Security World: [SECURITY] [DSA 2037-1] New kdm packages fix privilege escalation

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-2037-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
April 17, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : kdm (kdebase)
Vulnerability : race condition
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2010-0436

Sebastian Krahmer discovered that a race condition in the KDE Desktop
Environment's KDM display manager, allow a local user to elevate privileges
to root.

For the stable distribution (lenny), this problem has been fixed in version
4:3.5.9.dfsg.1-6+lenny1.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your kdm package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/k/kdebase/kdebase_3.5.9.dfsg.1-6+lenny1.diff.gz
Size/MD5 checksum: 1073859 4fcea749b80fe556f2a5b311495c75c6
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_3.5.9.dfsg.1.orig.tar.gz
Size/MD5 checksum: 27978023 497176f651e348722ed8a17bb437ac28
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_3.5.9.dfsg.1-6+lenny1.dsc
Size/MD5 checksum: 2921 a7026a6edffbad1207c03aa7c3e61c41

Architecture independent packages:

http://security.debian.org/pool/updates/main/k/kdebase/kdebase-doc_3.5.9.dfsg.1-6+lenny1_all.deb
Size/MD5 checksum: 1236508 1c9471e67998687a2886b1a3a4aa48fa
http://security.debian.org/pool/updates/main/k/kdebase/kdebase_3.5.9.dfsg.1-6+lenny1_all.deb
Size/MD5 checksum: 38468 17e217191d3060d823d93fef0dde6167
http://security.debian.org/pool/updates/main/k/kdebase/kdeeject_3.5.9.dfsg.1-6+lenny1_all.deb
Size/MD5 checksum: 37684 79bb46efdeb8cd9ef5f6aff2d52d9628
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-doc-html_3.5.9.dfsg.1-6+lenny1_all.deb
Size/MD5 checksum: 376972 ebd58296ec6076d5bda03d3b9ba70fb4
http://security.debian.org/pool/updates/main/k/kdebase/kdebase-data_3.5.9.dfsg.1-6+lenny1_all.deb
Size/MD5 checksum: 10329324 8630741db4aa5464f34b4898f8ccf076

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJLyi3uAAoJECIIoQCMVaAcE00H/1DcWpjBW1yhUKAkpMk6Ox7d
OQIEcb+xMKjplKE1Y+i73BGLzq03oXr6o16W8pL8orQ2RDwqhVkYBaNwRzHtRawl
nk6Tc4MRhAw9p89HJoLmKTU7EDrGS/ryMcA0YyTUhlTcXruMa4P116tP9rIZqveC
UhAICjEm+2IPT++a6yBI1WztCtXA3RuZjfr7KfviRjrGCxkzVFCSN7ssp+Zl7ns8
vdpvlNnExxRvzZAwhAn1BSLs3rxwp8YsXSAvDTncO2tko7Eh9H84Qrd45eTGmzs4
RoTvowhmY2zHVFHMqAyrLTwLS4dS0JgZqi7laO5xPZTT4IST141Zn9S3rhPn/Vs=
=078U
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20100417215451.78B3C3267BD@morgana.loeki.tv

Security World

Search This Blog

Saturday, April 17, 2010

[SECURITY] [DSA 2037-1] New kdm packages fix privilege escalation

No comments: