Day: 5 Agosto 2010

USN-968-1: Dell Latitude 2110 vulnerability

Referenced CVEs: 
CVE-2010-0834

Description: 
===========================================================
Ubuntu Security Notice USN-968-1 August 05, 2010
base-files vulnerability
CVE-2010-0834
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 9.10:
base-files 5.0.0ubuntu7.1

Ubuntu 10.04 LTS:
base-files 5.0.0ubuntu20.10.04.2

In general, a standard system update will make all the necessary changes.

Details follow:

It was discovered that the Ubuntu image shipped on some Dell Latitude
2110 systems was accidentally configured to allow unauthenticated package
installations. A remote attacker intercepting network communications or
a malicious archive mirror server could exploit this to trick the user
into installing unsigned packages, resulting in arbitrary code execution
with root privileges.

Articoli Correlati

  • No Related Posts

USN-966-1: Linux kernel vulnerabilities

Referenced CVEs: 
CVE-2008-7256, CVE-2010-1173, CVE-2010-1436, CVE-2010-1437, CVE-2010-1451, CVE-2010-1636, CVE-2010-1641, CVE-2010-1643, CVE-2010-2071, CVE-2010-2492

Description: 
===========================================================
Ubuntu Security Notice USN-966-1 August 04, 2010
linux, linux-{source-2.6.15,ec2,mvl-dove,ti-omap} vulnerabilities
CVE-2008-7256, CVE-2010-1173, CVE-2010-1436, CVE-2010-1437,
CVE-2010-1451, CVE-2010-1636, CVE-2010-1641, CVE-2010-1643,
CVE-2010-2071, CVE-2010-2492
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 6.06 LTS
Ubuntu 8.04 LTS
Ubuntu 9.04
Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
linux-image-2.6.15-55-386 2.6.15-55.86
linux-image-2.6.15-55-686 2.6.15-55.86
linux-image-2.6.15-55-amd64-generic 2.6.15-55.86
linux-image-2.6.15-55-amd64-k8 2.6.15-55.86
linux-image-2.6.15-55-amd64-server 2.6.15-55.86
linux-image-2.6.15-55-amd64-xeon 2.6.15-55.86
linux-image-2.6.15-55-hppa32 2.6.15-55.86
linux-image-2.6.15-55-hppa32-smp 2.6.15-55.86
linux-image-2.6.15-55-hppa64 2.6.15-55.86
linux-image-2.6.15-55-hppa64-smp 2.6.15-55.86
linux-image-2.6.15-55-itanium 2.6.15-55.86
linux-image-2.6.15-55-itanium-smp 2.6.15-55.86
linux-image-2.6.15-55-k7 2.6.15-55.86
linux-image-2.6.15-55-mckinley 2.6.15-55.86
linux-image-2.6.15-55-mckinley-smp 2.6.15-55.86
linux-image-2.6.15-55-powerpc 2.6.15-55.86
linux-image-2.6.15-55-powerpc-smp 2.6.15-55.86
linux-image-2.6.15-55-powerpc64-smp 2.6.15-55.86
linux-image-2.6.15-55-server 2.6.15-55.86
linux-image-2.6.15-55-server-bigiron 2.6.15-55.86
linux-image-2.6.15-55-sparc64 2.6.15-55.86
linux-image-2.6.15-55-sparc64-smp 2.6.15-55.86

Ubuntu 8.04 LTS:
linux-image-2.6.24-28-386 2.6.24-28.73
linux-image-2.6.24-28-generic 2.6.24-28.73
linux-image-2.6.24-28-hppa32 2.6.24-28.73
linux-image-2.6.24-28-hppa64 2.6.24-28.73
linux-image-2.6.24-28-itanium 2.6.24-28.73
linux-image-2.6.24-28-lpia 2.6.24-28.73
linux-image-2.6.24-28-lpiacompat 2.6.24-28.73
linux-image-2.6.24-28-mckinley 2.6.24-28.73
linux-image-2.6.24-28-openvz 2.6.24-28.73
linux-image-2.6.24-28-powerpc 2.6.24-28.73
linux-image-2.6.24-28-powerpc-smp 2.6.24-28.73
linux-image-2.6.24-28-powerpc64-smp 2.6.24-28.73
linux-image-2.6.24-28-rt 2.6.24-28.73
linux-image-2.6.24-28-server 2.6.24-28.73
linux-image-2.6.24-28-sparc64 2.6.24-28.73
linux-image-2.6.24-28-sparc64-smp 2.6.24-28.73
linux-image-2.6.24-28-virtual 2.6.24-28.73
linux-image-2.6.24-28-xen 2.6.24-28.73

