Re: Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

2015-10-03 Thread Gianfranco Costamagna 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Hi folks, with the Unstable/Strech fixed uploads I'm ready to ask for
a DSA, to fix the virtualbox "regression" problem.

Following the debdiff.

Basically we fixed the circular dependency that lead to a bad
behaviour during upgrades for some people.

I'm asking your permission to upload on ftp-master.

cheers,

(and thanks)

Gianfranco

diff --git a/debian/changelog b/debian/changelog
index 3da9c65..de7c7b0 100644
- --- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+virtualbox (4.3.30-dfsg-1+deb8u2) jessie-security; urgency=medium
+
+  [ Ritesh Raj Sarraf ]
+  * Move virtualbox-dkms | virtualbox-source to Depends,
+needed to fully configure virtualbox kernel module prior
+to reload virtualbox service, avoiding a race condition.
+(Closes: #798527, #798979)
+
+ -- Gianfranco Costamagna   Fri, 18 Sep
2015 23:35:08 +0200
+
 virtualbox (4.3.30-dfsg-1+deb8u1) jessie-security; urgency=medium

   [ Ritesh Raj Sarraf ]
diff --git a/debian/control b/debian/control
index 2307870..4972d3c 100644
- --- a/debian/control
+++ b/debian/control
@@ -88,10 +88,8 @@ Description: x86 virtualization solution - Qt based
user interface
 Package: virtualbox
 Architecture: amd64 i386
 Pre-Depends: dpkg (>= 1.15.6~)
- -Depends: adduser, ${misc:Depends}, ${python:Depends}, ${shlibs:Depends}
- -Recommends: virtualbox-dkms (= ${source:Version}) | virtualbox-source
(= ${source:Version}),
- -virtualbox-qt (= ${binary:Version}),
- -${shlibs:Recommends}
+Depends: adduser, ${misc:Depends}, ${python:Depends},
${shlibs:Depends}, virtualbox-dkms (>= ${source:Version}) |
virtualbox-source (>= ${source:Version}) | virtualbox-modules (>=
${source:Version})
+Recommends: virtualbox-qt (= ${binary:Version}), ${shlibs:Recommends}
 Suggests: vde2, virtualbox-guest-additions-iso
 Conflicts: virtualbox-2.0,
virtualbox-2.1,
@@ -132,7 +130,8 @@ Package: virtualbox-dkms
 Section: contrib/kernel
 Architecture: all
 Pre-Depends: dpkg (>= 1.15.6~)
- -Depends: virtualbox (>= ${source:Version}), ${misc:Depends}
+Depends: ${misc:Depends}
+Recommends: virtualbox (>= ${source:Version})
 Description: x86 virtualization solution - kernel module sources for dk
ms
  VirtualBox is a free x86 virtualization solution allowing a wide range
  of x86 operating systems such as Windows, DOS, BSD or Linux to run on
a
@@ -151,6 +150,7 @@ Depends: build-essential,
  kbuild,
  module-assistant,
  ${misc:Depends}
+Recommends: virtualbox (>= ${source:Version})
 Description: x86 virtualization solution - kernel module source
  VirtualBox is a free x86 virtualization solution allowing a wide range
  of x86 operating systems such as Windows, DOS, BSD or Linux to run on
a
@@ -159,6 +159,10 @@ Description: x86 virtualization solution - kernel
module source
  This package provides the source code for the virtualbox kernel module
.
  The virtualbox package is also required in order to make use of these
  modules. Kernel sources or headers are required to compile this module
.
+ .
+ The source is placed under /usr/src, and after decompression it can
+ be built to produce a virtualbox-modules-_KVERS_ providing
+ "virtualbox-modules" package.

 Package: virtualbox-guest-dkms
 Section: contrib/kernel
@@ -194,6 +198,10 @@ Description: x86 virtualization solution - guest
addition module source
  modules. The virtualbox-guest-utils package is also required in order
to
  make use of these modules. Kernel sources or headers are required to
compile
  these modules.
+ .
+ The source is placed under /usr/src, and after decompression it can
+ be built to produce a virtualbox-guest-modules-_KVERS_ providing
+ "virtualbox-guest-modules" package.

