SHARE
Facebook X Pinterest WhatsApp

Debian GNU/Linux Advisories: kernel-patch-2.4.17-mips, kernel-patch-2.4.19-mips, ecartis, listar

Written By
Web Webster
Web Webster
Mar 27, 2003 
- --------------------------------------------------------------------------
Debian Security Advisory DSA 270-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
March 27sh, 2003                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Packages       : kernel-patch-2.4.17-mips, kernel-patch-2.4.19-mips
Vulnerability  : local privilege escalation
Problem-Type   : local
Debian-specific: no
CVE Id         : CAN-2003-0127

The kernel module loader in Linux 2.2 and Linux 2.4 kernels has a flaw
in ptrace.  This hole allows local users to obtain root privileges by
using ptrace to attach to a child process that is spawned by the
kernel.  Remote exploitation of this hole is not possible.

This advisory only covers kernel packages for the big and little endian MIPS
architectures.  Other architectures will be covered by separate advisories.

For the stable distribution (woody) this problem has been fixed in version
2.4.17-0.020226.2.woody1 of kernel-patch-2.4.17-mips (mips+mipsel) and in
version 2.4.19-0.020911.1.woody1 of kernel-patch-2.4.19-mips (mips only).

The old stable distribution (potato) is not affected by this problem
for these architectures since mips and mipsel were first released with
Debian GNU/Linux 3.0 (woody).

For the unstable distribution (sid) this problem has been fixed in
version 2.4.19-0.020911.6 of kernel-patch-2.4.19-mips (mips+mipsel).

We recommend that you upgrade your kernel-images packages immediately.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-patch-2.4.17-mips_2.4.17-0.020226.2.woody1.dsc
      Size/MD5 checksum:      786 937c32a962c27f9461a10d4d2c98c350
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-patch-2.4.17-mips_2.4.17-0.020226.2.woody1.tar.gz
      Size/MD5 checksum:  1140097 e26c4406aa52e77b00df972335fdbb71

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody1.dsc
      Size/MD5 checksum:      832 4e431992276bcd65d34bd07b86784200
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody1.tar.gz
      Size/MD5 checksum:  1035256 cd2e9213d798552a7ebc550903e45bf9

  Architecture independent components:

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-patch-2.4.17-mips_2.4.17-0.020226.2.woody1_all.deb
      Size/MD5 checksum:  1142510 b1c1c6d93281938651b91c0caa85b818

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-patch-2.4.19-mips_2.4.19-0.020911.1.woody1_all.deb
      Size/MD5 checksum:  1036948 8de25b980c15831460c844a535b76e3a

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-headers-2.4.17_2.4.17-0.020226.2.woody1_mips.deb
      Size/MD5 checksum:  3494700 3ebb5ff6d044f808b500dfb0f5beccad
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-image-2.4.17-r4k-ip22_2.4.17-0.020226.2.woody1_mips.deb
      Size/MD5 checksum:  2038950 baae9c9e139d2b5ef035f01adea32171
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-image-2.4.17-r5k-ip22_2.4.17-0.020226.2.woody1_mips.deb
      Size/MD5 checksum:  2039084 5bb6ad7c4207a6f351612fd4e330a337

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-headers-2.4.19_2.4.19-0.020911.1.woody1_mips.deb
      Size/MD5 checksum:  3897722 8d096cf0e9286e175127dfb1763bfcd2
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r4k-ip22_2.4.19-0.020911.1.woody1_mips.deb
      Size/MD5 checksum:  2072292 3f49ce11a63309465f1ee5c31b54a1c4
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/kernel-image-2.4.19-r5k-ip22_2.4.19-0.020911.1.woody1_mips.deb
      Size/MD5 checksum:  2072926 b4ac7b3f74a392c4f7482eb590eadcb2
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.19-mips/mips-tools_2.4.19-0.020911.1.woody1_mips.deb
      Size/MD5 checksum:    12418 ec83e5bf008c27285768faffcbbd8534

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-headers-2.4.17_2.4.17-0.020226.2.woody1_mipsel.deb
      Size/MD5 checksum:  3493956 68730ffdae0bd73800c5e9aef83094ca
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-image-2.4.17-r3k-kn02_2.4.17-0.020226.2.woody1_mipsel.deb
      Size/MD5 checksum:  2193168 1ae735e62e4ff6c94b2741d0bad26d4c
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/kernel-image-2.4.17-r4k-kn04_2.4.17-0.020226.2.woody1_mipsel.deb
      Size/MD5 checksum:  2189118 64001cdeae34c28e987bb4dca356213e
    http://security.debian.org/pool/updates/main/k/kernel-patch-2.4.17-mips/mips-tools_2.4.17-0.020226.2.woody1_mipsel.deb
      Size/MD5 checksum:    14086 8a15ad3716a048cfac78184f67ec2985


