BugTraq
[USN-1099-1] GDM vulnerability Mar 30 2011 11:37PM
Steve Beattie (sbeattie ubuntu com)
===========================================================
Ubuntu Security Notice USN-1099-1 March 30, 2011
gdm vulnerability
CVE-2011-0727
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS
Ubuntu 10.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
gdm 2.28.1-0ubuntu2.3

Ubuntu 10.04 LTS:
gdm 2.30.2.is.2.30.0-0ubuntu5.1

Ubuntu 10.10:
gdm 2.30.5-0ubuntu4.1

After a standard system update you need to log out all desktop sessions
and restart GDM to make all the necessary changes.

Details follow:

Sebastian Krahmer discovered that GDM (GNOME Display Manager) did not
properly drop privileges when handling the cache directories used
to store users' dmrc and face icon files. This could allow a local
attacker to change the ownership of arbitrary files, thereby gaining
root privileges.

Updated packages for Ubuntu 9.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3.
diff.gz
Size/MD5: 769588 17bc09f417591f1913940d47cec9cc35
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3.
dsc
Size/MD5: 2168 09c46d7f6f577daa95f47643025ea67c
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1.orig.tar.gz

Size/MD5: 3661916 b8f101394aa73e4505bad4ed4f0a695c

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_
amd64.deb
Size/MD5: 731002 0e00de9426edb0a1dd9cd74d86251548

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_
i386.deb
Size/MD5: 672338 2e903d2e97356a7a7138f1da9c37c27a

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_armel.deb
Size/MD5: 662246 d6a5a00bc8e37ab1e8ab6faaec9efb42

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_lpia.deb
Size/MD5: 669764 79d09e696d5ff527e86a263944cdf7db

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_powerpc.de
b
Size/MD5: 697456 eff967e0f0206a299f68e93b76f48d13

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.28.1-0ubuntu2.3_sparc.deb
Size/MD5: 681890 23eec0f66ceb24635f86e3e4f3d06ade

Updated packages for Ubuntu 10.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0
ubuntu5.1.diff.gz
Size/MD5: 795064 e314a75da58ead79bd79cac83730c057
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0
ubuntu5.1.dsc
Size/MD5: 2223 ea497892c7cc53f86ea3769c78e75962
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0.o
rig.tar.gz
Size/MD5: 3725698 583f6e50936f085be268e8543905fb74

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0
ubuntu5.1_amd64.deb
Size/MD5: 798524 1e7b5dee40db568fcafa7d5f8c085c65

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0
ubuntu5.1_i386.deb
Size/MD5: 734446 1de50ebe2d1a869a3cc2a4ffb7136de9

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_
armel.deb
Size/MD5: 725942 f443a1c4098e116c293ebd9bc153f661

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_
powerpc.deb
Size/MD5: 760048 30592a26d7d20bc8b70d24543baf6182

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.2.is.2.30.0-0ubuntu5.1_
sparc.deb
Size/MD5: 753996 be562ec975b051a5e6909b394fc5cbc7

Updated packages for Ubuntu 10.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1.
debian.tar.gz
Size/MD5: 112891 a3aee3567a60f658b826668807c4dc6e
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1.
dsc
Size/MD5: 2187 07a449c1f9b1b1b393b92608f019cfd8
http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5.orig.tar.gz

Size/MD5: 3784180 9d200a16d6bbab0ac41b93b9dbe6d508

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_
amd64.deb
Size/MD5: 808788 c88e512ff6c1d9b0afe2553bca3aaa0c

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_
i386.deb
Size/MD5: 741206 578f4738cc323ba2d636ad13ce9d328a

armel architecture (ARM Architecture):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_armel.deb
Size/MD5: 741478 b5b04d07aaa136f2412f38d4e71e2d81

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/gdm/gdm_2.30.5-0ubuntu4.1_powerpc.de
b
Size/MD5: 768424 e7227f70358590f88e12e801e10b85cb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIcBAEBCgAGBQJNk76oAAoJEC8Jno0AXoH0xesP/RuI/WINUgZB/SDr/ksd3ZWr
42S8Sfxv5fm2orbxOyBJIpA2nPKvVew8wmccD5b3HlcPhJ9ie/bTKObxx61anF5H
s6IaE6zSRFIHhk45yvaDHxJ3fACTVpXjT1n5eki2mnnGWU2xGL9xWrjP/7O5GjxR
9TUsUuOqQaFKCnw24yE5DKYQp5RGFhV3ADBS4Rlivu7blKFJIqi/2JWRXp72ihsJ
DOIdlXrHygeL5TaLfoTg1zqsBluvoobo5Ytmn7hlM8Gc5ogJixxN3C7FVs1sX0mU
3nHbUnahEslX+pTnXrELw36ZNbsLT3LVIgRrSJEohIpv7AueCM0MSw54QUrIwvtz
i7NeADqACVVx/an/NsPkS0VCindohp02nj+qjYarGsc/E+7+LHoTy1W2IfTHO/El
3hLjrRBuUuvzqdWNPX8ZH0ZP9REexJUf9sC+64S5DdxxiD2BLkk7yhzw2iwqJ/p0
6MIPgh6X6v/B4oSIubjt1GoVxfEpxOvksgluhpW/KzYezGcg3V0mn63aLCQt/tt5
KCKOBPSIlUKys5aFjGZ1/99t7PV5nFuxVJyVXkGcyijLGfz1x/UKYZs/9xNZjYv5
N5mgTdXl65GkOTJOHLiu1dzjxKWAH6k8Uu0BaSMP6BXr30gU38ix+l8pGv/Siuaa
IVSH+4Jc8mjyk7tWKUk5
=O+vR
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus