Debian: New rssh packages fix privilege escalation
Summary
- --------------------------------------------------------------------------Debian Security Advisory DSA 1109-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff July 16th, 2006 http://www.debian.org/security/faq - --------------------------------------------------------------------------Package : rssh Vulnerability : programming error Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-1320 Debian Bug : 346322 Russ Allbery discovered that rssh, a restricted shell, performs insufficient checking of incoming commands, which might lead to a bypass of access restrictions. For the stable distribution (sarge) this problem has been fixed in version 2.2.3-1.sarge.2. For the unstable distribution (sid) this problem has been fixed in version 2.3.0-1.1. We recommend that you upgrade your rssh package. Upgrade Instructions - --------------------wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: Size/MD5 checksum: 589 a8ccbaa1d14d0aa30b3eb0bb1aefd4e5 Size/MD5 checksum: 52207 00e3ad8c7944ed55e1316e414ab3d388 Size/MD5 checksum: 107216 74f40a4fd5d2b097af34a817e21a33cf Alpha architecture: Size/MD5 checksum: 48782 0388514b947030f42219c9a615527dd9 AMD64 architecture: Size/MD5 checksum: 44472 021a58e5c2591e2a15e4f1804816aa7b ARM architecture: Size/MD5 checksum: 41974 98eb40b5011e7868b02edfc07591f005 Intel IA-32 architecture: Size/MD5 checksum: 42596 7236c31d25f8b4cbbb8894112aa585aa Intel IA-64 architecture: Size/MD5 checksum: 55530 9c61a904a78c4c6d93763cdb73f9c009 HP Precision architecture: Size/MD5 checksum: 44098 334ae1019286051be323bf6994d51c99 Motorola 680x0 architecture: Size/MD5 checksum: 41522 0efafd5a441d6d392d1a2490bfb2dcc4 Big endian MIPS architecture: Size/MD5 checksum: 49520 7126170731d1b5ad12d7afb6d68c16b7 Little endian MIPS architecture: Size/MD5 checksum: 49546 7d8859c87eeb09f3b2502cfbed3c3f66 PowerPC architecture: Size/MD5 checksum: 42936 f68184985e1ec6c27518ac74404afbec IBM S/390 architecture: Size/MD5 checksum: 42596 29243bae45e1dca2c07ca609617c0bfa Sun Sparc architecture: Size/MD5 checksum: 42532 59db16aa282bc182f79418fdd99341c0 These files will probably be moved into the stable distribution on its next update. - ---------------------------------------------------------------------------------For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org