 Package: virtualbox-guest-x11
 Section: contrib/x11
-BEGIN PGP SIGNATURE-
Version: GnuPG v2

iQIcBAEBCAAGBQJWD/jnAAoJEPNPCXROn13Zrc0QAL+eILX1PiOhYexUrqx6PEn9
6pkAKJcIFZArl3FL9CQ8MYveBd4D6EhWGgfuhKYDVP8YvAIDTRZNN/kwzv8EBrV4
cJFBs7a4k1t+DO5tREJjUQRxKvPqt2qvu+GaBpSBGyFz+f7Yu9RYOEjfnlVDpOSu
H5hlA1TxSdKbCIQxssqoaD4Wlby0gq1ZSLLH2oFzQa1l5SBn4F9Tck0XDd12JX9a
DnbDl0tG83hq8L+8SNENEkIF67R0952BGCe9XHIeDBQiIY321tAkm4h94keXtexX
rLNNB1IQe/mySH0u/tVoGqWHlx7G30roKUG0GpRZ7qxf9MSjeZN/Ym2NT1YFNMGc
HmLJ/6QjJOwHDIZxhMzYZPklcVwJpJ776NxWuO4UnGJif9uaAfKrUpzOfq7k6aKp
FQOUvKFPXldyFRciDSJypf0q98xAsHM8M5rgZ3h8RFK2It55kMoq42jbxUo3g7GY
EbWFwD9qauoGoDi2CeoJCd+q78l0hX2VpneZFxoHTQNpYzdS61x3pcHKzEYJqfjw
btvyv+qVXzn4cbW02513/IpPwUXSNrq/2MKPfGxPF4sHMVY/TwF8iwtkafHFpa8F
eyyBw9X2/Qt3cSODl2WKQBDc+6NYY17Zh8pnrf0VTXL3hyhj3zP6K8JqTgErAZ5H
FUPu/tu7ros3r10XfoUd
=41iN
-END PGP SIGNATURE-
diff --git a/debian/changelog b/debian/changelog
index 3da9c65..de7c7b0 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,13 @@
+virtualbox (4.3.30-dfsg-1+deb8u2) jessie-security; urgency=medium
+
+  [ Ritesh Raj Sarraf ]
+  * Move virtualbox-dkms | virtualbox-source to Depends,
+needed to fully configure virtualbox kernel module

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Gianfranco Costamagna 
Hi Dirk,


>your recommendation has produced bug #798979 and meanwhile 16 e-mails.
>Why didn't you restrict these obviously not enough tested changes to 
>distributions other than "stable" and "oldstable" or at least to those 
>users who want to work with WiFi? As for Debian no homebanking programs 
>are available which are able to handle with my RSA-chipcard, I am thrown 
>on Windows under VirtualBox. If a new installation of the VM will be 
>necessary I may be confronted with the loss of all my homebanking data, 
>what an awful idea!


Hi Dirk, first, you can always downgrade virtualbox, and you have plenty of 
google
links teaching you how to cope with that.

I can't reproduce the problem, and I'm trying together with upstream my best to 
fix it.

For sure your bug report started with

"virtualbox: DSA-3359-1 causes VBoxClient to send error message "The VirtualBox 
kernel
service is not running" and to break off."
and no bug content, so you didn't gave me enough stuff to work on.


anyway, I have some questions for you, while I'm trying hardly to reproduce the 
problem

(I did install and upgrade on a clean jessie without *any* issue in restarting 
VMs)

I had similar reports in ubuntu, and they were caused by people running the 
virtualbox install from Oracle website
(not the deb file, because we conflict with them) and then not completely 
purging virtualbox prior
to install the Debian package.

So if you really care about your VM you need to give us more information such 
as:

1) did you have a clean system?
2) can you please provide english logs?
3) can you please try to purge virtualbox (maybe from synaptic) and install it 
again?

in the last case I would like to see the full install log, and for sure all the 
log files
mentioned in a possible failure.

cheers,

Gianfranco

Re: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Dirk Olsen 


Am 13.09.2015 um 21:47 schrieb Moritz Muehlenhoff:


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

- -
Debian Security Advisory DSA-3359-1   secur...@debian.org
https://www.debian.org/security/   Moritz Muehlenhoff
September 13, 2015https://www.debian.org/security/faq
- -

Package: virtualbox
CVE ID : CVE-2015-2594

This update fixes an unspecified security issue in VirtualBox related to
guests using bridged networking via WiFi. Oracle no longer provides
information on specific security vulnerabilities in VirtualBox. To still
support users of the already released Debian releases we've decided to
update these to the respective 4.1.40 and 4.3.30 bugfix releases.

