From martin.pitt@canonical.com Mon Apr 4 05:31:22 2005 From: Martin Pitt To: ubuntu-security-announce@lists.ubuntu.com Cc: full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com Date: Mon, 4 Apr 2005 11:25:00 +0200 Subject: [Full-disclosure] [USN-104-1] unshar vulnerability =========================================================== Ubuntu Security Notice USN-104-1 April 04, 2005 sharutils vulnerability https://bugzilla.ubuntu.com/show_bug.cgi?id=8459 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: sharutils The problem can be corrected by upgrading the affected package to version 1:4.2.1-10ubuntu0.2. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Joey Hess discovered that "unshar" created temporary files in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Source archives: http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1-10ubuntu0.2.diff.gz Size/MD5: 8181 7135804300d9a381cfebc2133e7239c2 http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1-10ubuntu0.2.dsc Size/MD5: 634 1a16efd9010325d369909b608fb59597 http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1.orig.tar.gz Size/MD5: 306022 b8ba1d409f07edcb335ff72a27bd9828 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils-doc_4.2.1-10ubuntu0.2_all.deb Size/MD5: 28000 56cd083b2fbc3e689cb157a59c760f52 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1-10ubuntu0.2_amd64.deb Size/MD5: 113908 801afa19d2f272d22f7d13f5efb0a51a i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1-10ubuntu0.2_i386.deb Size/MD5: 110766 2d3e74efceff274a2bb4a17b3c4702b1 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/s/sharutils/sharutils_4.2.1-10ubuntu0.2_powerpc.deb Size/MD5: 112656 1ce41914dde0c8d548f6bcc2d3a8fbd8 [ Part 1.2, "Digital signature" Application/PGP-SIGNATURE ] [ 196bytes. ] [ Unable to print this part. ] [ Part 2: "Attached Text" ] _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/