WINDOWS CENTER: ubuntu-security-announce Digest, Vol 53, Issue 5

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-723-1] Git vulnerabilities (Marc Deslauriers)

----------------------------------------------------------------------

Message: 1
Date: Wed, 18 Feb 2009 16:23:53 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
Subject: [USN-723-1] Git vulnerabilities
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <1234992233.15829.2.camel@mdlinux.technorage.com>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-723-1 February 18, 2009
git-core vulnerabilities
CVE-2008-3546, CVE-2008-5516, CVE-2008-5517, CVE-2008-5916
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
git-core 1.1.3-1ubuntu1.1

Ubuntu 7.10:
git-core 1:1.5.2.5-2ubuntu0.1
gitweb 1:1.5.2.5-2ubuntu0.1

Ubuntu 8.04 LTS:
git-core 1:1.5.4.3-1ubuntu2.1
gitweb 1:1.5.4.3-1ubuntu2.1

Ubuntu 8.10:
git-core 1:1.5.6.3-1.1ubuntu2.1
gitweb 1:1.5.6.3-1.1ubuntu2.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that Git did not properly handle long file paths. If a user
were tricked into performing commands on a specially crafted Git repository, an
attacker could possibly execute arbitrary code with the privileges of the user
invoking the program. (CVE-2008-3546)

It was discovered that the Git web interface (gitweb) did not correctly handle
shell metacharacters when processing certain commands. A remote attacker could
send specially crafted commands to the Git server and execute arbitrary code
with the privileges of the Git web server. This issue only applied to Ubuntu
7.10 and 8.04 LTS. (CVE-2008-5516, CVE-2008-5517)

It was discovered that the Git web interface (gitweb) did not properly restrict
the diff.external configuration parameter. A local attacker could exploit this
issue and execute arbitrary code with the privileges of the Git web server.
This issue only applied to Ubuntu 8.04 LTS and 8.10. (CVE-2008-5916)

Updated packages for Ubuntu 6.06 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1.diff.gz
Size/MD5: 8481 84fe19c380b31b7964b6c07a2500afee
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1.dsc
Size/MD5: 726 b23292f80d33ee016fcf97a4255dac6d
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3.orig.tar.gz
Size/MD5: 572735 4527e2a1afe3e30c0dc49455d9445dab

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-doc_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 274678 e523f354649e74138b2aec0842bda73e
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-email_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 10040 099cc4c8d98d641cb8832e1b7d767db2
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/gitk_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 34830 9467ee72ac93ef0f3417e76b9f7955e1
http://security.ubuntu.com/ubuntu/pool/universe/g/git-core/git-arch_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 18572 eacf41e5062a143d9d959c0e2a2d4846
http://security.ubuntu.com/ubuntu/pool/universe/g/git-core/git-cvs_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 17804 8bcbc71667cd93ee00b9b3034c419c43
http://security.ubuntu.com/ubuntu/pool/universe/g/git-core/git-svn_1.1.3-1ubuntu1.1_all.deb
Size/MD5: 14464 c90c396cdebda9315ec6c567c29da498

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1_amd64.deb
Size/MD5: 2175496 6d631f1b04de3816e1a2a2c2401dc527

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1_i386.deb
Size/MD5: 1783188 3dab34c13e1ccbc7e3168e55043bc185

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1_powerpc.deb
Size/MD5: 2160072 5d23dfdca43d79e68d3c85ca75c87e78

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.1.3-1ubuntu1.1_sparc.deb
Size/MD5: 1819706 78da61a35bb9ad71a29c84e30bcc311f

Updated packages for Ubuntu 7.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1.diff.gz
Size/MD5: 144952 d83b395b7bbd2cd749d9aa5d97a83bcd
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1.dsc
Size/MD5: 913 6da97e15925a75ff803168fea6b9b925
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5.orig.tar.gz
Size/MD5: 1413507 4e8de9e56882f3214a92f6d7dc3c49ec

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1_amd64.deb
Size/MD5: 3973872 de072e080943ef677305b88811e53276

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1_i386.deb
Size/MD5: 3629654 29acb5504bd85ebb88e87262166604b2

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1_lpia.deb
Size/MD5: 3645624 d14c3238f9dc2a384d962eac1b0b9449

powerpc architecture (Apple Macintosh G3/G4/G5):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1_powerpc.deb
Size/MD5: 4045000 068573efc26e0837b66022fc66bc0bf9

sparc architecture (Sun SPARC/UltraSPARC):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.2.5-2ubuntu0.1_sparc.deb
Size/MD5: 3579554 d1d7afe1b703db3e4cb2b488ae880580

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1.diff.gz
Size/MD5: 200842 b96d1522b48149c79d6a62a3de9d81d0
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1.dsc
Size/MD5: 981 9a433d45bfaff2ec9ae2a927d04e7261
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.4.3.orig.tar.gz
Size/MD5: 1899555 6311a711eb780b1fbae29e0fd28836bd

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1_amd64.deb
Size/MD5: 3354474 305781ff01c0c1f367f1a633702a77e7

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1_i386.deb
Size/MD5: 3080146 27f36ed5dec0e0f02021e3321f8263b0

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1_lpia.deb
Size/MD5: 3088974 5fd7ebb55e8e332e3e8c68d3b1f4e7e0

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1_powerpc.deb
Size/MD5: 3451558 22bf0faf3f9dc0c1c0750f4daa86b19e

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.4.3-1ubuntu2.1_sparc.deb
Size/MD5: 3049674 46582ea0b9edc250d6466670d76c8e35

Updated packages for Ubuntu 8.10:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1.diff.gz
Size/MD5: 229915 29811f5d42c322f4bde6c774994606c2
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1.dsc
Size/MD5: 1424 dc616d099eb6d2529d6753568e21f6e0
http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.6.3.orig.tar.gz
Size/MD5: 2098346 26989b6880744ab16f105edaca130777

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1_amd64.deb
Size/MD5: 3439688 5dc535f599b63db0b0e36fa9d08e3a3c

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1_i386.deb
Size/MD5: 3162042 b5e9615f4cd16835e9fa59bcc6516faf

lpia architecture (Low Power Intel Architecture):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1_lpia.deb
Size/MD5: 3145876 08219da3bab247ac30a2265af7e5a227

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1_powerpc.deb
Size/MD5: 3477660 5c4c917a1e88655ea95e73aa2067b53b

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/g/git-core/git-core_1.5.6.3-1.1ubuntu2.1_sparc.deb
Size/MD5: 3101712 97f7607c999059acf15a931da1d675cf

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20090218/e22e8c0e/attachment-0001.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 53, Issue 5
*******************************************************

News

Thursday, February 19, 2009

ubuntu-security-announce Digest, Vol 53, Issue 5

No comments:

WINDOWS CENTER

Blog Archive