BugTraq
[ MDVSA-2011:102 ] rdesktop May 28 2011 03:33PM
security mandriva com
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2011:102
http://www.mandriva.com/security/
_______________________________________________________________________

Package : rdesktop
Date : May 28, 2011
Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A vulnerability has been identified and fixed in rdesktop:

Directory traversal vulnerability in the disk_create function in
disk.c in rdesktop before 1.7.0, when disk redirection is enabled,
allows remote RDP servers to read or overwrite arbitrary files via
a .. (dot dot) in a pathname (CVE-2011-1595).

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php\?cPath=149\&products_id=4
90

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1595
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2009.0:
918cfba3795494f163c9d6ee5729a500 2009.0/i586/rdesktop-1.6.0-4.1mdv2009.0.i586.rpm
4510e318899bc8e082c1d2425a669fd7 2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm

Mandriva Linux 2009.0/X86_64:
d2822a3d35f810b358303524f5b8b59e 2009.0/x86_64/rdesktop-1.6.0-4.1mdv2009.0.x86_64.rpm
4510e318899bc8e082c1d2425a669fd7 2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm

Mandriva Linux 2010.1:
4993b0be42653f8a24ea1b9e2cbfe02c 2010.1/i586/rdesktop-1.6.0-11.1mdv2010.2.i586.rpm
25e8f153a3cd642e9993cdabae897b62 2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm

Mandriva Linux 2010.1/X86_64:
c591e1214b1c5f92b7188b388c7cea16 2010.1/x86_64/rdesktop-1.6.0-11.1mdv2010.2.x86_64.rpm
25e8f153a3cd642e9993cdabae897b62 2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm

Corporate 4.0:
440e2625f77de1c862bf4babf1f6e8ba corporate/4.0/i586/rdesktop-1.4.1-1.2.20060mlcs4.i586.rpm
3771560586bffcfe6fa7a833127c5068 corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
301f64a655c16678069e43c7d999e6fa corporate/4.0/x86_64/rdesktop-1.4.1-1.2.20060mlcs4.x86_64.rpm
3771560586bffcfe6fa7a833127c5068 corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm

Mandriva Enterprise Server 5:
c2f395818fad39c475aadc8884ce664e mes5/i586/rdesktop-1.6.0-4.1mdvmes5.2.i586.rpm
85f0ac66db03e44f2bf03434786cda8e mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
bfdfb7a5e8818e6f7a250b849dc1f45e mes5/x86_64/rdesktop-1.6.0-4.1mdvmes5.2.x86_64.rpm
85f0ac66db03e44f2bf03434786cda8e mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFN4OWImqjQ0CJFipgRArj2AKDIaAayNWXXIbLGYPY9/n4zPYFc3gCgj9WT
5TEdWZTfsdYs7XBjHGSKfAk=
=Gffu
-----END PGP SIGNATURE-----

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus