Linux Security
    Linux Security
    Linux Security

    Debian: New links2 packages fix arbitrary shell command execution

    Date
    3981
    Posted By
    Teemu Salmela discovered that the links2 character mode web browser performs insufficient sanitising of smb:// URIs, which might lead to the execution of arbitrary shell commands.
    - ------------------------------------------------------------------------
    Debian Security Advisory DSA-1240-1                  This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.debian.org/security/                               Steve Kemp
    December 21, 2006
    - ------------------------------------------------------------------------
    
    Package        : links2
    Vulnerability  : insufficient escaping
    Problem type   : remote
    Debian-specific: no
    CVE Id(s)      : CVE-2006-5925
    Debian Bug     : 400718
    
    Teemu Salmela discovered that the links2 character mode web browser
    performs insufficient sanitising of smb:// URIs, which might lead to the
    execution of arbitrary shell commands.
    
    For the stable distribution (sarge) this problem has been fixed in
    version 2.1pre16-1sarge1.
    
    For the upcoming stable distribution (etch) this problem has been
    fixed in version 2.1pre26-1.
    
    For the unstable distribution (sid) this problem has been fixed in
    version 2.1pre26-1.
    
    We recommend that you upgrade your links2 package.
    
    Upgrade instructions
    - --------------------
    
    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.
    
    If you are using the apt-get package manager, use the line for
    sources.list as given below:
    
    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages
    
    You may use an automated update by adding the resources from the
    footer to the proper configuration.
    
    Debian 3.1 (stable)
    - -------------------
    
    Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.
    
    Source archives:
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1.diff.gz
        Size/MD5 checksum:    28658 a83c79990bbfb6f9ec26d737f767ee90
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16.orig.tar.gz
        Size/MD5 checksum:  4217483 7baf4fc20cc244d80ead21cebff07d89
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1.dsc
        Size/MD5 checksum:      841 ed4853334b7eebef055271df06cdcd7a
    
    alpha architecture (DEC Alpha)
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_alpha.deb
        Size/MD5 checksum:  2110324 b3633fddb199c45339d3837bb0a519a0
    
    amd64 architecture (AMD x86_64 (AMD64))
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_amd64.deb
        Size/MD5 checksum:  2040922 5fb402e6a833709741d20238346c7597
    
    arm architecture (ARM)
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_arm.deb
        Size/MD5 checksum:  1996004 c7c79ddcb82d5758668ed71d74b9685f
    
    i386 architecture (Intel ia32)
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_i386.deb
        Size/MD5 checksum:  1997426 4c1ef611e31c57583f7471653962a84a
    
    m68k architecture (Motorola Mc680x0)
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_m68k.deb
        Size/MD5 checksum:  1904084 e5c777a07eaa88f4367b51d88c556a14
    
    mips architecture (MIPS (Big Endian))
    
      https://security.debian.org/pool/updates/main/l/links2/links2_2.1pre16-1sarge1_mips.deb
        Size/MD5 checksum:  2034596 22854de6eaf3aa1e392291760e85e5e8
    
    
      These files will probably be moved into the stable distribution on
      its next update.
    
    - ---------------------------------------------------------------------------------
    For apt-get: deb https://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    

    Advisories

    LinuxSecurity Poll

    How are you contributing to Open Source?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 4 answer(s).
    /main-polls/37-how-are-you-contributing-to-open-source?task=poll.vote&format=json
    37
    radio
    [{"id":"127","title":"I'm involved with the development of an open-source project(s).","votes":"2","type":"x","order":"1","pct":100,"resources":[]},{"id":"128","title":"I've reported vulnerabilities I've discovered in open-source code.","votes":"0","type":"x","order":"2","pct":0,"resources":[]},{"id":"129","title":"I've provided developers with feedback on their projects.","votes":"0","type":"x","order":"3","pct":0,"resources":[]},{"id":"130","title":"I've helped another community member get started contributing to Open Source.","votes":"0","type":"x","order":"4","pct":0,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350


    VIEW MORE POLLS

    bottom 200

    Please enable / Bitte aktiviere JavaScript!
    Veuillez activer / Por favor activa el Javascript![ ? ]

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.