USN-184-1: umount vulnerability
Posted on: 09/19/2005 05:22 AM

A new umount vulnerability update is available for Ubuntu Linux. Here the announcement:

Ubuntu Security Notice USN-184-1 September 19, 2005
util-linux vulnerability

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:


The problem can be corrected by upgrading the affected package to
version 2.12-7ubuntu6.1 (for Ubuntu 4.10), or 2.12p-2ubuntu2.2 (for
Ubuntu 5.04). In general, a standard system upgrade is sufficient to
effect the necessary changes.

Details follow:

David Watson discovered that "umount -r" removed some restrictive
mount options like the "nosuid" flag. If /etc/fstab contains
user-mountable removable devices which specify the "nosuid" flag
(which is common practice for such devices), a local attacker could
exploit this to execute arbitrary programs with root privileges by
calling "umount -r" on a removable device.

This does not affect the default Ubuntu configuration. Since Ubuntu
mounts removable devices automatically, there is normally no need to
configure them manually in /etc/fstab.

Updated packages for Ubuntu 4.10 (Warty Warthog):

Source archives:
Size/MD5: 109678 0f53c5d6208be9e3cff6aeddc8c425a0
Size/MD5: 684 9eeee328200d97c7061c26f6282a8546
Size/MD5: 1857871 997adf78b98d9d1c5db4f37ea982acff

Architecture independent packages:
Size/MD5: 1003200 ed3311f9aa0a7e56c23577d047c319fd

amd64 architecture (Athlon64, Opteron, EM64T Xeon)
Size/MD5: 64334 6882395e415054b701c2e70bdb67ee0e
Size/MD5: 482704 f9a48c8a7375e9f8074c065aabdd6838
Size/MD5: 141548 9eb9d95d01f993f448ad7ca939c111f4
Size/MD5: 397282 ff8ef6b3bbd984d6dede6354541aaff7

i386 architecture (x86 compatible Intel/AMD)
Size/MD5: 62742 f704e179423d77e77af3d00870fe8167
Size/MD5: 474138 a8ca30bfa696161380b877670c4d9419
Size/MD5: 135724 00e352bc778a4dda0f03501c96f747ab
Size/MD5: 373882 a66f10929e0ccd92428499e2406e6b50

powerpc architecture (Apple Macintosh G3/G4/G5)
Size/MD5: 63050 197f4dcd622e12c1e603a189dcb411d3
Size/MD5: 487592 196015505a5781c9000686b0e3692d1f
Size/MD5: 137564 6844adb2e3b7e2688579d08db55a3bb0
Size/MD5: 399388 35f96a97db999cced0307bd0acb6897f

Updated packages for Ubuntu 5.04 (Hoary Hedgehog):

Source archives:
Size/MD5: 718 87d4453343f20f472d6c22f57f8f0024
Size/MD5: 74592 09a577be3acfe5951136f6bcb969106b
Size/MD5: 718 d3964d818741de394f6758e9b344d176
Size/MD5: 2001658 d47e820f6880c21c8b4c0c7e8a7376cc

Architecture independent packages:
Size/MD5: 1071916 dc0eceabc84f3d65ce6360fbeb557d2c

amd64 architecture (Athlon64, Opteron, EM64T Xeon)
Size/MD5: 67510 587db10c31483770140574c96b088bb4
Size/MD5: 550626 9ae6cb429953fc0540c854abaf2e6651
Size/MD5: 146380 a46a1901f8c9ec9bf9aa677f27bbc79c
Size/MD5: 401386 5ba3eb993cb8ea376d9570405c57730d

i386 architecture (x86 compatible Intel/AMD)
Size/MD5: 65744 e377676d6d4a1d7442b7eb4c79356dd4
Size/MD5: 541066 7045bd2f3ebdec339c4f4fc8d68bc9be
Size/MD5: 140696 c5156a184a4d9fc45a80a3688ef10d89
Size/MD5: 377960 ed0dd2a6803e2163aad3d13b15ca46e4

powerpc architecture (Apple Macintosh G3/G4/G5)
Size/MD5: 66254 75c8f28f2d50a2f27bcaf2808d7ae4f7
Size/MD5: 556402 e4a18ea0ff5552fa8c341e077cf87bdc
Size/MD5: 147474 d03bf255994b756f8a80485ee28a3460
Size/MD5: 406646 92f63f8884ae854e9f6f7c2f0d9df731

Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

Version: GnuPG v1.4.1 (GNU/Linux)


Printed from Linux Compatible (