For the oldstable distribution (wheezy), this problem has been fixed
in version 4.1.40-dfsg-1+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 4.3.30-dfsg-1+deb8u1.

For the testing distribution (stretch), this problem has been fixed
in version 4.3.30-dfsg-1.

For the unstable distribution (sid), this problem has been fixed in
version 4.3.30-dfsg-1.

We recommend that you upgrade your virtualbox packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-annou...@lists.debian.org
-BEGIN PGP SIGNATURE-
[...]

-END PGP SIGNATURE-


Hi,

your recommendation has produced bug #798979 and meanwhile 16 e-mails.
Why didn't you restrict these obviously not enough tested changes to 
distributions other than "stable" and "oldstable" or at least to those 
users who want to work with WiFi? As for Debian no homebanking programs 
are available which are able to handle with my RSA-chipcard, I am thrown 
on Windows under VirtualBox. If a new installation of the VM will be 
necessary I may be confronted with the loss of all my homebanking data, 
what an awful idea!


Dirk Olsen

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Ritesh Raj Sarraf 
Adding the other bug, similar to it, against Unstable.


As mentioned earlier, it does look like we need to add a tighter
dependency in between the dkms/source package and the main virtualbox
package.


I just made the changes, built, and verified locally. And it seems to
be in line with my root cause. Ofcourse, before I'd like we push it to
Unstable first (and close 798527), and then tackle the other stable
releases. And any additional testing is going to help now.


Please see console log below. With the tighter dependency now,
virtualbox does not get picked until its {Pre}Dependency, i.e.
virtualbox-dkms is properly installed.

I have pushed the changes to the git repo, for the master branch.

@Gianfranco: I'm still on the sloppy internet network, so if you have
the bandwidth, please feel free to prepare the new upload.


rrs@chutzpah:/var/tmp/vbox$ apt-cache policy virtualbox virtualbox-dkms
virtualbox:
  Installed: 5.0.4-dfsg-2
  Candidate: 5.0.4-dfsg-2
  Version table:
 5.0.4-dfsg-3 0
500 file:/var/tmp/vbox/  Packages
 *** 5.0.4-dfsg-2 0
990 http://ftp.debian.org/debian/ testing/contrib amd64
Packages
500 http://ftp.debian.org/debian/ unstable/contrib amd64
Packages
100 /var/lib/dpkg/status
virtualbox-dkms:
  Installed: 5.0.4-dfsg-2
  Candidate: 5.0.4-dfsg-2
  Version table:
 5.0.4-dfsg-3 0
500 file:/var/tmp/vbox/  Packages
 *** 5.0.4-dfsg-2 0
990 http://ftp.debian.org/debian/ testing/contrib amd64
Packages
500 http://ftp.debian.org/debian/ unstable/contrib amd64
Packages
100 /var/lib/dpkg/status
22:56 ♒♒♒   ☺

rrs@chutzpah:/var/tmp/vbox$ sudo aptitude install virtualbox=5.0.4-dfsg
-3 virtualbox-dkms=5.0.4-dfsg-3 virtualbox-qt=5.0.4-dfsg-3
The following packages will be upgraded: 
  virtualbox virtualbox-dkms virtualbox-qt 
3 packages upgraded, 0 newly installed, 0 to remove and 6 not upgraded.
Need to get 0 B/21.3 MB of archives. After unpacking 12.3 kB will be
freed.
Do you want to continue? [Y/n/?] 
WARNING: untrusted versions of the following packages will be
installed!

Untrusted packages could compromise your system's security.
You should only proceed with the installation if you are certain that
this is what you want to do.

  virtualbox virtualbox-dkms virtualbox-qt 

Do you want to ignore this warning and proceed anyway?
To continue, enter "Yes"; to abort, enter "No": Yes
Reading changelogs... Doneelogs... 33%   
(Reading database ... 332296 files and directories currently
installed.)
Preparing to unpack .../virtualbox-dkms_5.0.4-dfsg-3_all.deb ...

 Uninstall Beginning 
Module:  virtualbox
Version: 5.0.4
Kernel:  4.1.7+ (x86_64)
-

Status: Before uninstall, this module version was ACTIVE on this
kernel.

vboxdrv.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxnetadp.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxnetflt.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.


vboxpci.ko:
 - Uninstallation
   - Deleting from: /lib/modules/4.1.7+/updates/dkms/
 - Original module
   - No original module was found for this module on this kernel.
   - Use the dkms install command to reinstall any previous module
version.

depmod...

