[Subject Prev][Subject Next][Thread Prev][Thread Next][Subject Index][Thread Index]

(fwd) [SECURITY] New version of mailx released



[Debian users, please upgrade.  This will also solve the suidperl
problem which I posted earlier if I read it right, though the
announcement doesn't explicitely state that -- Raju]

This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------

Approved-By: aleph1@xxxxxxxxxxxxxxxxx
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxxxxxxxx
Received: from securityfocus.com (mail.securityfocus.com [207.126.127.78]) by
          lists.securityfocus.com (Postfix) with SMTP id 3BCC71EE8E for
          <bugtraq@xxxxxxxxxxxxxxxxxxxxxxx>; Tue,  8 Aug 2000 23:14:11 -0700
          (PDT)
Received: (qmail 12148 invoked by alias); 9 Aug 2000 06:14:58 -0000
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxx
Received: (qmail 12145 invoked from network); 9 Aug 2000 06:14:58 -0000
Received: from murphy.debian.org (216.234.231.6) by mail.securityfocus.com with
          SMTP; 9 Aug 2000 06:14:58 -0000
Received: (qmail 14989 invoked by uid 38); 9 Aug 2000 06:11:41 -0000
X-Envelope-Sender: wichert@xxxxxxxxxx
Received: (qmail 14945 invoked from network); 9 Aug 2000 06:11:38 -0000
Received: from adsl-63-194-75-242.dsl.snfc21.pacbell.net (HELO
          fog.mors.wiggy.net) (@63.194.75.242) by murphy.debian.org with SMTP;
          9 Aug 2000 06:11:38 -0000
Received: (from wichert@localhost) by fog.mors.wiggy.net (8.11.0/8.11.0/Debian
          8.11.0-1) id e796ApZ09822 for
          debian-security-announce@xxxxxxxxxxxxxxxx; Tue, 8 Aug 2000 23:10:51
          -0700
X-Debian: PGP check passed for security officers
Priority: urgent
X-Mailing-List: <debian-security-announce@xxxxxxxxxxxxxxxx> archive/latest/109
X-Loop: debian-security-announce@xxxxxxxxxxxxxxxx
Precedence: list
Message-ID:  <pRJXuD.A.CqD.cYPk5@murphy>
Reply-To: security@xxxxxxxxxx
Comments:     Resent-From: debian-security-announce@xxxxxxxxxxxxxxxx
Comments:     Originally-From: Wichert Akkerman <wichert@xxxxxxxxxx>
From: debian-security-announce@xxxxxxxxxxxxxxxx
Sender: Bugtraq List <BUGTRAQ@xxxxxxxxxxxxxxxxx>
To: BUGTRAQ@xxxxxxxxxxxxxxxxx
Subject:      [SECURITY] New version of mailx released
Date:         Tue, 8 Aug 2000 23:14:11 -0700

-----BEGIN PGP SIGNED MESSAGE-----

- ------------------------------------------------------------------------
Debian Security Advisory                             security@xxxxxxxxxx
http://www.debian.org/security/                         Wichert Akkerman
August  8, 2000
- ------------------------------------------------------------------------


Package        : mailx
Problem type   : local exploit
Debian-specific: no

mailx is a often used by other programs to send email. Unfortunately
mailx as distributed in Debian GNU/Linux 2.1 has some features that
made it possible to execute system commands if a user can trick a
privileged program to send email using /usr/bin/mail.

This has been fixed in version 8.1.1-10.1.1slink.2 by no longer
allowing all configuration options to be set using the environment.

We recommend you upgrade your mailx package immediately.

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

Debian GNU/Linux 2.1 alias slink
- --------------------------------

  This version of Debian was released only for Intel, the Motorola
  680x0, the alpha and the Sun sparc architecture.

