Re: [SECURITY] [DSA 1611-1] New afuse packages fix privilege escalation
On 16 July 2008 21:18:32 Thijs Kinkhorst wrote:
> ------------------------------------------------------------------------
> Debian Security Advisory DSA-1611-1 security@debian.org
> http://www.debian.org/security/ Thijs Kinkhorst
> July 16, 2008 http://www.debian.org/security/faq
> ------------------------------------------------------------------------
>
> Package : afuse
> Vulnerability : privilege escalation
> Problem type : local
> Debian-specific: no
> CVE Id(s) : CVE-2008-2232
> Debian Bug : 490921
>
> Anders Kaseorg discovered that afuse, an automounting file system
> in user-space, did not properly escape meta characters in paths.
> This allowed a local attacker with read access to the filesystem to
> execute commands as the owner of the filesystem.
>
> For the stable distribution (etch), this problem has been fixed in
> version 0.1.1-1+etch1.
>
> For the unstable distribution (sid), this problem has been fixed in
> version 0.2-3.
>
> We recommend that you upgrade your afuse (0.1.1-1+etch1) package.
>
> Upgrade instructions
> --------------------
>
> wget url
> will fetch the file for you
> dpkg -i file.deb
> will install the referenced file.
>
> If you are using the apt-get package manager, use the line for
> sources.list as given below:
>
> apt-get update
> will update the internal database
> apt-get upgrade
> will install corrected packages
>
> You may use an automated update by adding the resources from the
> footer to the proper configuration.
>
>
> Debian GNU/Linux 4.0 alias etch
> -------------------------------
>
> Source archives:
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.di
>ff.gz Size/MD5 checksum: 3699 645246f8f338b76b6d6785fff9997c5a
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1.ds
>c Size/MD5 checksum: 657 fe408099626f3bad3bc68d2717df2a9b
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1.orig.tar.g
>z Size/MD5 checksum: 98171 95cce7d6ed8e984d0ff2d650e6beb167
>
> alpha architecture (DEC Alpha)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_al
>pha.deb Size/MD5 checksum: 15476 465baebb172ecda5ed1e7bdd174fddac
>
> amd64 architecture (AMD x86_64 (AMD64))
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_am
>d64.deb Size/MD5 checksum: 14224 5e5dca72cb191bf0d435f770c62e07f5
>
> arm architecture (ARM)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ar
>m.deb Size/MD5 checksum: 12448 f39bc75bceec2e8979a514bda07164d6
>
> hppa architecture (HP PA RISC)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_hp
>pa.deb Size/MD5 checksum: 14602 603022ee85f781d0c8c155936d432484
>
> i386 architecture (Intel ia32)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_i3
>86.deb Size/MD5 checksum: 13086 b422ac9cb737dd1fb7827eb6ea222bba
>
> ia64 architecture (Intel ia64)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_ia
>64.deb Size/MD5 checksum: 17730 9fc41e69a8df1ddee15831b971ededb1
>
> mips architecture (MIPS (Big Endian))
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mi
>ps.deb Size/MD5 checksum: 14232 69ebaa63e04dd9a16ad8ff5a772dc576
>
> mipsel architecture (MIPS (Little Endian))
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_mi
>psel.deb Size/MD5 checksum: 14282 9dabd8530851c9588c4927f53cf923d2
>
> powerpc architecture (PowerPC)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_po
>werpc.deb Size/MD5 checksum: 13582 c6c86e8600353b4ff4ed66c9608fd7d0
>
> s390 architecture (IBM S/390)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_s3
>90.deb Size/MD5 checksum: 14154 b36cc8bab5a28d13430a18697bb4b85c
>
> sparc architecture (Sun SPARC/UltraSPARC)
>
>
> http://security.debian.org/pool/updates/main/a/afuse/afuse_0.1.1-1+etch1_sp
>arc.deb Size/MD5 checksum: 12562 ff0fd7531cc011d032f74c78ae17ca0e
>
>
> These files will probably be moved into the stable distribution on
> its next update.
>
> ---------------------------------------------------------------------------
>------ For apt-get: deb http://security.debian.org/ stable/updates main
> For dpkg-ftp: ftp://security.debian.org/debian-security
> dists/stable/updates/main Mailing list:
> debian-security-announce@lists.debian.org
> Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
Reply to: