Debian: DSA-1714-1: New rt2570 packages fix arbitrary code execution

    Date28 Jan 2009
    CategoryDebian
    62
    Posted ByLinuxSecurity Advisories
    It was discovered that an integer overflow in the "Probe Request" packet parser of the Ralinktech wireless drivers might lead to remote denial of service or the execution of arbitrary code.
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1714-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                       Moritz Muehlenhoff
    January 28, 2009                      http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : rt2570
    Vulnerability  : integer overflow
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2009-0282
    
    It was discovered that an integer overflow in the "Probe Request" packet
    parser of the Ralinktech wireless drivers might lead to remote denial of
    service or the execution of arbitrary code.
    
    Please note that you need to rebuild your driver from the source
    package in order to set this update into effect. Detailed
    instructions can be found in /usr/share/doc/rt2570-source/README.Debian
    
    For the stable distribution (etch), this problem has been fixed in
    version 1.1.0+cvs20060620-3+etch1.
    
    For the upcoming stable distribution (lenny) and the unstable
    distribution (sid), this problem has been fixed in version
    1.1.0+cvs20080623-2.
    
    We recommend that you upgrade your rt2570 package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 4.0 alias etch
    - -------------------------------
    
    Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/r/rt2570/rt2570_1.1.0+cvs20060620-3+etch1.dsc
        Size/MD5 checksum:      664 457b00a7cf3d60bef559e9cdc442e036
      http://security.debian.org/pool/updates/main/r/rt2570/rt2570_1.1.0+cvs20060620-3+etch1.diff.gz
        Size/MD5 checksum:     4958 20b48e5fb05d999bfc643a2bb0c7401f
      http://security.debian.org/pool/updates/main/r/rt2570/rt2570_1.1.0+cvs20060620.orig.tar.gz
        Size/MD5 checksum:   253367 f4131d670920a878b4d4a0f5d4d8b93a
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/r/rt2570/rt2570-source_1.1.0+cvs20060620-3+etch1_all.deb
        Size/MD5 checksum:   252986 58a62ca3f7d3b1b49cfbe9aa02eabe7b
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    Do you read our distribution advisories on a regular basis?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /component/communitypolls/?task=poll.vote&format=json
    23
    radio
    [{"id":"84","title":"Yes, for a single distribution","votes":"0","type":"x","order":"1","pct":0,"resources":[]},{"id":"85","title":"Yes, for multiple distributions","votes":"6","type":"x","order":"2","pct":60,"resources":[]},{"id":"86","title":"No","votes":"4","type":"x","order":"3","pct":40,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.