  Source archives:
    http://security.debian.org/dists/stable/updates/source/mailx_8.1.1-10.1.1slink.2.diff.gz
      MD5 checksum: edcd9210ef001cfde91252abd3547ab1
    http://security.debian.org/dists/stable/updates/source/mailx_8.1.1-10.1.1slink.2.dsc
      MD5 checksum: 508850b252b8f4797cfc38ce3e63ac57
    http://security.debian.org/dists/stable/updates/source/mailx_8.1.1.orig.tar.gz
      MD5 checksum: c779002cb043b57fd5198ec2032cacb0

  Alpha architecture:
    http://security.debian.org/dists/stable/updates/binary-alpha/mailx_8.1.1-10.1.1slink.2_alpha.deb
      MD5 checksum: 8a218e08fd337c260504ffce82954426

  Intel ia32 architecture:
    http://security.debian.org/dists/stable/updates/binary-i386/mailx_8.1.1-10.1.1slink.2_i386.deb
      MD5 checksum: 1eb602833806b8a7a3d30a2515eadf72

  Motorola 680x0 architecture:
    http://security.debian.org/dists/stable/updates/binary-m68k/mailx_8.1.1-10.1.1slink.2_m68k.deb
      MD5 checksum: b31f0ec28bd6a42108f1bb51e6795fed

  Sun Sparc architecture:
    http://security.debian.org/dists/stable/updates/binary-sparc/mailx_8.1.1-10.1.1slink.2_sparc.deb
      MD5 checksum: e6f6f193c85b45f9220fa9819326d6ac

  These files will be moved into
  ftp://ftp.debian.org/debian/dists/stable/*/binary-$arch/ soon.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Please note that woody has not been released yet. However since potato
  is very close to being release security updates are already being made
  available on security.debian.org.

  Potato will be release for alpha, arm, i386, m68k, powerpc and sparc.
  However at this moment fixes are not available for all architectures.
  Packages for architectures not mentioned here will be available
  shortly on security.debian.org .

  Source archives:
    http://security.debian.org/dists/potato/updates/main/source/mailx_8.1.1-10.1.3.diff.gz
      MD5 checksum: 95f3a7a1305c6c276471d02f33d0c837
    http://security.debian.org/dists/potato/updates/main/source/mailx_8.1.1-10.1.3.dsc
      MD5 checksum: fea46d4eb874052ff4b440fac3c0c976
    http://security.debian.org/dists/potato/updates/main/source/mailx_8.1.1.orig.tar.gz
      MD5 checksum: c779002cb043b57fd5198ec2032cacb0

  Alpha architecture:
    http://security.debian.org/dists/potato/updates/main/binary-alpha/mailx_8.1.1-10.1.3_alpha.deb
      MD5 checksum: d85e6f8ca7822c36d2947cc5f07c9d59

  ARM architecture:
    http://security.debian.org/dists/potato/updates/main/binary-arm/mailx_8.1.1-10.1.3_arm.deb
      MD5 checksum: 37bd5565a76a96391ca6cf3c2116d74b

  Intel ia32 architecture:
    http://security.debian.org/dists/potato/updates/main/binary-i386/mailx_8.1.1-10.1.3_i386.deb
      MD5 checksum: fefd4a769160b8a1ed25df4d62dc4a2b

  PowerPC architecture:
    http://security.debian.org/dists/potato/updates/main/binary-powerpc/mailx_8.1.1-10.1.3_powerpc.deb
      MD5 checksum: 990e9168c99dc1661011577c203a8d53

  Sun Sparc architecture:
    http://security.debian.org/dists/potato/updates/main/binary-sparc/mailx_8.1.1-10.1.3_sparc.deb
      MD5 checksum: 9ccb4cc89c5d9ec6e912034ff1584b90

For not yet released architectures please refer to the appropriate
directory ftp://ftp.debian.org/debian/dists/sid/binary-$arch/ .

- --
- ----------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable updates
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates
Mailing list: debian-security-announce@xxxxxxxxxxxxxxxx

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQB1AwUBOZD16ajZR/ntlUftAQEZawL/et1fP+gJeK00Thjk+j8EfjwMD0nHXlEY
dEJKvFPhLSFXjzNR6ikhTi4vp81mhzJ9r14lzlRtaFS5O3t7R/BDN7QHqoIec+hh
gMeAuuPd1HJ+7diSZmyOeahbkG9oiRXJ
=/5IH
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to debian-security-announce-request@xxxxxxxxxxxxxxxx
with a subject of "unsubscribe". Trouble? Contact listmaster@xxxxxxxxxxxxxxxx

------------------------------

End of this Digest
******************