Debian: DSA-1815-1: New libtorrent-rasterbar packages fix denial of

    Date14 Jun 2009
    CategoryDebian
    63
    Posted ByLinuxSecurity Advisories
    It was discovered that the Rasterbar Bittorrent library performed insufficient validation of path names specified in torrent files, which could lead to denial of service by overwriting files.
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1815-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                       Moritz Muehlenhoff
    June 14, 2009                         http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : libtorrent-rasterbar
    Vulnerability  : programming error
    Problem type   : local(remote)
    Debian-specific: no
    CVE Id(s)      : CVE-2009-1760
    
    It was discovered that the Rasterbar Bittorrent library performed
    insufficient validation of path names specified in torrent files, which
    could lead to denial of service by overwriting files.
    
    The old stable distribution (etch) doesn't include libtorrent-rasterbar.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 0.13.1-2+lenny1.
    
    For the unstable distribution (sid), this problem has been fixed in
    version 0.14.4-1.
    
    We recommend that you upgrade your libtorrent-rasterbar package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.diff.gz
        Size/MD5 checksum:     5295 ad26ec230cfb51e8b1a11053c631e23a
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1.orig.tar.gz
        Size/MD5 checksum:  1469775 9d6b112fedc5861402647ff72e95dba0
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar_0.13.1-2+lenny1.dsc
        Size/MD5 checksum:     1688 615d598da6448acb06a5564b5af98504
    
    Architecture independent packages:
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-doc_0.13.1-2+lenny1_all.deb
        Size/MD5 checksum:   494718 2ff3232090c18212dceab0c240ad5b6a
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_alpha.deb
        Size/MD5 checksum:  2847180 bdc11c81ec50ef9c87e473a5adedef4d
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_alpha.deb
        Size/MD5 checksum:  1191354 7fc10d95bb5fb39218ef46a4e0256aa0
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_alpha.deb
        Size/MD5 checksum:  7486406 be3e0f535a318d69bd8d8f84987c00c9
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_amd64.deb
        Size/MD5 checksum:   991572 8bfc1c7c2a0e715830b6b869d6700826
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_amd64.deb
        Size/MD5 checksum:  1958800 6f925903c79b0c09c861cfafc154fddb
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_amd64.deb
        Size/MD5 checksum:  7578292 b5fda43c6ef50c504a11362f34efba69
    
    arm architecture (ARM)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_arm.deb
        Size/MD5 checksum:  1083396 265b8b109918bdb5a7cbd7a93a98f906
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_arm.deb
        Size/MD5 checksum:  7278890 4f175b83c43250504e3e6e927b1aa95b
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_arm.deb
        Size/MD5 checksum:  2081302 f75e702139b6e6df8282ca8db807358a
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_armel.deb
        Size/MD5 checksum:   863962 d3e22f0d17881578c94ff18577c7b0ff
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_armel.deb
        Size/MD5 checksum:  2114218 28a9d8dd167a77c1c350c5f0c26656bb
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_armel.deb
        Size/MD5 checksum:  7401594 096572e6a80d8e2629893d2eda7b06b2
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_hppa.deb
        Size/MD5 checksum:  1131024 69724d35147d2cb2d47f47b1dd2d09f2
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_hppa.deb
        Size/MD5 checksum:  2188616 48986004e631fcb30dc617dd09d6bb7e
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_hppa.deb
        Size/MD5 checksum:  7447584 9c0ef400fb8a6af2fed8e57572749e82
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_i386.deb
        Size/MD5 checksum:  7466610 561fa4b4cc308ab89142ba8745144839
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_i386.deb
        Size/MD5 checksum:   986646 fbae1919d47696f1160191896ee51fe2
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_i386.deb
        Size/MD5 checksum:  1837994 706c48fe6df16cf87954938079b83bbd
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_ia64.deb
        Size/MD5 checksum:  2839510 0784e971e672f0d3508735b58b0190e0
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_ia64.deb
        Size/MD5 checksum:  7867400 ef973715edcbbcc5739c959bc1a616e7
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_ia64.deb
        Size/MD5 checksum:  1408300 465e116873aeb20eb4d3307f11e23a1f
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_mips.deb
        Size/MD5 checksum:  2042000 a7da44aa33d55dd1720f03ff5578265b
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_mips.deb
        Size/MD5 checksum:   923072 f228766d2143c5678b568a7317427a7d
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_mips.deb
        Size/MD5 checksum:  7563768 7269489934ef49530520be1f58d37137
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_mipsel.deb
        Size/MD5 checksum:  7357426 4c6e09de92323c4edfc2e9d1697b88d4
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_mipsel.deb
        Size/MD5 checksum:   915480 5f6dcdcd4ebcf05c993ae8961172f8c3
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_mipsel.deb
        Size/MD5 checksum:  2022654 d370a93c7711c996b40e679c75b9e450
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_powerpc.deb
        Size/MD5 checksum:  2009160 ffe50b547f76cc3715a696ec446c4a96
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_powerpc.deb
        Size/MD5 checksum:  7771456 cf4a135f1dad2440449cc0a6e3ea2863
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_powerpc.deb
        Size/MD5 checksum:  1046364 d68326739c445096bebf71b8da2fb9ab
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_s390.deb
        Size/MD5 checksum:  7523480 b51f62f23c283f3ec6992b234946a585
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_s390.deb
        Size/MD5 checksum:   945680 55899bdfa3d12f96dcc8a3bca4688429
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_s390.deb
        Size/MD5 checksum:  1877984 57a4674260e40426e3b12f2d1e2e500f
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dbg_0.13.1-2+lenny1_sparc.deb
        Size/MD5 checksum:  7366596 36c4f6f9964750a32ce7278bf4d04da2
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar0_0.13.1-2+lenny1_sparc.deb
        Size/MD5 checksum:  1145234 ff7d341f351f65144621eed3f9a3cf86
      http://security.debian.org/pool/updates/main/libt/libtorrent-rasterbar/libtorrent-rasterbar-dev_0.13.1-2+lenny1_sparc.deb
        Size/MD5 checksum:  1734368 064c9bfed79ac652c89db16fb1b74357
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"39","type":"x","order":"1","pct":50.65,"resources":[]},{"id":"88","title":"Should be more technical","votes":"11","type":"x","order":"2","pct":14.29,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"27","type":"x","order":"3","pct":35.06,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.