Debianin tietoturvatiedote

DSA-197-1 courier -- puskurin ylivuoto

Ilmoitettu:
15.11.2002
Vaikutuksen alaiset paketit:
courier
Altis:
Kyllä
Viittaukset tietoturvatietokantoihin:
Mitren CVE-sanakirjassa: CVE-2002-1311.
Lisätietoa:

Courier sqwebmail-paketista, CGI-ohjelmasta joka tarjoaa autentikoidun pääsyn paikallisille postilaatikoille, on löydetty ongelma. Ohjelma ei pudota käyttöoikeuksia riittävän nopeasti käynnistysvaiheessa tietyissä olosuhteissa, jolloin paikallinen komentotulkin käyttäjä voi ajaa sqwebmail-binäärin ja siten kykenee lukemaan satunnaisen tiedoston paikalliselta tiedostojärjestelmältä.

Ongelma on korjattu nykyisen vakaan jakelun (woody) versiossa 0.37.3-2.3 ja epävakaan jakelun (sid) versiossa 0.40.0-1. Aikaisempi vakaa jakelu (potato) ei sisällä Courier sqwebmail-paketteja. courier-ssl-paketit eivät ole myöskään alttiita koska ne eivät ole riippuvaisia sqwebmail-paketista.

Suosittelemme sqwebmail-paketin välitöntä päivittämistä.

Korjattu:

Debian GNU/Linux 3.0 (woody)

Lähde:
http://security.debian.org/pool/updates/main/c/courier/courier_0.37.3-2.3.diff.gz
http://security.debian.org/pool/updates/main/c/courier/courier_0.37.3-2.3.dsc
http://security.debian.org/pool/updates/main/c/courier/courier_0.37.3.orig.tar.gz
Arkkitehtuuririippumaton komponentti:
http://security.debian.org/pool/updates/main/c/courier/courier-doc_0.37.3-2.3_all.deb
Alpha:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier-ssl/courier-imap-ssl_1.4.3-3.1_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_alpha.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_alpha.deb
ARM:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_arm.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_arm.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_i386.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_ia64.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_ia64.deb
HP Precision:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_hppa.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_hppa.deb
Motorola 680x0:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_m68k.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_m68k.deb
Big endian MIPS:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_mips.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_mips.deb
Little endian MIPS:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_mipsel.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_powerpc.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_s390.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/c/courier/courier-authdaemon_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-authmysql_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-base_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-debug_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-imap_1.4.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-ldap_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-maildrop_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mlm_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-mta_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pcp_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-pop_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/courier-webadmin_0.37.3-2.3_sparc.deb
http://security.debian.org/pool/updates/main/c/courier/sqwebmail_0.37.3-2.3_sparc.deb

Listattujen tiedostojen MD5-tarkistussummat ovat luettavissa alkuperäisestä tiedotteesta.