Security World: [SECURITY] [DSA 2015-1] New drbd8 packages fix privilege escalation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2015 security@debian.org
http://www.debian.org/security/ Dann Frazier
March 15, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : drbd8
Vulnerability : privilege escalation
Problem type : local
Debian-specific: no
CVE Id(s) : not yet available
Debian Bug : 573531

A local vulnerability has been discovered in drbd8.

Philipp Reisner fixed an issue in the drbd kernel module that allows
local users to send netlink packets to perform actions that should be
restricted to users with CAP_SYS_ADMIN privileges. This is a similar
issue to those described by CVE-2009-3725.

This update also fixes an ABI compatibility issue which was introduced
by linux-2.6 (2.6.26-21lenny3). The prebuilt drbd module packages listed
in this advisory require a linux-image package version 2.6.26-21lenny3
or greater.

For the stable distribution (lenny), this problem has been fixed in
drbd8 (2:8.0.14-2+lenny1).

We recommend that you upgrade your drbd8 packages.

The linux-modules-extra-2.6 package has been rebuilt against the updated
drbd8 package to provide fixed prebuilt drbd8-modules packages. If,
instead of using the prebuilt drbd8-modules packages, you have built and
installed a local copy of the drbd module from the drbd8-source package
(e.g., using module-assistant), you will need to follow the same steps
you originally used to rebuild your module after upgrading the
drbd8-source package.

Note: After upgrading a kernel module you must reload the module
for the changes to take effect:
1) Shutdown all services that make use of the drbd module
2) Unload the previous drbd module (modprobe -r drbd)
3) Load the updated drbd module (modprobe drbd)
4) Restart any services that make use of the drbd module

A system reboot will also cause the updated module to be used.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/d/drbd8/drbd8_8.0.14-2+lenny1.diff.gz
Size/MD5 checksum: 13534 0f37f7d1b213bb9da12a77739ea732ec
http://security.debian.org/pool/updates/main/d/drbd8/drbd8_8.0.14-2+lenny1.dsc
Size/MD5 checksum: 1106 ac5eca2917f7a55329edd74fc5337bf8
http://security.debian.org/pool/updates/main/d/drbd8/drbd8_8.0.14.orig.tar.gz
Size/MD5 checksum: 319039 8b4586e2561879b5e86d0a91affb5aa2
http://security.debian.org/pool/updates/main/l/linux-modules-extra-2.6/linux-modules-extra-2.6_2.6.26-6+lenny3.tar.gz
Size/MD5 checksum: 110567 48b74b1067e1fb89169292e5a008271e
http://security.debian.org/pool/updates/main/l/linux-modules-extra-2.6/linux-modules-extra-2.6_2.6.26-6+lenny3.dsc
Size/MD5 checksum: 22876 8bf03cefe9575d96400f701f477b5173

Architecture independent packages:

http://security.debian.org/pool/updates/main/d/drbd8/drbd8-source_8.0.14-2+lenny1_all.deb
Size/MD5 checksum: 144286 23122da383150e92058d581c652bcc1f

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iD8DBQFLnu4PhuANDBmkLRkRAq4WAJ9R87UlsWvCE3IX1OW+8jSTAg+IhwCdGDl5
jpbW2gQTwrIvLQlcE9X2kzk=
=iNuw
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20100316023704.GJ10141@ldl.fc.hp.com

Security World

Search This Blog

Monday, March 15, 2010

[SECURITY] [DSA 2015-1] New drbd8 packages fix privilege escalation

No comments: