ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. Ubuntu 10.10 (Maverick Meerkat) reachs end-of-life on April
10, 2012 (Kate Stewart)
2. [USN-1395-1] PyPAM vulnerability (Marc Deslauriers)
----------------------------------------------------------------------
Message: 1
Date: Thu, 08 Mar 2012 09:31:54 -0600
From: Kate Stewart <kate.stewart@ubuntu.com>
To: ubuntu-announce@lists.ubuntu.com,
ubuntu-security-announce@lists.ubuntu.com
Cc: ubuntu-release@lists.ubuntu.com
Subject: Ubuntu 10.10 (Maverick Meerkat) reachs end-of-life on April
10, 2012
Message-ID: <1331220714.18248.1032.camel@veni>
Content-Type: text/plain; charset="UTF-8"
Ubuntu announced its 10.10 (Maverick Meerkat) release almost 18 months
ago, on October 10, 2010 at 10:10:10 UTC. As with the earlier releases,
Ubuntu committed to ongoing security and critical fixes for a period
of 18 months. The support period is now nearing its end and Ubuntu 10.10
will reach end of life on Tuesday, April 10, 2012. At that time, Ubuntu
Security Notices will no longer include information or updated packages
for Ubuntu 10.10.
The supported upgrade path from Ubuntu 10.10 is via Ubuntu 11.04.
Instructions and caveats for the upgrade may be found at
https://help.ubuntu.com/community/NattyUpgrades. Ubuntu 11.04
continues to be actively supported with security updates and
select high-impact bug fixes. All announcements of official security
updates for Ubuntu releases are sent to the ubuntu-security-announce
mailing list, information about which may be found at
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce.
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customise or alter their software in order to meet their needs.
Kate Stewart
Ubuntu Release Manager
------------------------------
Message: 2
Date: Thu, 08 Mar 2012 13:33:44 -0500
From: Marc Deslauriers <marc.deslauriers@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1395-1] PyPAM vulnerability
Message-ID: <1331231624.2788.9.camel@mdlinux>
Content-Type: text/plain; charset="utf-8"
==========================================================================
Ubuntu Security Notice USN-1395-1
March 08, 2012
python-pam vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.10
- Ubuntu 10.04 LTS
Summary:
PyPAM could be made to crash or possibly run programs if it processed
a specially crafted password.
Software Description:
- python-pam: A Python interface to the PAM library
Details:
Markus Vervier discovered that PyPAM incorrectly handled passwords
containing NULL bytes. An attacker could exploit this to cause applications
using PyPAM to crash, or possibly execute arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
python-pam 0.4.2-12.2ubuntu2.11.10.1
Ubuntu 11.04:
python-pam 0.4.2-12.2ubuntu2.11.04.1
Ubuntu 10.10:
python-pam 0.4.2-12.1ubuntu1.10.10.1
Ubuntu 10.04 LTS:
python-pam 0.4.2-12.1ubuntu1.10.04.1
After a standard system update you need to restart applications that use
PyPAM to make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1395-1
CVE-2012-1502
Package Information:
https://launchpad.net/ubuntu/+source/python-pam/0.4.2-12.2ubuntu2.11.10.1
https://launchpad.net/ubuntu/+source/python-pam/0.4.2-12.2ubuntu2.11.04.1
https://launchpad.net/ubuntu/+source/python-pam/0.4.2-12.1ubuntu1.10.10.1
https://launchpad.net/ubuntu/+source/python-pam/0.4.2-12.1ubuntu1.10.04.1
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: This is a digitally signed message part
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20120308/8688dadd/attachment-0001.pgp>
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 90, Issue 7
*******************************************************
No comments:
Post a Comment