Otklonjena je ranjivost programskog paketa ecryptfs-utils. Ecryptfs je sustav za kriptografsku zaštitu datoteka, dio Linux jezgre od inačice 2.6.19. Ranjivost se nalazila unutar naredbe mount.ecrpytfs_private koja zajedno s pozivom funkcije set setreuid() nije postavljala vrijednost "effective group id" parametra. Zbog toga se kao vlasnik /etc/mtab pogrešno postavljao korisnik koji je pokrenuo mount.ecrpytfs_private. Preporučuje se nadogradnja paketa.
Izvorni tekst preporuke
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-11979
2011-09-02 04:46:01
--------------------------------------------------------------------------------
Name : ecryptfs-utils
Product : Fedora 14
Version : 90
Release : 2.fc14
URL : https://launchpad.net/ecryptfs
Summary : The eCryptfs mount helper and support libraries
Description :
eCryptfs is a stacked cryptographic filesystem that ships in Linux
kernel versions 2.6.19 and above. This package provides the mount
helper and supporting libraries to perform key management and mount
functions.
Install ecryptfs-utils if you would like to mount eCryptfs.
--------------------------------------------------------------------------------
Update Information:
- fix incorrect mtab group ownership
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 31 2011 Michal Hlavinka - 90-2
- set the group id in mount.ecryptfs_private (CVE-2011-3145)
* Thu Aug 11 2011 Michal Hlavinka - 90-1
- security fixes:
- privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832)
- race condition when checking source during mount (CVE-2011-1833)
- mtab corruption via improper handling (CVE-2011-1834)
- key poisoning via insecure temp directory handling (CVE-2011-1835)
- information disclosure via recovery mount in /tmp (CVE-2011-1836)
- arbitrary file overwrite via lock counter race (CVE-2011-1837)
* Tue Aug 9 2011 Michal Hlavinka - 87-8
- improve logging messages of ecryptfs pam module
- keep own copy of passphrase, pam clears it too early
* Wed Aug 3 2011 Michal Hlavinka - 87-7
- keyring from auth stack does not survive, use pam_data and delayed
keyring initialization
* Thu Jul 21 2011 Michal Hlavinka - 87-6
- fix pam module to set ecryptfs gid before mount helper execution
- do not use zombie process, it causes lock ups in ssh
* Tue Jul 19 2011 Michal Hlavinka - 87-5
- do not use memcpy for overlaping areas
- fix broken pam module resulting in session with wrong gid
* Thu Jun 9 2011 Michal Hlavinka - 87-4
- check for ecryptfs pam module before home dir migration
* Tue Jun 7 2011 Michal Hlavinka - 87-3
- update of mtab does not work if it's a symlink (#706911)
* Thu May 26 2011 Michal Hlavinka - 87-2
- auto-load ecryptfs module in ecryptfs-setup-private
* Tue May 24 2011 Michal Hlavinka - 87-1
- updated to v. 87
* Wed Mar 2 2011 Michal Hlavinka - 86-2
- fix selinux context
* Fri Feb 25 2011 Michal Hlavinka - 86-1
- updated to v. 86
* Tue Feb 1 2011 Michal Hlavinka - 85-1
- ecryptfs-utils updated to 85
* Tue Jan 11 2011 Dan Horák - 84-3
- fix build on arches where char is unsigned by default
* Tue Jan 4 2011 Michal Hlavinka - 84-2
- fix unsigned < 0 test (#664474)
* Mon Dec 20 2010 Michal Hlavinka - 84-1
- ecryptfs-utils updated to 84
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #732607 - CVE-2011-3145 ecryptfs-utils: incorrect mtab group ownership
https://bugzilla.redhat.com/show_bug.cgi?id=732607
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update ecryptfs-utils' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-11936
2011-09-02 04:44:03
--------------------------------------------------------------------------------
Name : ecryptfs-utils
Product : Fedora 15
Version : 90
Release : 2.fc15
URL : https://launchpad.net/ecryptfs
Summary : The eCryptfs mount helper and support libraries
Description :
eCryptfs is a stacked cryptographic filesystem that ships in Linux
kernel versions 2.6.19 and above. This package provides the mount
helper and supporting libraries to perform key management and mount
functions.
Install ecryptfs-utils if you would like to mount eCryptfs.
--------------------------------------------------------------------------------
Update Information:
- fix incorrect mtab group ownership
--------------------------------------------------------------------------------
ChangeLog:
* Wed Aug 31 2011 Michal Hlavinka - 90-2
- set the group id in mount.ecryptfs_private (CVE-2011-3145)
* Thu Aug 11 2011 Michal Hlavinka - 90-1
- security fixes:
- privilege escalation via mountpoint race conditions (CVE-2011-1831, CVE-2011-1832)
- race condition when checking source during mount (CVE-2011-1833)
- mtab corruption via improper handling (CVE-2011-1834)
- key poisoning via insecure temp directory handling (CVE-2011-1835)
- information disclosure via recovery mount in /tmp (CVE-2011-1836)
- arbitrary file overwrite via lock counter race (CVE-2011-1837)
* Tue Aug 9 2011 Michal Hlavinka - 87-9
- improve logging messages of ecryptfs pam module
- keep own copy of passphrase, pam clears it too early
* Wed Aug 3 2011 Michal Hlavinka - 87-8
- keyring from auth stack does not survive, use pam_data and delayed
keyring initialization
* Thu Jul 21 2011 Michal Hlavinka - 87-7
- fix pam module to set ecryptfs gid before mount helper execution
- do not use zombie process, it causes lock ups in ssh
* Mon Jul 11 2011 Michal Hlavinka - 87-6
- do not use memcpy for overlaping areas
- fix broken pam module resulting in session with wrong gid
* Mon Jul 11 2011 Michal Hlavinka - 87-5
- fix mtab handling everywhere
* Thu Jun 9 2011 Michal Hlavinka - 87-4
- check for ecryptfs pam module before home dir migration
* Tue Jun 7 2011 Michal Hlavinka - 87-3
- update of mtab does not work if it's a symlink (#706911)
* Thu May 26 2011 Michal Hlavinka - 87-2
- auto-load ecryptfs module in ecryptfs-setup-private
* Tue May 24 2011 Michal Hlavinka - 87-1
- updated tp v. 87
* Fri Mar 11 2011 Michal Hlavinka - 86-3
- fix man pages
* Wed Mar 2 2011 Michal Hlavinka - 86-2
- fix selinux context
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #732607 - CVE-2011-3145 ecryptfs-utils: incorrect mtab group ownership
https://bugzilla.redhat.com/show_bug.cgi?id=732607
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update ecryptfs-utils' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke