2008年2月22日

[debian-users:50194] [Translate] [SECURITY] [DSA 1501-1] New dspam packages fix informationdisclosure

かねこです。
URL 等は Debian-security-announce メーリングリストの元記事を確認
ください。

------>8------------>8------------>8------------>8------------>8-
- ------------------------------------------------------------------------
Debian Security Advisory DSA-1501-1 security@xxxxx
http://www.debian.org/security/ Thijs Kinkhorst

February 21, 2008 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : dspam
Vulnerability : プログラムミス
Problem type : ローカル
Debian-specific: はい
CVE Id(s) : CVE-2007-6418
Debian Bug : 448519

Tobias Gruetzmacher さんにより、統計的スパムフィルタ dsapm で Debian パ
ッケージ時に追加された CRON スクリプトに MySQL バックエンドを使う場合の
データベースパスワードが記載されていることが発見されました。この欠陥がロ
ーカルユーザから攻撃可能で、email などのdspam データベースの内容を読み出
すことが可能です。

安定版 (stable) ディストリビューション (etch) では、この問題はバージョン
3.6.8-5etch1 で修正されています。mipsel アーキテクチャ向けのパッケージは
近く提供予定です。

旧安定版 (sarge) には dspam パッケージは収録されていません。

不安定版 (unstable) ディストリビューション (sid) では、この問題はバージョ
ン 3.6.8-5.1 で修正されています。

直ぐに dspam パッケージをアップグレードすることを勧めます。


アップグレード手順
------------------

wget url
でファイルを取得できます。
dpkg -i file.deb
で参照されたファイルをインストールできます。

apt-get パッケージマネージャを用いている場合には、本メールのフッタ記載の
行を sources.list に加えて、

apt-get update
を実行して内部データベースを更新し、
apt-get upgrade
によって修正されたパッケージをインストールしてください。

本メールのフッタ記載の設定を自ホストの設定に加えることにより、自動更新を
行うこともできます。


Debian GNU/Linux 4.0 alias etch
- -------------------------------

ソースアーカイブ:

http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8.orig.tar.gz
Size/MD5 checksum: 743275 c4b1a7079690ee16d8b0f36b2a2a90a4
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1.dsc
Size/MD5 checksum: 1425 aca91c929ec1c4e3f575e7e8eb37ba55
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1.diff.gz
Size/MD5 checksum: 53607 9e4fa44cfd9154eeea77a895d08e2952

アーキテクチャに依存しないパッケージ:

http://security.debian.org/pool/updates/main/d/dspam/dspam-doc_3.6.8-5etch1_all.deb
Size/MD5 checksum: 94508 22874dcda2fff6d04a0c644338dcf848

http://security.debian.org/pool/updates/main/d/dspam/dspam-webfrontend_3.6.8-5etch1_all.deb
Size/MD5 checksum: 109488 2fcf87ed0a9d0a82b984f1d7a83fd92a

alpha architecture (DEC Alpha)

http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 116722 fbeea9d902b354bf94b0e8358b2e035f

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 97600 426456f7a254c4deb9caa4fe46497006

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 106284 07ce97c65711d9e45e6fff61424fcef4

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 151074 565a30c4964601abdc3d7590e37df3cb

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 71262 662cbe35889767f8cfa0628347c6f1f8
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 360272 2ff991276cafa57e04843a93b5bc818d

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_alpha.deb
Size/MD5 checksum: 86090 0bcb341c0d38afe2a6f91c5ccc89a7e6

amd64 architecture (AMD x86_64 (AMD64))


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 85046 f116fad2f6a59b334548c1e410dca1b0

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 71178 6791d5a9e01eec2014b9a2384f6ff72f
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 335094 c95a6da6a5569a3bc93f146a8e4150b4

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 104680 fabdcca6612f273a075e9b553c065cb6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 132954 59b06e7c1a4f91a03fa29846adc31732
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 112174 412daf4a7e2581b7f7039c6236ddd4c9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_amd64.deb
Size/MD5 checksum: 97026 f53ca8975eb626cbcfdc85001a3c6bd3

arm architecture (ARM)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 71198 173775fc14192d9b357799fa5603d57e
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 316880 cd581369819fbf1cfa4e35cb98b9194e

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 84516 fa6d6c6bfc9b1f9999cb1116d8bdc823

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 95234 053bac8c1d149fb299ff8721cb177cd5

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 101400 c8efedf650bb3b9eb19f08b06c85b1d6
http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 124638 cbeaf73c8faa223ad18fe00d0247b5bb
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_arm.deb
Size/MD5 checksum: 108600 88eb7c6283e964f667219009a801eda8

hppa architecture (HP PA RISC)

http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 116800 26d4d2436a356933aec1981f29b6f568

