclosure via recovery mount in /tmp (CVE-2011-1836) - arbitrary file overwrite via lock counter race (CVE-2011-1837) - improve logging messages of ecryptfs pam module - keep own copy of passphrase, pam clears it too early - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - improve logging messages of ecryptfs pam module - keep own copy of passphrase, pam clears it too early - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - improve logging messages of ecryptfs pam module - keep own copy of passphrase, pam clears it too early - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization - keyring from auth stack does not survive, use pam_data and delayed keyring initialization -------------------------------------------------------------------------------- ChangeLog: * Thu Aug 11 2011 Michal Hlavinka <[email protected]> - 90-1 - security fixes: - privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832) - race condition when checking source during mount (CVE-2011-1833) - mtab corruption via improper handling (CVE-2011-1834) - key poisoning via insecure temp directory handling (CVE-2011-1835) - information disclosure via recovery mount in /tmp (CVE-2011-1836) - arbitrary file overwrite via lock counter race (CVE-2011-1837) * Tue Aug 9 2011 Michal Hlavinka <[email protected]> - 87-8 - improve logging messages of ecryptfs pam module - keep own copy of passphrase, pam clears it too early * Wed Aug 3 2011 Michal Hlavinka <[email protected]> - 87-7 - keyring from auth stack does not survive, use pam_data and delayed keyring initialization * Thu Jul 21 2011 Michal Hlavinka <[email protected]> - 87-6 - fix pam module to set ecryptfs gid before mount helper execution - do not use zombie process, it causes lock ups in ssh * Tue Jul 19 2011 Michal Hlavinka <[email protected]> - 87-5 - do not use memcpy for overlaping areas - fix broken pam module resulting in session with wrong gid * Thu Jun 9 2011 Michal Hlavinka <[email protected]> - 87-4 - check for ecryptfs pam module before home dir migration * Tue Jun 7 2011 Michal Hlavinka <[email protected]> - 87-3 - update of mtab does not work if it's a symlink (#706911) * Thu May 26 2011 Michal Hlavinka <[email protected]> - 87-2 - auto-load ecryptfs module in ecryptfs-setup-private * Tue May 24 2011 Michal Hlavinka <[email protected]> - 87-1 - updated to v. 87 * Wed Mar 2 2011 Michal Hlavinka <[email protected]> - 86-2 - fix selinux context * Fri Feb 25 2011 Michal Hlavinka <[email protected]> - 86-1 - updated to v. 86 * Tue Feb 1 2011 Michal Hlavinka <[email protected]> - 85-1 - ecryptfs-utils updated to 85 * Tue Jan 11 2011 Dan Horák <dan[at]danny.cz> - 84-3 - fix build on arches where char is unsigned by default * Tue Jan 4 2011 Michal Hlavinka <[email protected]> - 84-2 - fix unsigned < 0 test (#664474) * Mon Dec 20 2010 Michal Hlavinka <[email protected]> - 84-1 - ecryptfs-utils updated to 84 -------------------------------------------------------------------------------- References: [ 1 ] Bug #729465 - CVE-2011-1831 CVE-2011-1832 CVE-2011-1834 CVE-2011-1835 CVE-2011-1837 ecryptfs: multiple flaws to mount/umount arbitrary locations and possibly disclose confidential information https://bugzilla.redhat.com/show_bug.cgi?id=729465 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update ecryptfs-utils' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list [email protected] https://admin.fedoraproject.org/mailman/listinfo/package-announce
