Debian: DSA-2095-1: New lvm2 packages fix denial of service

    Date23 Aug 2010
    CategoryDebian
    47
    Posted ByLinuxSecurity Advisories
    Alasdair Kergon discovered that the cluster logical volume manager daemon (clvmd) in lvm2, The Linux Logical Volume Manager, does not verify client credentials upon a socket connection, which allows local users to cause a
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1
    
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-2095-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    http://www.debian.org/security/                        Giuseppe Iuculano
    August 23, 2010                       http://www.debian.org/security/faq
    - ------------------------------------------------------------------------
    
    Package        : lvm2
    Vulnerability  : insecure communication protocol
    Problem type   : local
    Debian-specific: no
    CVE Id         : CVE-2010-2526
    Debian Bug     : 591204
    
    
    Alasdair Kergon discovered that the cluster logical volume manager daemon
    (clvmd) in lvm2, The Linux Logical Volume Manager, does not verify client
    credentials upon a socket connection, which allows local users to cause a
    denial of service.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 2.02.39-8
    
    For the testing distribution (squeeze), and the unstable distribution (sid),
    this problem has been fixed in version 2.02.66-3
    
    
    We recommend that you upgrade your lvm2 package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    
    Debian GNU/Linux 5.0 alias lenny
    - --------------------------------
    
    Debian (stable)
    - ---------------
    
    Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8.diff.gz
        Size/MD5 checksum:    17393 fb9151fdf32540e15eb245389d9d5903
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39.orig.tar.gz
        Size/MD5 checksum:   594342 1450ae55a89ea98e4ea51ad7f4ba22d4
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8.dsc
        Size/MD5 checksum:     1132 a0c84982012567f3ca824e7bdeae7637
    
    alpha architecture (DEC Alpha)
    
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_alpha.deb
        Size/MD5 checksum:   256566 c326b8e851c0f32cbe8691b01cc11984
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_alpha.deb
        Size/MD5 checksum:   384348 8d1385a4f8337c5526f3304c6fec1f51
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_alpha.udeb
        Size/MD5 checksum:   245390 e462d169578ba15401c90dd77760b38d
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_amd64.udeb
        Size/MD5 checksum:   225468 8c8e5331e9ddb80e616ae52e766007fd
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_amd64.deb
        Size/MD5 checksum:   237884 a0125354fa125136d2f9ec3de006cdc2
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_amd64.deb
        Size/MD5 checksum:   365790 dcc943057cd272357b6650f1eefac73a
    
    armel architecture (ARM EABI)
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_armel.udeb
        Size/MD5 checksum:   234540 b88dd34c0908a28233d5eadd04f85efa
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_armel.deb
        Size/MD5 checksum:   366242 4c76f36b042cf9623f0083bb805133f6
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_armel.deb
        Size/MD5 checksum:   237448 c8da5e5304588fc15c99b544f04e146c
    
    hppa architecture (HP PA RISC)
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_hppa.deb
        Size/MD5 checksum:   392908 6b16252cf68e7059f1e30a9e476f94e8
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_hppa.deb
        Size/MD5 checksum:   260256 091ed1a82e45c00754a95caa6b0baa6f
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_hppa.udeb
        Size/MD5 checksum:   255674 2637ecd324df5ea0fc623feb19d1d306
    
    i386 architecture (Intel ia32)
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_i386.deb
        Size/MD5 checksum:   355436 9d02ac68e55be8eef8d0ea1ce6b20b43
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_i386.deb
        Size/MD5 checksum:   226510 f52a7348863979ed12844154c4573c10
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_i386.udeb
        Size/MD5 checksum:   208860 df9af70565f01b89e4b2739352f78222
    
    ia64 architecture (Intel ia64)
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_ia64.udeb
        Size/MD5 checksum:   322386 5ae8fba02689e5b9a694aef1dbb13057
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_ia64.deb
        Size/MD5 checksum:   480774 2c556d7af51ddab5a44b2d6e5d6b3bd7
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_ia64.deb
        Size/MD5 checksum:   329042 f7942af707e8751aa0b4839405e82483
    
    mips architecture (MIPS (Big Endian))
    
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_mips.deb
        Size/MD5 checksum:   232164 9fe857ac073303976e7fc855381564ac
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_mips.udeb
        Size/MD5 checksum:   225760 f714be0414b5a2da553723bcbf86936d
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_mips.deb
        Size/MD5 checksum:   356294 5e61467dee584f182c860a32c2d307b9
    
    mipsel architecture (MIPS (Little Endian))
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_mipsel.deb
        Size/MD5 checksum:   354690 47619b026ff026c16b4cc140bc6c94d0
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_mipsel.udeb
        Size/MD5 checksum:   225336 cee7c70a03aab11246400022a122e250
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_mipsel.deb
        Size/MD5 checksum:   231334 5a661a87a3d8ec350616d7d248567272
    
    powerpc architecture (PowerPC)
    
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_powerpc.deb
        Size/MD5 checksum:   245820 ef94fd14b4386668bf0ab1e76fb661ce
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_powerpc.udeb
        Size/MD5 checksum:   223004 da5e2c560409f2463fe5032640accd17
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_powerpc.deb
        Size/MD5 checksum:   372636 8514f410e8a3a6060d4cf4f9798f0918
    
    s390 architecture (IBM S/390)
    
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_s390.deb
        Size/MD5 checksum:   381192 4c81fd3daec2c429851d8e697351fce6
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_s390.deb
        Size/MD5 checksum:   251920 413ae367df9f54c8f27f79287f0aa75d
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_s390.udeb
        Size/MD5 checksum:   247930 75c9a32ada8454709f9696fb2c18109f
    
    sparc architecture (Sun SPARC/UltraSPARC)
    
      http://security.debian.org/pool/updates/main/l/lvm2/clvm_2.02.39-8_sparc.deb
        Size/MD5 checksum:   229496 e5858c5018f21cd34b0d2d27accb8042
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2_2.02.39-8_sparc.deb
        Size/MD5 checksum:   353842 06efa3d5cb736deb80499c2ed393902e
      http://security.debian.org/pool/updates/main/l/lvm2/lvm2-udeb_2.02.39-8_sparc.udeb
        Size/MD5 checksum:   223984 76a8e6c8de5400c6a41e8923b7f12509
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and http://packages.debian.org/
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"14","type":"x","order":"1","pct":53.85,"resources":[]},{"id":"88","title":"Should be more technical","votes":"4","type":"x","order":"2","pct":15.38,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"8","type":"x","order":"3","pct":30.77,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.