USN-184-1: umount vulnerability

Posted by Bob on: 09/19/2005 05:22 AM [ Print | 0 comment(s) ]

A new umount vulnerability update is available for Ubuntu Linux. Here the announcement:

Ubuntu Security Notice USN-184-1 September 19, 2005
util-linux vulnerability
CAN-2005-2876
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)

The following packages are affected:

mount

The problem can be corrected by upgrading the affected package to
version 2.12-7ubuntu6.1 (for Ubuntu 4.10), or 2.12p-2ubuntu2.2 (for
Ubuntu 5.04). In general, a standard system upgrade is sufficient to
effect the necessary changes.

Details follow:

David Watson discovered that "umount -r" removed some restrictive
mount options like the "nosuid" flag. If /etc/fstab contains
user-mountable removable devices which specify the "nosuid" flag
(which is common practice for such devices), a local attacker could
exploit this to execute arbitrary programs with root privileges by
calling "umount -r" on a removable device.

This does not affect the default Ubuntu configuration. Since Ubuntu
mounts removable devices automatically, there is normally no need to
configure them manually in /etc/fstab.

Updated packages for Ubuntu 4.10 (Warty Warthog):

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1.diff.gz
Size/MD5: 109678 0f53c5d6208be9e3cff6aeddc8c425a0
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1.dsc
Size/MD5: 684 9eeee328200d97c7061c26f6282a8546
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12.orig.tar.gz
Size/MD5: 1857871 997adf78b98d9d1c5db4f37ea982acff

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux-locales_2.12-7ubuntu6.1_all.deb
Size/MD5: 1003200 ed3311f9aa0a7e56c23577d047c319fd

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 64334 6882395e415054b701c2e70bdb67ee0e
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_amd64.udeb
Size/MD5: 482704 f9a48c8a7375e9f8074c065aabdd6838
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 141548 9eb9d95d01f993f448ad7ca939c111f4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_amd64.deb
Size/MD5: 397282 ff8ef6b3bbd984d6dede6354541aaff7

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_i386.deb
Size/MD5: 62742 f704e179423d77e77af3d00870fe8167
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_i386.udeb
Size/MD5: 474138 a8ca30bfa696161380b877670c4d9419
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_i386.deb
Size/MD5: 135724 00e352bc778a4dda0f03501c96f747ab
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_i386.deb
Size/MD5: 373882 a66f10929e0ccd92428499e2406e6b50

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 63050 197f4dcd622e12c1e603a189dcb411d3
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12-7ubuntu6.1_powerpc.udeb
Size/MD5: 487592 196015505a5781c9000686b0e3692d1f
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 137564 6844adb2e3b7e2688579d08db55a3bb0
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12-7ubuntu6.1_powerpc.deb
Size/MD5: 399388 35f96a97db999cced0307bd0acb6897f

Updated packages for Ubuntu 5.04 (Hoary Hedgehog):

Source archives:

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.1.dsc
Size/MD5: 718 87d4453343f20f472d6c22f57f8f0024
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2.diff.gz
Size/MD5: 74592 09a577be3acfe5951136f6bcb969106b
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2.dsc
Size/MD5: 718 d3964d818741de394f6758e9b344d176
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p.orig.tar.gz
Size/MD5: 2001658 d47e820f6880c21c8b4c0c7e8a7376cc

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux-locales_2.12p-2ubuntu2.2_all.deb
Size/MD5: 1071916 dc0eceabc84f3d65ce6360fbeb557d2c

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 67510 587db10c31483770140574c96b088bb4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_amd64.udeb
Size/MD5: 550626 9ae6cb429953fc0540c854abaf2e6651
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 146380 a46a1901f8c9ec9bf9aa677f27bbc79c
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_amd64.deb
Size/MD5: 401386 5ba3eb993cb8ea376d9570405c57730d

i386 architecture (x86 compatible Intel/AMD)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 65744 e377676d6d4a1d7442b7eb4c79356dd4
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_i386.udeb
Size/MD5: 541066 7045bd2f3ebdec339c4f4fc8d68bc9be
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 140696 c5156a184a4d9fc45a80a3688ef10d89
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_i386.deb
Size/MD5: 377960 ed0dd2a6803e2163aad3d13b15ca46e4

powerpc architecture (Apple Macintosh G3/G4/G5)

http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/bsdutils_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 66254 75c8f28f2d50a2f27bcaf2808d7ae4f7
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/fdisk-udeb_2.12p-2ubuntu2.2_powerpc.udeb
Size/MD5: 556402 e4a18ea0ff5552fa8c341e077cf87bdc
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/mount_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 147474 d03bf255994b756f8a80485ee28a3460
http://security.ubuntu.com/ubuntu/pool/main/u/util-linux/util-linux_2.12p-2ubuntu2.2_powerpc.deb
Size/MD5: 406646 92f63f8884ae854e9f6f7c2f0d9df731

--mP3DRpeJDSE+ciuQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDLp2nDecnbV4Fd/IRAmDBAKC1IfJX6Voq/DabB+5UFj5a34ekrQCfS0F7
OyrR+rEH496KA/95B0bOX7s=
=kyn4
-----END PGP SIGNATURE-----