===========================================================
Ubuntu Security Notice USN-198-1 October 10, 2005
cfengine vulnerabilities
CAN-2005-2960, CAN-2005-3137
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected:
cfengine
The problem can be corrected by upgrading the affected package to
version 1.6.5-1ubuntu0.4.10.1 (for Ubuntu 4.10), or
1.6.5-1ubuntu0.5.04.1 (for Ubuntu 5.04). In general, a standard
system upgrade is sufficient to effect the necessary changes.
Details follow:
Javier Fernández-Sanguino Peña discovered that several tools in the
cfengine package (vicf, cfmailfilter, and cfcron) create and use
temporary files in an insecure way. A local attacker could exploit
this with a symlink attack to create or overwrite arbitrary files with
the privileges of the user running the cfengine program.
Updated packages for Ubuntu 4.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.1.diff.gz
Size/MD5: 102867 ebd2d4596fe81bad3f87b69c0a1057cd
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.1.dsc
Size/MD5: 704 1cde3ab958c48f9cb64eb7005e44bfe9
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.diff.gz
Size/MD5: 102863 0fe4462348ac5db6e48f5ae4200223ee
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5.orig.tar.gz
Size/MD5: 880066 fc02d8d56433f32020c3030192cad66e
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine-doc_1.6.5-1ubuntu0.4.10.1_all.deb
Size/MD5: 351924 ed29a178c45c8c539ef3b04afcefded0
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.1_amd64.deb
Size/MD5: 353892 44c62122d59a5f0974ad033dc6e80b4a
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.1_i386.deb
Size/MD5: 311784 cb66ad235cfdbe07a8f29d9d09f5e073
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.4.10.1_powerpc.deb
Size/MD5: 354564 4bdd42ce5b05c00bc314cb06df597dc3
Updated packages for Ubuntu 5.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5-1ubuntu0.5.04.1.diff.gz
Size/MD5: 102866 335e8d60109f38507a1f869a58595564
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5-1ubuntu0.5.04.1.dsc
Size/MD5: 704 a942df3e7d86a6d1f86126ddb648e6e9
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine_1.6.5.orig.tar.gz
Size/MD5: 880066 fc02d8d56433f32020c3030192cad66e
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/c/cfengine/cfengine-doc_1.6.5-1ubuntu0.5.04.1_all.deb
Size/MD5: 386022 fcac1e988bae93f33c5da1ea37014055
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.5.04.1_amd64.deb
Size/MD5: 353878 073ffd567f5b5bfaa3160e878b46d9ba
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.5.04.1_i386.deb
Size/MD5: 311104 23232672fe6e8eb10f25133cf59680a9
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/universe/c/cfengine/cfengine_1.6.5-1ubuntu0.5.04.1_powerpc.deb
Size/MD5: 354586 107e028030519395ee526224bdf31da5
Attachment:
signature.asc
Description: Digital signature