Debians sikkerhedsbulletin

DSA-172-1 tkmail -- usikre midlertidige filer

Rapporteret den:

8. okt 2002

Berørte pakker:

tkmail

Sårbar:

Referencer i sikkerhedsdatabaser:

I Mitres CVE-ordbog: CVE-2002-1193.

Yderligere oplysninger:

Man har opdaget at tkmail opretter midlertidige filer på en usikker måde. En angriber med lokal adgang kan udnytte dette til nemt at oprette og overskrive filer som en anden bruger.

Dette problem er rettet i version 4.0beta9-8.1 i den aktuelle stabile distribution (woody), i version 4.0beta9-4.1 i den gamle stabile distribution (potato) og version 4.0beta9-9 i den ustabile distribution (sid).

Vi anbefaler at du opgraderer dine tkmail-pakker.

Rettet i:

Debian GNU/Linux 2.2 (potato)

Kildekode:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1.dsc; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1.diff.gz; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_i386.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_m68k.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_powerpc.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-4.1_sparc.deb

Debian GNU/Linux 3.0 (woody)

Kildekode:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1.dsc; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1.diff.gz; http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9.orig.tar.gz
Alpha:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_alpha.deb
ARM:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_arm.deb
Intel IA-32:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_i386.deb
Intel IA-64:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_ia64.deb
HP Precision:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_hppa.deb
Motorola 680x0:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_m68k.deb
Big endian MIPS:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_mips.deb
Little endian MIPS:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_mipsel.deb
PowerPC:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_powerpc.deb
IBM S/390:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_s390.deb
Sun Sparc:: http://security.debian.org/pool/updates/main/t/tkmail/tkmail_4.0beta9-8.1_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.