Ubuntu 9.04:
linux-image-2.6.28-19-generic 2.6.28-19.62
linux-image-2.6.28-19-imx51 2.6.28-19.62
linux-image-2.6.28-19-iop32x 2.6.28-19.62
linux-image-2.6.28-19-ixp4xx 2.6.28-19.62
linux-image-2.6.28-19-lpia 2.6.28-19.62
linux-image-2.6.28-19-server 2.6.28-19.62
linux-image-2.6.28-19-versatile 2.6.28-19.62
linux-image-2.6.28-19-virtual 2.6.28-19.62

Ubuntu 9.10:
linux-image-2.6.31-214-dove 2.6.31-214.29
linux-image-2.6.31-214-dove-z0 2.6.31-214.29
linux-image-2.6.31-22-386 2.6.31-22.61
linux-image-2.6.31-22-generic 2.6.31-22.61
linux-image-2.6.31-22-generic-pae 2.6.31-22.61
linux-image-2.6.31-22-ia64 2.6.31-22.61
linux-image-2.6.31-22-lpia 2.6.31-22.61
linux-image-2.6.31-22-powerpc 2.6.31-22.61
linux-image-2.6.31-22-powerpc-smp 2.6.31-22.61
linux-image-2.6.31-22-powerpc64-smp 2.6.31-22.61
linux-image-2.6.31-22-server 2.6.31-22.61
linux-image-2.6.31-22-sparc64 2.6.31-22.61
linux-image-2.6.31-22-sparc64-smp 2.6.31-22.61
linux-image-2.6.31-22-virtual 2.6.31-22.61
linux-image-2.6.31-307-ec2 2.6.31-307.16

Ubuntu 10.04 LTS:
linux-image-2.6.32-207-dove 2.6.32-207.21
linux-image-2.6.32-24-386 2.6.32-24.39
linux-image-2.6.32-24-generic 2.6.32-24.39
linux-image-2.6.32-24-generic-pae 2.6.32-24.39
linux-image-2.6.32-24-ia64 2.6.32-24.39
linux-image-2.6.32-24-lpia 2.6.32-24.39
linux-image-2.6.32-24-powerpc 2.6.32-24.39
linux-image-2.6.32-24-powerpc-smp 2.6.32-24.39
linux-image-2.6.32-24-powerpc64-smp 2.6.32-24.39
linux-image-2.6.32-24-preempt 2.6.32-24.39
linux-image-2.6.32-24-server 2.6.32-24.39
linux-image-2.6.32-24-sparc64 2.6.32-24.39
linux-image-2.6.32-24-sparc64-smp 2.6.32-24.39
linux-image-2.6.32-24-versatile 2.6.32-24.39
linux-image-2.6.32-24-virtual 2.6.32-24.39
linux-image-2.6.32-308-ec2 2.6.32-308.14
linux-image-2.6.33-502-omap 2.6.33-502.9

After a standard system update you need to reboot your computer to make
all the necessary changes.

Details follow:

Junjiro R. Okajima discovered that knfsd did not correctly handle
strict overcommit. A local attacker could exploit this to crash knfsd,
leading to a denial of service. (Only Ubuntu 6.06 LTS and 8.04 LTS were
affected.) (CVE-2008-7256, CVE-2010-1643)

Chris Guo, Jukka Taimisto, and Olli Jarva discovered that SCTP did
not correctly handle invalid parameters. A remote attacker could send
specially crafted traffic that could crash the system, leading to a
denial of service. (CVE-2010-1173)

Mario Mikocevic discovered that GFS2 did not correctly handle certain
quota structures. A local attacker could exploit this to crash the
system, leading to a denial of service. (Ubuntu 6.06 LTS was not
affected.) (CVE-2010-1436)

