From joey@infodrom.org Wed Mar 22 01:17:10 2006 From: Martin Schulze Resent-From: list@murphy.debian.org (Mailing List Manager) To: Debian Security Announcements Date: Wed, 22 Mar 2006 07:14:44 +0100 (CET) Reply-To: full-disclosure@lists.grok.org.uk Subject: [Full-disclosure] [SECURITY] [DSA 1013-1] New snmptrapfmt packages fix insecure temporary file -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1013-1 security@debian.org http://www.debian.org/security/ Martin Schulze March 22nd, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : snmptrapfmt Vulnerability : insecure temporary file Problem type : local Debian-specific: no CVE ID : CVE-2006-0050 Will Aoki discovered that snmptrapfmt, a configurable snmp trap handler daemon for snmpd, does not prevent overwriting existing files when writing to a temporary log file. For the old stable distribution (woody) this problem has been fixed in version 1.03woody1. For the stable distribution (sarge) this problem has been fixed in version 1.08sarge1. For the unstable distribution (sid) this problem has been fixed in version 1.10-1. We recommend that you upgrade your snmptrapfmt package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.0 alias woody - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1.dsc Size/MD5 checksum: 526 70bff136cf1671dba87b7c25b76b534c http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1.tar.gz Size/MD5 checksum: 16716 ac6bcf8eccfa4f71e0ef9ea14bdd4ef2 Alpha architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_alpha.deb Size/MD5 checksum: 20836 85e594b0cba3135205290f6e9c9e45d8 ARM architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_arm.deb Size/MD5 checksum: 15972 727d82a7bf68f33f058026608636179b Intel IA-32 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_i386.deb Size/MD5 checksum: 15828 51cc452a5a4a34adf3eee8bd0f1cc931 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_ia64.deb Size/MD5 checksum: 23470 d88193f743bd931056ababfe186b406d HP Precision architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_hppa.deb Size/MD5 checksum: 17876 eb4bfab080f1e01f8c1c424b37e86d2e Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_m68k.deb Size/MD5 checksum: 15300 e5bc6331255c4d367b21fa33484a24df Big endian MIPS architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_mips.deb Size/MD5 checksum: 17414 706c890e463e40982115577d6366b38c Little endian MIPS architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_mipsel.deb Size/MD5 checksum: 17396 4b9549de0525237b7960fcc3fb7a7e34 PowerPC architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_powerpc.deb Size/MD5 checksum: 17012 77a60b2618a0d6402b61505542def0c9 IBM S/390 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_s390.deb Size/MD5 checksum: 16396 9c432c75e9ab8999f706cf5f44a3f912 Sun Sparc architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.03woody1_sparc.deb Size/MD5 checksum: 20106 dba3eb8c1af9cd1cf4887b9f9f5dc919 Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1.dsc Size/MD5 checksum: 516 b50422f5221e403d2050c14b7c66ce61 http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1.tar.gz Size/MD5 checksum: 18028 4272e8d4477b04fe767e81bf42100ddb Alpha architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_alpha.deb Size/MD5 checksum: 20432 d6ac3ca520d385a287668f1052309ace AMD64 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_amd64.deb Size/MD5 checksum: 18940 b1569bc7eb07473243c3cb8d3ae39b0d ARM architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_arm.deb Size/MD5 checksum: 17314 09efd328261c381c3d5820fd8694687f Intel IA-32 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_i386.deb Size/MD5 checksum: 17556 297688542b5ebc69a90d65eefcf91bf1 Intel IA-64 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_ia64.deb Size/MD5 checksum: 23648 c09e71375846d03fcc055661a4fa5583 HP Precision architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_hppa.deb Size/MD5 checksum: 19622 43dd8b83363eabc50db98b94c8997669 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_m68k.deb Size/MD5 checksum: 16940 538ee49ec5f773667ec7dd673685fb2b Big endian MIPS architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_mips.deb Size/MD5 checksum: 20446 cd81b32736aed88be213a8b081b0c433 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_mipsel.deb Size/MD5 checksum: 20528 c1c92e310b4d39d22b5fd322741c9375 PowerPC architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_powerpc.deb Size/MD5 checksum: 18244 e5ed9744340de79cab0f5b79638f0fbb IBM S/390 architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_s390.deb Size/MD5 checksum: 18436 be9b62e95c994b756200e868339d378e Sun Sparc architecture: http://security.debian.org/pool/updates/main/s/snmptrapfmt/snmptrapfmt_1.08sarge1_sparc.deb Size/MD5 checksum: 17450 d99f331ac8d556f359d45211a78cddf8 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (GNU/Linux) iD8DBQFEIOtTW5ql+IAeqTIRAoTjAJ9JBST8vYtEoA17BmMriapCYaqlogCdFIWb /oFqeRbFJO2oacu/kMcy5vw= =rCmj -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/