Säkerhetsbulletin från Debian

DSA-1177-1 usermin -- programmeringsfel

Rapporterat den:

2006-09-15

Berörda paket:

usermin

Sårbara:

Referenser i säkerhetsdatabaser:

I Debians felrapporteringssystem: Fel 374609.
I Mitres CVE-förteckning: CVE-2006-4246.

Ytterligare information:

Hendrik Weimer upptäckte att det var möjligt för en normal användare att inaktivera inloggningsskalet för rootkontot via usermin, ett webbaserat administreringsverktyg.

För den stabila utgåvan (Sarge) har detta problem rättats i version 1.110-3.1.

I uppströmsdistributionen rättas detta problem i version 1.220.

Vi rekommenderar att ni uppgraderar ert usermin-paket.

Rättat i:

Debian GNU/Linux 3.1 (sarge)

Källkod:: http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.dsc; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1.diff.gz; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110.orig.tar.gz
Arkitekturoberoende komponent:: http://security.debian.org/pool/updates/main/u/usermin/usermin-at_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-changepass_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-chfn_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-commands_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-cron_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-cshrc_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-fetchmail_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-forward_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-gnupg_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-htaccess_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-htpasswd_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-mailbox_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-man_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-mysql_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-plan_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-postgresql_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-proc_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-procmail_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-quota_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-schedule_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-shell_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-spamassassin_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-ssh_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-tunnel_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-updown_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin-usermount_1.110-3.1_all.deb; http://security.debian.org/pool/updates/main/u/usermin/usermin_1.110-3.1_all.deb

MD5-kontrollsummor för dessa filer finns i originalbulletinen.