ubuntu-security-announce@lists.ubuntu.com
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
or, via email, send a message with subject or body 'help' to
ubuntu-security-announce-request@lists.ubuntu.com
You can reach the person managing the list at
ubuntu-security-announce-owner@lists.ubuntu.com
When replying, please edit your Subject line so it is more specific
than "Re: Contents of ubuntu-security-announce digest..."
Today's Topics:
1. [USN-1419-1] Puppet vulnerabilities (Tyler Hicks)
2. Ubuntu 10.10 (Maverick Meerkat) end-of-life reached on April
10, 2012 (Kate Stewart)
----------------------------------------------------------------------
Message: 1
Date: Wed, 11 Apr 2012 01:08:29 -0500
From: Tyler Hicks <tyhicks@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Subject: [USN-1419-1] Puppet vulnerabilities
Message-ID: <20120411060828.GA6262@boyd>
Content-Type: text/plain; charset="us-ascii"
==========================================================================
Ubuntu Security Notice USN-1419-1
April 11, 2012
puppet vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in puppet.
Software Description:
- puppet: Centralized configuration management
Details:
It was discovered that Puppet used a predictable filename when downloading Mac
OS X package files. A local attacker could exploit this to overwrite arbitrary
files. (CVE-2012-1906)
It was discovered that Puppet incorrectly handled filebucket retrieval
requests. A local attacker could exploit this to read arbitrary files.
(CVE-2012-1986)
It was discovered that Puppet incorrectly handled filebucket store requests. A
local attacker could exploit this to perform a denial of service via resource
exhaustion. (CVE-2012-1987)
It was discovered that Puppet incorrectly handled filebucket requests. A local
attacker could exploit this to execute arbitrary code via a crafted file path.
(CVE-2012-1988)
It was discovered that Puppet used a predictable filename for the Telnet
connection log file. A local attacker could exploit this to overwrite arbitrary
files. This issue only affected Ubuntu 11.10. (CVE-2012-1989)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
puppet-common 2.7.1-1ubuntu3.6
Ubuntu 11.04:
puppet-common 2.6.4-2ubuntu2.9
Ubuntu 10.04 LTS:
puppet-common 0.25.4-2ubuntu6.7
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1419-1
CVE-2012-1906, CVE-2012-1986, CVE-2012-1987, CVE-2012-1988,
CVE-2012-1989
Package Information:
https://launchpad.net/ubuntu/+source/puppet/2.7.1-1ubuntu3.6
https://launchpad.net/ubuntu/+source/puppet/2.6.4-2ubuntu2.9
https://launchpad.net/ubuntu/+source/puppet/0.25.4-2ubuntu6.7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20120411/771d7b8e/attachment-0001.pgp>
------------------------------
Message: 2
Date: Tue, 10 Apr 2012 10:39:12 -0500
From: Kate Stewart <kate.stewart@ubuntu.com>
To: ubuntu-announce@lists.ubuntu.com,
ubuntu-security-announce@lists.ubuntu.com
Cc: ubuntu-release@lists.ubuntu.com
Subject: Ubuntu 10.10 (Maverick Meerkat) end-of-life reached on April
10, 2012
Message-ID: <1334072352.2182.1402.camel@veni>
Content-Type: text/plain; charset="UTF-8"
This note is just to confirm that the support period for Ubuntu 10.10
(Maverick Meerkat) formally ends on April 10, 2012 and Ubuntu Security Notices
no longer includes information or updated packages for Ubuntu 10.10.
The supported upgrade path from Ubuntu 10.10 is via Ubuntu 11.04
(Natty Narwhal). Instructions and caveats for the upgrade may be found at
https://help.ubuntu.com/community/NattyUpgrades. Note that upgrades
to version 11.04 and beyond are only supported in multiple steps, via
an upgrade first to 11.04, then to 11.10. Both Ubuntu 11.04 and Ubuntu 11.10
continue to be actively supported with security updates and select
high-impact bug fixes. All announcements of official security
updates for Ubuntu releases are sent to the ubuntu-security-announce
mailing list, information about which may be found at
https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce.
Since its launch in October 2004 Ubuntu has become one of the most
highly regarded Linux distributions with millions of users in homes,
schools, businesses and governments around the world. Ubuntu is Open
Source software, costs nothing to download, and users are free to
customize or alter their software in order to meet their needs.
Kate Stewart
Ubuntu Release Manager
------------------------------
--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
End of ubuntu-security-announce Digest, Vol 91, Issue 5
*******************************************************
No comments:
Post a Comment