Ubuntu 843-1: BackupPC vulnerability

    Date06 Oct 2009
    CategoryUbuntu
    49
    Posted ByLinuxSecurity Advisories
    It was discovered that BackupPC did not restrict normal users from setting the ClientNameAlias parameter. An authenticated user could exploit this to gain access to unauthorized hosts. This update fixed the issue by preventing normal users from modifying the ClientNameAlias configuration parameter. [More...]
    ===========================================================
    Ubuntu Security Notice USN-843-1           October 06, 2009
    backuppc vulnerability
    CVE-2009-3369
    ===========================================================
    
    A security issue affects the following Ubuntu releases:
    
    Ubuntu 8.04 LTS
    Ubuntu 8.10
    Ubuntu 9.04
    
    This advisory also applies to the corresponding versions of
    Kubuntu, Edubuntu, and Xubuntu.
    
    The problem can be corrected by upgrading your system to the
    following package versions:
    
    Ubuntu 8.04 LTS:
      backuppc                        3.0.0-4ubuntu1.1
    
    Ubuntu 8.10:
      backuppc                        3.1.0-3ubuntu2.1
    
    Ubuntu 9.04:
      backuppc                        3.1.0-4ubuntu1.1
    
    In general, a standard system upgrade is sufficient to effect the
    necessary changes.
    
    Details follow:
    
    It was discovered that BackupPC did not restrict normal users from setting
    the ClientNameAlias parameter. An authenticated user could exploit this to
    gain access to unauthorized hosts. This update fixed the issue by
    preventing normal users from modifying the ClientNameAlias configuration
    parameter.
    
    
    Updated packages for Ubuntu 8.04 LTS:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1.diff.gz
          Size/MD5:    21923 9900a0a3545140aa8dfa99c82325c2a6
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1.dsc
          Size/MD5:      725 b95b75a4b08f5d51b0cc498e3b11abd5
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0.orig.tar.gz
          Size/MD5:   432200 dc37728c1dc9225354523f279045f3f3
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1_all.deb
          Size/MD5:   491322 b09233c28365bca07e7589cde9e70f29
    
    Updated packages for Ubuntu 8.10:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1.diff.gz
          Size/MD5:    24091 e9caaf9693e4222226e523d383844cfd
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1.dsc
          Size/MD5:     1123 655eb9b56a61072ee29f5c12096c1cbb
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.orig.tar.gz
          Size/MD5:   474981 84b4471852ef910768eae9963ef932d2
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1_all.deb
          Size/MD5:   537934 8ba6638c0e0c971db6c0b5a8635cd54e
    
    Updated packages for Ubuntu 9.04:
    
      Source archives:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1.diff.gz
          Size/MD5:    27074 395e09fdee61feb651812c68d447e1c7
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1.dsc
          Size/MD5:     1123 b71592b894e37a3e08a42f13b0884f2c
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.orig.tar.gz
          Size/MD5:   474981 84b4471852ef910768eae9963ef932d2
    
      Architecture independent packages:
    
        http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1_all.deb
          Size/MD5:   540222 b52db5cf3ec5b95fa34eeff76046e318
    
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"23","type":"x","order":"1","pct":56.1,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":12.2,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"13","type":"x","order":"3","pct":31.71,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.