DKMS: uninstall completed.

--
Deleting module version: 5.0.4
completely from the DKMS tree.
--
Done.
Unpacking virtualbox-dkms (5.0.4-dfsg-3) over (5.0.4-dfsg-2) ...
Preparing to unpack .../virtualbox-qt_5.0.4-dfsg-3_amd64.deb ...
Unpacking virtualbox-qt (5.0.4-dfsg-3) over (5.0.4-dfsg-2) ...
Processing triggers for hicolor-icon-theme (0.13-1) ...
Processing triggers for shared-mime-info (1.3-1) ...
Unknown media type in type 'all/all'
Unknown media type in type 'all/allfiles'
Processing triggers for mime-support (3.59) ...
Processing triggers for gnome-menus (3.13.3-6) ...
Processing triggers for desktop-file-utils (0.22-1) ...
Processing triggers for menu (2.1.47) ...
Processing triggers for man-db (2.7.3-1) ...
Setting up virtualbox-dkms (5.0.4-dfsg-3) ...
Loading new virtualbox-5.0.4 DKMS files...
Building only for 4.1.7+
Building initial module for 4.1.7+
Done.

vboxdrv:
Running module version sanity check.
 - Original module
   - No original module exists within this kernel
 - Installation
   - Installing to /lib/modules/4.1.7+/updates/dkms/

vboxnetadp.ko:
Running module version sanity check.
 - Original module

Re: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Moritz Mühlenhoff 
Georgi Naplatanov  schrieb:
>
> Dear maintainer(s),
> virtualbox-guest-additions-iso package version is 4.3.18. Are you going
> to update the package to version 4.3.30?

The security team support doesn't support non-free. The maintainer can update
it in a point update if needed.

Cheers,
Moritz

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Gianfranco Costamagna 
BTW I'm mostly sure as we specified in a previous email, this problem is not 
related to the security
DSA, but with a race condition in an upgrade path handled by apt.
(probably always here, but with systemd it might be occurring more frequently).

(it might have happened with a one-line patch, or even with a no change rebuild)


A solution might be to do a
"systemctl stop virtualbox" and check that no "VBoxSVC" is running.


(and sorry for the bad experience you had)


cheers,

Gianfranco

Re: Bug#798979: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-18 Thread Dirk Olsen 


Am 18.09.2015 um 12:07 schrieb Gianfranco Costamagna:


[...]

Hi Dirk, first, you can always downgrade virtualbox, and you have plenty of 
google
links teaching you how to cope with that.

[...]


Hi Gianfranco,

before taking further action I would like to know whether the Debian 
Security Team or the command "apt-get" use Google utilities when working 
internal.


Sincerely, Dirk Olsen

Re: [SECURITY] [DSA 3359-1] virtualbox security update

2015-09-14 Thread Georgi Naplatanov 
On 09/13/2015 10:47 PM, Moritz Muehlenhoff wrote:
> -
> Debian Security Advisory DSA-3359-1   secur...@debian.org
> https://www.debian.org/security/   Moritz Muehlenhoff
> September 13, 2015https://www.debian.org/security/faq
> -
> 
> Package: virtualbox
> CVE ID : CVE-2015-2594
> 
> This update fixes an unspecified security issue in VirtualBox related to
> guests using bridged networking via WiFi. Oracle no longer provides
> information on specific security vulnerabilities in VirtualBox. To still
> support users of the already released Debian releases we've decided to
> update these to the respective 4.1.40 and 4.3.30 bugfix releases. 
> 
> For the oldstable distribution (wheezy), this problem has been fixed
> in version 4.1.40-dfsg-1+deb7u1.
> 
> For the stable distribution (jessie), this problem has been fixed in
> version 4.3.30-dfsg-1+deb8u1.
> 
> For the testing distribution (stretch), this problem has been fixed
> in version 4.3.30-dfsg-1.
> 
> For the unstable distribution (sid), this problem has been fixed in
> version 4.3.30-dfsg-1.
> 
> We recommend that you upgrade your virtualbox packages.
> 
> Further information about Debian Security Advisories, how to apply
> these updates to your system and frequently asked questions can be
> found at: https://www.debian.org/security/
> 
> Mailing list: debian-security-annou...@lists.debian.org

Dear maintainer(s),
virtualbox-guest-additions-iso package version is 4.3.18. Are you going
to update the package to version 4.3.30?

Kind regards
Georgi