1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 1643-1] New feta packages fix denial of service

    From Moritz Muehlenhoff@1:229/2 to All on Sun Oct 5 14:02:34 2008
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - ------------------------------------------------------------------------ Debian Security Advisory DSA-1643-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff October 05, 2008 http://www.debian.org/security/faq
    - ------------------------------------------------------------------------

    Package : feta
    Vulnerability : insecure temp file handling
    Problem type : local
    Debian-specific: no
    CVE Id(s) : CVE-2008-4440
    Debian Bug : 496397

    Dmitry E. Oboukhov discovered that the "to-upgrade" plugin of Feta,
    a simpler interface to APT, dpkg, and other Debian package tools
    creates temporary files insecurely, which may lead to local denial
    of service through symlink attacks.

    For the stable distribution (etch), this problem has been fixed in
    version 1.4.15+etch1.

    For the unstable distribution (sid), this problem has been fixed in
    version 1.4.16+nmu1.

    We recommend that you upgrade your feta package.

    Upgrade instructions
    - --------------------

    wget url
    will fetch the file for you
    dpkg -i file.deb
    will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
    will update the internal database
    apt-get upgrade
    will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.


    Debian GNU/Linux 4.0 alias etch
    - -------------------------------

    Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

    Source archives:

    http://security.debian.org/pool/updates/main/f/feta/feta_1.4.15+etch1.dsc
    Size/MD5 checksum: 545 87c8cdfc722b149eefc2c4cc1e05c868
    http://security.debian.org/pool/updates/main/f/feta/feta_1.4.15+etch1.tar.gz
    Size/MD5 checksum: 52134 27b5bc566e7f42a5b79dd8ef67013b8d

    Architecture independent packages:

    http://security.debian.org/pool/updates/main/f/feta/feta_1.4.15+etch1_all.deb
    Size/MD5 checksum: 47708 8133fddc8dc30973c5fcb3368292b1fb

    These files will probably be moved into the stable distribution on
    its next update.

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: [email protected]
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>












    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.9 (GNU/Linux)

    iEYEARECAAYFAkjon74ACgkQXm3vHE4uylreTgCg2Zv31MR4RicAZZkBMrD9UAsY 6iMAn0eev0L7/1n1QZDvoPPdbdKn+xPP
    =hHRj
    -----END PGP SIGNATURE-----


    --
    To UNSUBSCRIBE, email to [email protected]
    with a subject of "unsubscribe". Trouble? Contact [email protected]

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)