Security World: [SECURITY] [DSA 1973-1] New glibc packages fix information disclosure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1973-1 security@debian.org
http://www.debian.org/security/ Aurelien Jarno
January 19, 2010 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : glibc, eglibc
Vulnerability : information disclosure
Problem type : local
Debian-specific: no
CVE Id : CVE-2010-0015
Debian Bug : 560333

Christoph Pleger has discovered that the GNU C Library (aka glibc) and
its derivatives add information from the passwd.adjunct.byname map to
entries in the passwd map, which allows local users to obtain the
encrypted passwords of NIS accounts by calling the getpwnam function.

For the oldstable distribution (etch), this problem has been fixed in
version 2.3.6.ds1-13etch10 of the glibc package.

For the stable distribution (lenny), this problem has been fixed in
version 2.7-18lenny2 of the glibc package.

For the unstable distribution (sid) this problem has been fixed in
version 2.10.2-4 of the eglibc package.

We recommend that you upgrade your glibc or eglibc package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian (oldstable)
- ---------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/g/glibc/glibc_2.3.6.ds1-13etch10.dsc
Size/MD5 checksum: 2194 3985b011708649359ca02ddb917e66b0
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.3.6.ds1-13etch10.diff.gz
Size/MD5 checksum: 920950 fda680921e06d9448442c0e40a82b4fa
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.3.6.ds1.orig.tar.gz
Size/MD5 checksum: 13307585 d5e6ffe51e49ab29d513e600fb87cf54

Architecture independent packages:

http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.3.6.ds1-13etch10_all.deb
Size/MD5 checksum: 1480556 cf597752b310168ddbe626ee79671a33
http://security.debian.org/pool/updates/main/g/glibc/locales_2.3.6.ds1-13etch10_all.deb
Size/MD5 checksum: 4009500 c2a534de63b9f6ee1e76f65abc49feb8

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/g/glibc/libc6.1-udeb_2.3.6.ds1-13etch10_ia64.udeb
Size/MD5 checksum: 1258168 94be3180bc0c2717cb3d6f8d8843bb0e
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 4022146 c61ebac27a2c0079a7fe6b6c2b25dee3
http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.3.6.ds1-13etch10_ia64.udeb
Size/MD5 checksum: 12576 582391b772e14373092837244e374e73
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 2140854 834c1162eb0e238130300d46e16accb6
http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 6405448 799ae21bc72a07cdc0921fca4edbe446
http://security.debian.org/pool/updates/main/g/glibc/nscd_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 165410 be53e71650ca09aa7eef465b7bd59210
http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.3.6.ds1-13etch10_ia64.udeb
Size/MD5 checksum: 21028 0b880e73916a41284d809dbe21cf139f
http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 6128622 a59c96c89c263755cb6c6fec1ccfc219
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 5584726 a54b6c6dbb2a8468ccbcb214f471ed9a
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.3.6.ds1-13etch10_ia64.deb
Size/MD5 checksum: 1638622 c0dc39ec7c845979ed819792af9e0745

mipsel architecture (MIPS (Little Endian))

http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 6121780 0429ea7a908709bebb6dcf1d3100178a
http://security.debian.org/pool/updates/main/g/glibc/libc6_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 3943222 eac023ecfb071c2ae42c15119a8d622a
http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.3.6.ds1-13etch10_mipsel.udeb
Size/MD5 checksum: 8888 fd797ed35504a765910e713a5145b6c2
http://security.debian.org/pool/updates/main/g/glibc/libc6-prof_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 1770304 c0d6a55ecd9eab9815fbdc64dfb6b2da
http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.3.6.ds1-13etch10_mipsel.udeb
Size/MD5 checksum: 14666 3b59893d657b9551323cdb6aa2d6bd90
http://security.debian.org/pool/updates/main/g/glibc/libc6-pic_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 1399918 016c2369e7c28cbee32136a1aeb9a8a9
http://security.debian.org/pool/updates/main/g/glibc/libc6-udeb_2.3.6.ds1-13etch10_mipsel.udeb
Size/MD5 checksum: 985476 7e16c25784b4b05011a2ab1960755123
http://security.debian.org/pool/updates/main/g/glibc/nscd_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 144404 35aec97c9996fccf72078f3584a27991
http://security.debian.org/pool/updates/main/g/glibc/libc6-dev_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 2285748 a0a2d6d6003a16ac2dabb9d7e3bcc30d
http://security.debian.org/pool/updates/main/g/glibc/libc6-dbg_2.3.6.ds1-13etch10_mipsel.deb
Size/MD5 checksum: 5387612 23c25ed0aa885a82a2cb61cab5c9be9e

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7.orig.tar.gz
Size/MD5 checksum: 15386750 8816fbab13a072c0ccef6640c9d20833
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny2.diff.gz
Size/MD5 checksum: 746080 490b5454e410e7e6d173f35ed6d12068
http://security.debian.org/pool/updates/main/g/glibc/glibc_2.7-18lenny2.dsc
Size/MD5 checksum: 2564 348520fae28f63a32cfe8a6dc520231c

Architecture independent packages:

http://security.debian.org/pool/updates/main/g/glibc/locales_2.7-18lenny2_all.deb
Size/MD5 checksum: 4489926 58c7260aea726ee23a0e50d84595b540
http://security.debian.org/pool/updates/main/g/glibc/glibc-doc_2.7-18lenny2_all.deb
Size/MD5 checksum: 1628986 e785ce5ce122129805c5a90757970061
http://security.debian.org/pool/updates/main/g/glibc/glibc-source_2.7-18lenny2_all.deb
Size/MD5 checksum: 16005994 704856f12c5c9c43a8d5dd904af45b03

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dbg_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 6261652 06e88c0da93fd7dab0829847a0f94deb
http://security.debian.org/pool/updates/main/g/glibc/libnss-files-udeb_2.7-18lenny2_ia64.udeb
Size/MD5 checksum: 22610 7fe0c2d35af30d4eec8d0176d65c1e51
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-prof_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 2691134 eb2fd2d4fc61fa7c237f32b379791d2f
http://security.debian.org/pool/updates/main/g/glibc/nscd_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 197792 63b2679123616dce20c69f6579255958
http://security.debian.org/pool/updates/main/g/glibc/libc6.1_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 5615338 75d10e4f9e5bd92f4c7089f810b25d20
http://security.debian.org/pool/updates/main/g/glibc/locales-all_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 2605826 fff74128c928247980ff44cedcfbd120
http://security.debian.org/pool/updates/main/g/glibc/libnss-dns-udeb_2.7-18lenny2_ia64.udeb
Size/MD5 checksum: 12942 eb26ffb3b5c56da8e92ba2b764be25a3
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-udeb_2.7-18lenny2_ia64.udeb
Size/MD5 checksum: 1382410 4bdef86179309a310b727db9bee1c1cd
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-pic_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 1743264 6916eb62e98cdefa6eeb94283d78e9a8
http://security.debian.org/pool/updates/main/g/glibc/libc6.1-dev_2.7-18lenny2_ia64.deb
Size/MD5 checksum: 3229900 47564364622287000f2028b532d85274

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAktWMjcACgkQ62zWxYk/rQfjtACglnOO7ZVyXeofiXK1HBQQEboe
uPIAn08MwJSa5ImltY5pmV/g9jSTniI3
=hoKv
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Tuesday, January 19, 2010

[SECURITY] [DSA 1973-1] New glibc packages fix information disclosure

No comments:

Post a Comment