Debian: 'xmcd' vulnerability

    Date22 Nov 2000
    CategoryDebian
    2526
    Posted ByLinuxSecurity Advisories
    A buffer overflow in ncurses, linked to the "cda" binary, allowed a rootexploit. The problem is fixed in xmcd 2.5pl1-7.1.
    
    - ----------------------------------------------------------------------------
    Debian Security Advisory                                 This email address is being protected from spambots. You need JavaScript enabled to view it. 
    http://www.debian.org/security/                            Daniel Jacobowitz
    November 21, 2000
    - ----------------------------------------------------------------------------
    
    Package: xmcd
    Vulnerability: untrustworthy privileged binaries
    Debian-specific: yes
    Vulnerable: yes
    
    The Debian GNU/Linux xmcd package has historically installed two setuid
    helpers for accessing cddb databases and SCSI cdrom drives.  More recently,
    the package offered the administrator the chance to remove these setuid
    flags, but did so incorrectly.
    
    A buffer overflow in ncurses, linked to the "cda" binary, allowed a root
    exploit.  Fixed ncurses packages have been released, as well as fixed
    xmcd packages which do not install this binary with a setuid flag.
    
    The problem is fixed in xmcd 2.5pl1-7.1, and we recommend all users with
    xmcd installed upgrade to this release.  You may need to add users of xmcd
    to the "audio" and "cdrom" groups in order for them to continue using xmcd.
    
    Debian GNU/Linux 2.1 alias slink
    - --------------------------------
    
      Slink is no longer being supported by the Debian Security Team.  We highly
      recommend an upgrade to the current stable release.
    
    Debian GNU/Linux 2.2 (stable) alias potato
    - ------------------------------------------
    
      Fixes are currently available for the Alpha, ARM, Intel ia32, Motorola 680x0,
      PowerPC and Sun SPARC architectures, and will be included in 2.2r2.
    
      Source archives:
        
    http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.diff.gz
          MD5 checksum: 88eb19b072950d0c00fadf90c46a0386
        
    http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.dsc
          MD5 checksum: 78e6765e7bc526e200344ba400504602
        
    http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1.orig.tar.gz
          MD5 checksum: 316dd535081bc714c0745217471cfd65
    
      Alpha architecture:
     
    http://security.debian.org/dists/potato/updates/main/binary-alpha/cddb_2.5pl1-7.1_alpha.deb
          MD5 checksum: 4352ea9c83aae49abd985a4e5bd0f8d4
        
    http://security.debian.org/dists/potato/updates/main/binary-alpha/xmcd_2.5pl1-7.1_alpha.deb
          MD5 checksum: 46e713b153ee70ad284ce3dcab305b45
    
      ARM architecture:
        
    http://security.debian.org/dists/potato/updates/main/binary-arm/cddb_2.5pl1-7.1_arm.deb
          MD5 checksum: ba951094501062a45098c90de62c8b0c
        
    http://security.debian.org/dists/potato/updates/main/binary-arm/xmcd_2.5pl1-7.1_arm.deb
          MD5 checksum: cde12639f97883537e958c7444ad6c0b
    
      Intel ia32 architecture:
        
    http://security.debian.org/dists/potato/updates/main/binary-i386/cddb_2.5pl1-7.1_i386.deb
          MD5 checksum: 117f75f3f9f03680268fe2d12a023bab
        
    http://security.debian.org/dists/potato/updates/main/binary-i386/xmcd_2.5pl1-7.1_i386.deb
          MD5 checksum: a8a318f6ecb6b38a2cb0a36d984c3ec8
    
      Motorola 680x0 architecture:
        
    http://security.debian.org/dists/potato/updates/main/binary-m68k/cddb_2.5pl1-7.1_m68k.deb
          MD5 checksum: 6e724e2f9ebd0b7c5143f268d7630502
        
    http://security.debian.org/dists/potato/updates/main/binary-m68k/xmcd_2.5pl1-7.1_m68k.deb
          MD5 checksum: dcf12acab522d74f30ad3f5c7a4bd603
    
      PowerPC architecture:
        
    http://security.debian.org/dists/potato/updates/main/binary-powerpc/cddb_2.5pl1-7.1_powerpc.deb
          MD5 checksum: d0ffd57cb596e93f383013fdc9607569
        
    http://security.debian.org/dists/potato/updates/main/binary-powerpc/xmcd_2.5pl1-7.1_powerpc.deb
          MD5 checksum: 132094382de56fb7087d470c052f0644
    
      Sun Sparc architecture:
        
    http://security.debian.org/dists/potato/updates/main/binary-sparc/cddb_2.5pl1-7.1_sparc.deb
          MD5 checksum: 48c43a24d9c6c9ae86ffceeb6bfe0a36
        
    http://security.debian.org/dists/potato/updates/main/binary-sparc/xmcd_2.5pl1-7.1_sparc.deb
          MD5 checksum: 20b35079db60411b586e75a7ed196b9a
    
    Debian GNU/Linux Unstable alias woody
    - -------------------------------------
    
      This version of Debian is not yet released.
    
      Fixes will be made available for Alpha, ARM, Intel ia32, Motorola 680x0,
      PowerPC, and SPARC in the Debian archive in the next day.  The packages
      listed above may also be installed on unstable systems.
    
    - ----------------------------------------------------------------------------
    For apt-get: deb  http://security.debian.org/ stable/updates main
    Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it.
    Package info: `apt-cache show ' and  http://packages.debian.org/
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"4","type":"x","order":"1","pct":57.14,"resources":[]},{"id":"88","title":"Should be more technical","votes":"2","type":"x","order":"2","pct":28.57,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"1","type":"x","order":"3","pct":14.29,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.