BugTraq
[USN-968-1] Dell Latitude 2110 vulnerability Aug 05 2010 07:45PM
Kees Cook (kees ubuntu com)
===========================================================
Ubuntu Security Notice USN-968-1 August 05, 2010
base-files vulnerability
CVE-2010-0834
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
base-files 5.0.0ubuntu7.1

Ubuntu 10.04 LTS:
base-files 5.0.0ubuntu20.10.04.2

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that the Ubuntu image shipped on some Dell Latitude
2110 systems was accidentally configured to allow unauthenticated package
installations. A remote attacker intercepting network communications or
a malicious archive mirror server could exploit this to trick the user
into installing unsigned packages, resulting in arbitrary code execution
with root privileges.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu7.1.dsc
Size/MD5: 853 a699f7de48cd09591785129b4840ef56
http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu7.1.tar.gz
Size/MD5: 74901 d802a9135ce2e49e065926b69e16e646

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/lsb-release-ude
b_5.0.0ubuntu7.1_all.udeb
Size/MD5: 788 558c290ae2250679a3836da80fa3ebc0

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu7.1_amd64.deb
Size/MD5: 68358 67faf1b12530db1c708ba12994d88f60

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu7.1_i386.deb
Size/MD5: 68354 ec91c2c47ba30e2a3f2c5ee3ef73d812

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1
_lpia.deb
Size/MD5: 68360 1feaa5345fd288eca0fdd180ee12e140

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1
_powerpc.deb
Size/MD5: 68364 4543aabd986eced6a2dadd78ab93daf9

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu7.1
_sparc.deb
Size/MD5: 68366 2ccfbeddb349e6999d93d2505ed40a10

Updated packages for Ubuntu 10.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu20.10.04.2.dsc
Size/MD5: 876 9afddf09156582a48e57c76fab0cf4fa
http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu20.10.04.2.tar.gz
Size/MD5: 76356 d57362eab34a8e9f6cf27b595143c332

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/lsb-release-ude
b_5.0.0ubuntu20.10.04.2_all.udeb
Size/MD5: 788 3e937b94118602fc84aab4adbe3f9e97

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu20.10.04.2_amd64.deb
Size/MD5: 70240 2ecf9c810ef2f2315f63881068d8b839

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/b/base-files/base-files_5.0.
0ubuntu20.10.04.2_i386.deb
Size/MD5: 70236 d780378cf42209eeb90ed2f68940b837

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu20.
10.04.2_powerpc.deb
Size/MD5: 70230 3a5889ee074ddf43e7be7e6cbbc81c16

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/b/base-files/base-files_5.0.0ubuntu20.
10.04.2_sparc.deb
Size/MD5: 70236 c1fdeedbea2bcb8423ea745406ec3a05

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Kees Cook <kees (at) outflux (dot) net [email concealed]>

iEYEARECAAYFAkxbFM0ACgkQH/9LqRcGPm1sywCdGL4yzzoKXeK5pWwlk0EnUXxs
XzAAoIuT5L3BBRSh0YBMF+TuOPx/De7m
=7wa/
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus