Debians sikkerhedsbulletin

DSA-1177-1 usermin -- programmeringsfejl

Rapporteret den:

15. sep 2006

Berørte pakker:

usermin

Sårbar:

Referencer i sikkerhedsdatabaser:

I Debians fejlsporingssystem: Fejl 374609.
I Mitres CVE-ordbog: CVE-2006-4246.

Yderligere oplysninger:

Hendrik Weimer har opdaget at det var muligt for almindelige brugere at slå loginskallen til root-kontoen fra gennem usermin, et webbaseret administrationsværktøj.

I den stabile distribution (sarge) er dette problem rettet i version 1.110-3.1.

I opstrømsdistributionen er dette problem rettet i version 1.220.

Vi anbefaler at du opgraderer din usermin-pakke.

Rettet i:

Debian GNU/Linux 3.1 (sarge)

Kildekode:: http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.dsc; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.diff.gz; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110.orig.tar.gz
Arkitekturuafhængig komponent:: http://security.debian.org/pool/updates/main/u/usermin/usermin-at_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-changepass_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-chfn_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-commands_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-cron_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-cshrc_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-fetchmail_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-forward_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-gnupg_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-htaccess_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-htpasswd_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-mailbox_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-man_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-mysql_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-plan_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-postgresql_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-proc_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-procmail_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-quota_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-schedule_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-shell_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-spamassassin_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-ssh_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-tunnel_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-updown_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-usermount_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1_all.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.