Toshiyuki Okajima discovered that the kernel keyring did not correctly
handle dead keyrings. A local attacker could exploit this to crash the
system, leading to a denial of service. (CVE-2010-1437)

Brad Spengler discovered that Sparc did not correctly implement
non-executable stacks. This made userspace applications vulnerable to
exploits that would have been otherwise blocked due to non-executable
memory protections. (Ubuntu 10.04 LTS was not affected.) (CVE-2010-1451)

Dan Rosenberg discovered that the btrfs clone function did not correctly
validate permissions. A local attacker could exploit this to read
sensitive information, leading to a loss of privacy. (Only Ubuntu 9.10
was affected.) (CVE-2010-1636)

Dan Rosenberg discovered that GFS2 set_flags function did not correctly
validate permissions. A local attacker could exploit this to gain
access to files, leading to a loss of privacy and potential privilege
escalation. (Ubuntu 6.06 LTS was not affected.) (CVE-2010-1641)

Shi Weihua discovered that btrfs xattr_set_acl function did not
correctly validate permissions. A local attacker could exploit
this to gain access to files, leading to a loss of privacy and
potential privilege escalation. (Only Ubuntu 9.10 and 10.04 LTS were
affected.) (CVE-2010-2071)

Andre Osterhues discovered that eCryptfs did not correctly calculate
hash values. A local attacker with certain uids could exploit this to
crash the system or potentially gain root privileges. (Ubuntu 6.06 LTS
was not affected.) (CVE-2010-2492)

Articoli Correlati

  • No Related Posts

USN-964-2: Likewise Open regression

Description: 
===========================================================
Ubuntu Security Notice USN-964-2 July 29, 2010
likewise-open regression
https://launchpad.net/bugs/610300
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 10.04 LTS:
likewise-open 5.4.0.42111-2ubuntu1.2

In general, a standard system update will make all the necessary changes.

Details follow:

USN-964-1 fixed vulnerabilities in Likewise Open. The upstream fixes
were incomplete, which caused problems running certain services. This
update fixes the problem.

We apologize for the inconvenience.

Original advisory details:

Matt Weatherford discovered that Likewise Open did not correctly check
password expiration for the local-provider account. A local attacker could
exploit this to log into a system they would otherwise not have access to.

Articoli Correlati

  • No Related Posts

Firma digitale: dal 3 settembre 2010 in vigore nuove regole tecniche

Il 3 settembre p.v. entrano in vigore le modifiche alla firma digitale approvate con deliberazione n. 45/2009 dal Centro Nazionale per l’Informatica nella Pubblica Amministrazione (CNIPA) (pubblicata in Gazzetta Ufficiale lo scorso 3 dicembre).

Le nuove regole tecniche, che han modificato i formati delle firme digitali, sono supportate da tutte le Smart Card e dalle Business Key distribuite, tranne che dalle smart card con numero di serie che inizia con 1202… (il numero di serie è riportato sulla carta).

I possessori di tali carte possono richiedere il rilascio di un nuovo dispositivo (Business Key) allo sportello Servizi Telematici della Camera di Commercio di Venezia (sede di Mestre, Via Forte Marghera, 151 – tel. 041.2576612 – email: infosmartcard@ve.camcom.it – orario di sportello: dal lunedì al venerdì, dalle 8,45 alle 12,30).

È in corso da parte di Infocert S.p.A.l’invio di un’apposita comunicazione sull’argomento a tutti i titolari delle tessere in questione.

Da tale data devono essere sostituiti i programmi di firma dei documenti per poter apporre le nuove firme e verificare tutti i documenti firmati. Nel dettaglio la deliberazione prevede l’utilizzo di nuovi algoritmi matematici e nuovi formati dei dati per innalzare ulteriormente il livello di sicurezza, mantenendo inalterato il valore legale delle firme. Il nuovo software sarà disponibile dal 3 settembre 2010. Comunque in fase di aggiornamento dei vecchi programmi verrà richiesto di effettuare l’adeguamento alla nuova versione.
Per ulteriori approfondimenti su come richiedere la Business Key e sui costi relativi consulta la sezione del sito camerale http://www.ve.camcom.it/registro_imp/pagina.phtml?pagina=business_key&explode=40.3.1.

Articoli Correlati