WINDOWS CENTER: ubuntu-security-announce Digest, Vol 72, Issue 4

Send ubuntu-security-announce mailing list submissions to
ubuntu-security-announce@lists.ubuntu.com

To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com

You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."

Today's Topics:

1. [USN-985-1] mountall vulnerability (Kees Cook)
2. [USN-975-1] Firefox and Xulrunner vulnerabilities
(Jamie Strandboge)

----------------------------------------------------------------------

Message: 1
Date: Wed, 8 Sep 2010 13:28:03 -0700
From: Kees Cook <kees@ubuntu.com>
Subject: [USN-985-1] mountall vulnerability
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com
Message-ID: <20100908202803.GG2405@outflux.net>
Content-Type: text/plain; charset="us-ascii"

===========================================================
Ubuntu Security Notice USN-985-1 September 08, 2010
mountall vulnerability
CVE-2010-2961
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.04 LTS:
mountall 2.15.2

In general, a standard system update will make all the necessary changes.

Details follow:

Alasdair MacGregor discovered that mountall created a udev rule file
with world-writable permissions. A local attacker could exploit this
under certain conditions to cause udev to execute arbitrary commands as
the root user.

Updated packages for Ubuntu 10.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2.dsc
Size/MD5: 972 92e488f0e51ab3c20ddf537fdc92fd24
http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2.tar.gz
Size/MD5: 564582 036e6a108a9bc0c2155a7226ad5437c3

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2_amd64.deb
Size/MD5: 56016 76dc051afb8a20077f0c0b709369d6c0

i386 architecture (x86 compatible Intel/AMD):

http://security.ubuntu.com/ubuntu/pool/main/m/mountall/mountall_2.15.2_i386.deb
Size/MD5: 52384 42ebb3fa3f81ed1a08270d48a8f6b367

powerpc architecture (Apple Macintosh G3/G4/G5):

http://ports.ubuntu.com/pool/main/m/mountall/mountall_2.15.2_powerpc.deb
Size/MD5: 55780 cf51c1268b9b188150f9d2131882d8bb

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/m/mountall/mountall_2.15.2_sparc.deb
Size/MD5: 56758 276c85acaf4feaa54c53615f0a572b8b

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 236 bytes
Desc: Digital signature
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20100908/9346f794/attachment-0001.pgp

------------------------------

Message: 2
Date: Wed, 08 Sep 2010 16:54:46 -0500
From: Jamie Strandboge <jamie@canonical.com>
Subject: [USN-975-1] Firefox and Xulrunner vulnerabilities
To: ubuntu-security-announce
<ubuntu-security-announce@lists.ubuntu.com>
Cc: full-disclosure <full-disclosure@lists.grok.org.uk>,
bugtraq@securityfocus.com
Message-ID: <1283982886.4327.8.camel@luna>
Content-Type: text/plain; charset="utf-8"

===========================================================
Ubuntu Security Notice USN-975-1 September 08, 2010
firefox, firefox-3.0, firefox-3.5, xulrunner-1.9.1, xulrunner-1.9.2 vulnerabilities
CVE-2010-2760, CVE-2010-2762, CVE-2010-2764, CVE-2010-2765,
CVE-2010-2766, CVE-2010-2767, CVE-2010-2768, CVE-2010-2769,
CVE-2010-3166, CVE-2010-3167, CVE-2010-3168, CVE-2010-3169
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 9.04
Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
firefox-3.0 3.6.9+build1+nobinonly-0ubuntu0.8.04.1
xulrunner-1.9.2 1.9.2.9+build1+nobinonly-0ubuntu0.8.04.1

Ubuntu 9.04:
abrowser 3.6.9+build1+nobinonly-0ubuntu0.9.04.1
firefox-3.0 3.6.9+build1+nobinonly-0ubuntu0.9.04.1
xulrunner-1.9.2 1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1

Ubuntu 9.10:
firefox-3.5 3.6.9+build1+nobinonly-0ubuntu0.9.10.2
xulrunner-1.9.1 1.9.1.12+build1+nobinonly-0ubuntu0.9.10.2
xulrunner-1.9.2 1.9.2.9+build1+nobinonly-0ubuntu0.9.10.1

Ubuntu 10.04 LTS:
abrowser 3.6.9+build1+nobinonly-0ubuntu0.10.04.1
firefox 3.6.9+build1+nobinonly-0ubuntu0.10.04.1
xulrunner-1.9.2 1.9.2.9+build1+nobinonly-0ubuntu0.10.04.1

After a standard system update you need to restart Firefox and any
application that use Xulrunner to make all the necessary changes.

Details follow:

Several dangling pointer vulnerabilities were discovered in Firefox. An
attacker could exploit this to crash the browser or possibly run arbitrary
code as the user invoking the program. (CVE-2010-2760, CVE-2010-2767,
CVE-2010-3167)

Blake Kaplan and Michal Zalewski discovered several weaknesses in the
XPCSafeJSObjectWrapper (SJOW) security wrapper. If a user were tricked into
viewing a malicious site, a remote attacker could use this to run arbitrary
JavaScript with chrome privileges. (CVE-2010-2762)

Matt Haggard discovered that Firefox did not honor same-origin policy when
processing the statusText property of an XMLHttpRequest object. If a user
were tricked into viewing a malicious site, a remote attacker could use
this to gather information about servers on internal private networks.
(CVE-2010-2764)

Chris Rohlf discovered an integer overflow when Firefox processed the HTML
frameset element. If a user were tricked into viewing a malicious site, a
remote attacker could use this to crash the browser or possibly run
arbitrary code as the user invoking the program. (CVE-2010-2765)