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 137502 3a81b440fb5d8eeaea6742a6dcba379b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 106354 cb8d60fb47b5e3999ebb7d866968939e

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 98318 6b2940e4faac890c71227b003a9c643b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 71258 d5eea93cfce1a4b5e825c32f80b6574c
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 344376 5ff6104afcdf01293a344579b060e9b6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_hppa.deb
Size/MD5 checksum: 86434 e4e98427cbb27d7aae7a975646a77d11

i386 architecture (Intel ia32)

http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 320328 b55be9404b573b18b0fc7c21bf0247e8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 85084 655c55837cdccd7d70048f2ba74b6adc
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 110686 5eb5bcf9b8cd0fdf7e5dbdeec8b052c5

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 103912 85ceb515c9581c294060f78a50959cba

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 71254 42ea48af401d4b1d1eaa2d0e5251c38b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 96566 b96896e5ffc7617774a97fe968de4643

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_i386.deb
Size/MD5 checksum: 126340 e2a75400b747b2bc6f06dcb5548ac6a9

ia64 architecture (Intel ia64)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 114614 36e76fb73bf6b4d9f8fc3aec4cdfc120

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 155566 6c76fa0488f0d0fc5f7cf1484d5c0095
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 433272 f671ea16f0fd8d4114bdc26dcc2da4e6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 103060 1c92ebd3cedf951a674a0161fbba0a26

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 71262 9b2d4ac63622211ff0a3f4219ca7e237
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 129946 8f1084a301a1f159a6e99b319decf32c

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_ia64.deb
Size/MD5 checksum: 89500 dbf693b2e77b81f34836e1936bc1ac3c

mips architecture (MIPS (Big Endian))


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 71270 3d073f7671fe4ae6d3d8f023b04c20c1

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 103742 f66fdef7eba14fe018481880340265e7
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 333494 92bacf8b342185f430f0274caa35eb8a

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 139398 2d117739fc1fe541110ce781567327b3

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 84574 775c0a7eff0fab5a01ae0596dc4610b2
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 111290 3b797e3cb94fb594e26a00a9daea6a15

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_mips.deb
Size/MD5 checksum: 96176 b34f2d6cf4ce87f7e5c9655327393ad1

powerpc architecture (PowerPC)

http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 349508 770652e863d2fad63dabe283c32b69a1

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 98430 8988ac11256aa92b0a7fe2b1e5c7c9b8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 106846 2bd870d4457ccc4441c83db61f438cb6

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 133618 eec0027502c1a78fa3bb417869cd1ad0

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 86758 e11afd83aebf1e47bf5e47cd9fa3a412
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 114026 39d86f760518fcd914761d55711a5b50

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_powerpc.deb
Size/MD5 checksum: 71268 76e90f478e1093960e658a52844866c8

s390 architecture (IBM S/390)

http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 334940 4ef64b3bcb468e1fe5a2c909cfb4ddf8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 97054 93905182ac8facaff277ba7742c6cfad

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 104236 ad9aa683274dc8c4ee43ea56f543ee83

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 130690 3628ccc4160671ae7509402e7b5a4415
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 115260 dd4ffc92040a03a548995219c99bf86b

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 71262 de683f26a1b4bc8d27be7167443f3dc9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_s390.deb
Size/MD5 checksum: 85662 e66dbbc0ea9701302cc1e773bd64220b

sparc architecture (Sun SPARC/UltraSPARC)


http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-db4_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 71264 dd8548615ee98c41fb901e9bfd492f8c

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-dev_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 128140 3edcf034fb65f79ee9d8d74e75ad3171

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-sqlite3_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 84292 09b80a29ca25742211c8e2fbf2da1ef9

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-pgsql_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 101926 2dbf682520915d0047a2afcec034d8b8

http://security.debian.org/pool/updates/main/d/dspam/libdspam7-drv-mysql_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 95530 c81ace7df7cce9a54d7d0aa344778062
http://security.debian.org/pool/updates/main/d/dspam/libdspam7_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 109928 68c35d2c16ca9e119e950e379a1df7f6
http://security.debian.org/pool/updates/main/d/dspam/dspam_3.6.8-5etch1_sparc.deb
Size/MD5 checksum: 313106 ba1455bd0a08026a780270d26ba2ba38


これらのファイルは次の版の安定版リリース時そちらに移されます。


- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@xxxxx
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<;pkg>
------>8------------>8------------>8------------>8------------>8-
--
Seiji Kaneko skaneko@xxxxx
---------------------------------------------------------


投稿者 xml-rpc : 2008年2月22日 23:49
役に立ちました?:
過去のフィードバック 平均:(0) 総合:(0) 投票回数:(0)
本記事へのTrackback: http://hoop.euqset.org/blog/mt-tb2006.cgi/70207
トラックバック
コメント
コメントする




画像の中に見える文字を入力してください。