Your message dated Mon, 11 Oct 2010 05:32:07 +0000
with message-id <e1p5azx-0000fk...@franck.debian.org>
and subject line Bug#598293: fixed in ike 2.1.5+dfsg-2
has caused the Debian Bug report #598293,
regarding ike-qtgui: CVE-2010-3361: insecure library loading
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
598293: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598293
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: ike-qtgui
Version: 2.1.5+dfsg-1
Severity: grave
Tags: security
User: t...@security.debian.org
Usertags: ldpath
Hello,
During a review of the Debian archive, I've found your package to
contain a script that can be abused by an attacker to execute arbitrary
code.
The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.
Vulnerable code follows:
/usr/bin/ikea line 4:
LD_LIBRARY_PATH=/usr/lib/ike:$LD_LIBRARY_PATH exec /usr/lib/ike/ikea.real "$@"
/usr/bin/ikec line 4:
LD_LIBRARY_PATH=/usr/lib/ike:$LD_LIBRARY_PATH exec /usr/lib/ike/ikec.real "$@"
When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.
This vulnerability has been assigned the CVE id CVE-2010-3361. Please make sure
you mention it when forwarding this report to upstream and when fixing
this bug (everywhere: upstream and here at Debian.)
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3361
[1] http://security-tracker.debian.org/tracker/CVE-2010-3361
Sincerely,
Raphael Geissert
--- End Message ---
--- Begin Message ---
Source: ike
Source-Version: 2.1.5+dfsg-2
We believe that the bug you reported is fixed in the latest version of
ike, which is due to be installed in the Debian FTP archive:
ike-qtgui_2.1.5+dfsg-2_amd64.deb
to main/i/ike/ike-qtgui_2.1.5+dfsg-2_amd64.deb
ike_2.1.5+dfsg-2.diff.gz
to main/i/ike/ike_2.1.5+dfsg-2.diff.gz
ike_2.1.5+dfsg-2.dsc
to main/i/ike/ike_2.1.5+dfsg-2.dsc
ike_2.1.5+dfsg-2_amd64.deb
to main/i/ike/ike_2.1.5+dfsg-2_amd64.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 598...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Philipp Matthias Hahn <pmh...@debian.org> (supplier of updated ike package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Fri, 08 Oct 2010 14:57:57 +0200
Source: ike
Binary: ike ike-qtgui
Architecture: source amd64
Version: 2.1.5+dfsg-2
Distribution: unstable
Urgency: medium
Maintainer: Philipp Matthias Hahn <pmh...@debian.org>
Changed-By: Philipp Matthias Hahn <pmh...@debian.org>
Description:
ike - Shrew Soft VPN client - Daemon and libraries
ike-qtgui - Shrew Soft VPN client - Connection manager
Closes: 598292 598293
Changes:
ike (2.1.5+dfsg-2) unstable; urgency=medium
.
* Fix "CVE-2010-3361: insecure library loading" caused by LD_LIBRARY_PATH=:
in debian/wrappers/iked (Closes: #598292)
* Fix "CVE-2010-3361: insecure library loading" caused by LD_LIBRARY_PATH=:
in debian/wrappers/ike[ac] (Closes: #598293)
Checksums-Sha1:
f17a3d67fb73119a091a4023d427855bb9f5125d 1084 ike_2.1.5+dfsg-2.dsc
9f46ba6664743bfe78eaeda721cf5c6710018bab 6770 ike_2.1.5+dfsg-2.diff.gz
22a9f39594e0d2156007566f55c0edd526087c51 232940 ike_2.1.5+dfsg-2_amd64.deb
81e63a5384d2798bf5dd2d0ffeac50dec4fcc20d 202316
ike-qtgui_2.1.5+dfsg-2_amd64.deb
Checksums-Sha256:
30bdf3e950da6c1608db615b919f78e5a9911a4fb8b02968067dc27904abd62f 1084
ike_2.1.5+dfsg-2.dsc
f115db912560ea9ded66d5509317afc76421920c39dae03559a087005ee1e822 6770
ike_2.1.5+dfsg-2.diff.gz
8a83801236e5c98056bbe048c963cd841d9d91fc635708518a1eb54a3d85375c 232940
ike_2.1.5+dfsg-2_amd64.deb
ffc16541bcf02d9f3f6b3dac81eccf60e0da629bcd40c5be9a40df4c2c66e40c 202316
ike-qtgui_2.1.5+dfsg-2_amd64.deb
Files:
b60d393f13f04ae29b5caa8636a6d323 1084 net extra ike_2.1.5+dfsg-2.dsc
8ba1516e08d7e77732413583dcab17e0 6770 net extra ike_2.1.5+dfsg-2.diff.gz
f51131e1e0d9ebb013621e97d01092ba 232940 net extra ike_2.1.5+dfsg-2_amd64.deb
c47344518dc8d5ff499452ed8be290b4 202316 net extra
ike-qtgui_2.1.5+dfsg-2_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
iEYEARECAAYFAkyyn8wACgkQYPlgoZpUDjmZcACfZB5JnLUl5GsaDVWMgheDwmsE
MPcAnjg2VbrwtOms3Rsyu0lamP31Ke9a
=Ktp0
-----END PGP SIGNATURE-----
--- End Message ---