Several issues were discovered in the browser engine. If a user were
tricked into viewing a malicious site, a remote attacker could use this to
crash the browser or possibly run arbitrary code as the user invoking the
program. (CVE-2010-2766, CVE-2010-3168)

David Huang and Collin Jackson discovered that the <object> tag could
override the charset of a framed HTML document in another origin. An
attacker could utilize this to perform cross-site scripting attacks.
(CVE-2010-2768)

Paul Stone discovered that with designMode enabled an HTML selection
containing JavaScript could be copied and pasted into a document and have
the JavaScript execute within the context of the site where the code was
dropped. An attacker could utilize this to perform cross-site scripting
attacks. (CVE-2010-2769)

A buffer overflow was discovered in Firefox when processing text runs. If a
user were tricked into viewing a malicious site, a remote attacker could
use this to crash the browser or possibly run arbitrary code as the user
invoking the program. (CVE-2010-3166)

Peter Van der Beken, Jason Oster, Jesse Ruderman, Igor Bukanov, Jeff
Walden, Gary Kwong and Olli Pettay discovered several flaws in the
browser engine. If a user were tricked into viewing a malicious site, a
remote attacker could use this to crash the browser or possibly run
arbitrary code as the user invoking the program. (CVE-2010-3169)

Updated packages for Ubuntu 8.04 LTS:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly-0ubuntu0.8.04.1.diff.gz
Size/MD5: 136421 ae68468fff3cac848d808c9b7303263b
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly-0ubuntu0.8.04.1.dsc
Size/MD5: 2506 9e176c50426816ffefdb9f925226c23f
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly.orig.tar.gz
Size/MD5: 49904535 41e66af8893a5dcb1b09c1d9040031b5
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.8.04.1.diff.gz
Size/MD5: 69004 4443b719fed3a8f873dc51c21dce2ec6
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.8.04.1.dsc
Size/MD5: 2577 08ed08eabdae7609d1455f39a5bb6d67
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly.orig.tar.gz
Size/MD5: 48976642 8e63abe4ba760ba85fa4bdc617ff70a1

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

Updated packages for Ubuntu 9.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly-0ubuntu0.9.04.1.diff.gz
Size/MD5: 147692 e0af32c5b622cefe3e455526336765e0
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly-0ubuntu0.9.04.1.dsc
Size/MD5: 2662 52c9c262755dd2553c2016522849b886
http://security.ubuntu.com/ubuntu/pool/main/f/firefox-3.0/firefox-3.0_3.6.9+build1+nobinonly.orig.tar.gz
Size/MD5: 49904535 41e66af8893a5dcb1b09c1d9040031b5
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1.diff.gz
Size/MD5: 69244 232a6f97ffb10c4ecee34720e89d2483
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1.dsc
Size/MD5: 2606 c572e11bcba4dec31d7e2e9532872848
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly.orig.tar.gz
Size/MD5: 48976642 8e63abe4ba760ba85fa4bdc617ff70a1

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2-dbg_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 59229110 31e96821506bc88d92605a0fbcb76981
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2-dev_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 4794394 ba1c32b1a60bee6ce9303daa4ce77bc5
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2-gnome-support_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 44028 df4a297db274512c289ee0c237cac179
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2-testsuite-dev_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 75612 ea5cd1fc771ae190f883a1d05f6d30ac
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 10208814 bb8cc171d4474295bd0ecc06077c1832
http://ports.ubuntu.com/pool/main/x/xulrunner-1.9.2/xulrunner-dev_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 29416 e5bf12d322804672f2c3da0a4887d096
http://ports.ubuntu.com/pool/universe/x/xulrunner-1.9.2/xulrunner-1.9.2-testsuite_1.9.2.9+build1+nobinonly-0ubuntu0.9.04.1_sparc.deb
Size/MD5: 7627616 ef28dbeb2e526f5413ec11a28d87e2ee

Updated packages for Ubuntu 9.10:

Source archives:

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

lpia architecture (Low Power Intel Architecture):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

Updated packages for Ubuntu 10.04:

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_3.6.9+build1+nobinonly-0ubuntu0.10.04.1.diff.gz
Size/MD5: 178674 4ce82561d05a7f0bde17f37dbdda4468
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_3.6.9+build1+nobinonly-0ubuntu0.10.04.1.dsc
Size/MD5: 2621 ab158da54be01991d712d7e6242df4f0
http://security.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_3.6.9+build1+nobinonly.orig.tar.gz
Size/MD5: 49904535 41e66af8893a5dcb1b09c1d9040031b5
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.10.04.1.diff.gz
Size/MD5: 61282 2400f17d442eb7e90ec9ace310695776
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly-0ubuntu0.10.04.1.dsc
Size/MD5: 2625 b98aaaed6dd8737779bd96ffde0c87e3
http://security.ubuntu.com/ubuntu/pool/main/x/xulrunner-1.9.2/xulrunner-1.9.2_1.9.2.9+build1+nobinonly.orig.tar.gz
Size/MD5: 48976642 8e63abe4ba760ba85fa4bdc617ff70a1

Architecture independent packages:

amd64 architecture (Athlon64, Opteron, EM64T Xeon):

i386 architecture (x86 compatible Intel/AMD):

powerpc architecture (Apple Macintosh G3/G4/G5):

sparc architecture (Sun SPARC/UltraSPARC):

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
Url : https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20100908/b3762b41/attachment.pgp

------------------------------

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

End of ubuntu-security-announce Digest, Vol 72, Issue 4
*******************************************************

News

Wednesday, September 08, 2010

ubuntu-security-announce Digest, Vol 72, Issue 4

No comments:

WINDOWS CENTER

Blog Archive