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/;

- --------------------------------------------------------------------------
Debian Security Advisory DSA 271-1                     security@debian.org
http://www.debian.org/security/                             Martin Schulze
March 27th, 2003                        http://www.debian.org/security/faq
- --------------------------------------------------------------------------

Package        : ecartis, listar
Vulnerability  : unauthorized password change
Problem-Type   : remote
Debian-specific: no
CVE Id         : CAN-2003-0162

A problem has been discovered in ecartis, a mailing list manager,
formerly known as listar.  This vulnerability enables an attacker to
reset the password of any user defined on the list server, including
the list admins.

For the stable distribution (woody) this problem has been fixed in
version 0.129a+1.0.0-snap20020514-1.1 of ecartis.

For the old stable distribution (potato) this problem has been fixed
in version 0.129a-2.potato3 of listar.

For the unstable distribution (sid) this problem has been
fixed in version 1.0.0+cvs.20030321-1 of ecartis.

We recommend that you upgrade your ecartis and listar packages.


Upgrade Instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- ---------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3.dsc
      Size/MD5 checksum:      556 6a598c9cac5f1da997f3790b47711e33
    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3.diff.gz
      Size/MD5 checksum:    82819 d8154d1316c73efa71907f026b5a5df4
    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a.orig.tar.gz
      Size/MD5 checksum:   323888 0302a199d9e5ee180c9e6e55ee7a0780

  Alpha architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_alpha.deb
      Size/MD5 checksum:   357788 7db5223f510d4d0d03cbf68e2d9a554c
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_alpha.deb
      Size/MD5 checksum:    32072 5e63d71fa7a8cd8aed70821f529b5d13

  ARM architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_arm.deb
      Size/MD5 checksum:   335076 5b51113b57b948e9b2b73c06a835dde2
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_arm.deb
      Size/MD5 checksum:    32174 1182335a3ce6c842aaef2832cd56db09

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_i386.deb
      Size/MD5 checksum:   301830 aa8d67d1f07cb0a769d2030708e3725c
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_i386.deb
      Size/MD5 checksum:    25342 efd78841548a3e97b0d0557e8b360a3d

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_m68k.deb
      Size/MD5 checksum:   308188 fbacaef28d85db28a2d3d5e1e70945ce
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_m68k.deb
      Size/MD5 checksum:    28030 2acf707d75e5f1e04cd297b5f1e33a3a

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_powerpc.deb
      Size/MD5 checksum:   339304 4fb6eaa9bb7a3bc6f7598b6dd77a11b6
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_powerpc.deb
      Size/MD5 checksum:    32094 ee010d55634c49190c6c31158474bc11

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/l/listar/listar_0.129a-2.potato3_sparc.deb
      Size/MD5 checksum:   343804 f43699c1036fbbacba2ee9f726796208
    http://security.debian.org/pool/updates/main/l/listar/listar-cgi_0.129a-2.potato3_sparc.deb
      Size/MD5 checksum:    31450 f0cd070c44790d8afdabd87a01aa3a9f


Debian GNU/Linux 3.0 alias woody
- --------------------------------

  Source archives:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1.dsc
      Size/MD5 checksum:      633 c12d84d29fc5f3a4d035abe9a4364d59
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1.diff.gz
      Size/MD5 checksum:    10058 a3a508ca141857099b5a2162ab960d2c
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514.orig.tar.gz
      Size/MD5 checksum:   326215 2772a595a3fe7ea5073874113da813ec

  Alpha architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_alpha.deb
      Size/MD5 checksum:   256488 b1acd0ec6048db96f8cca9f7f714012e
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_alpha.deb
      Size/MD5 checksum:    34062 2d294ecdf9de201e498e701f147cad9c

  ARM architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_arm.deb
      Size/MD5 checksum:   238342 9be97e50e03945c60b58298ab31c59b1
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_arm.deb
      Size/MD5 checksum:    34196 d8d260318e3d8cd7dcee6645a8691b18

  Intel IA-32 architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_i386.deb
      Size/MD5 checksum:   199224 04f19e17d53b454345d1d3bcb61fc7b5
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_i386.deb
      Size/MD5 checksum:    26382 09241d9ce5d2638f3bc36e20cdca4780

  Intel IA-64 architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_ia64.deb
      Size/MD5 checksum:   337858 8acbd18d48d6ce6afe2c484479d79d10
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_ia64.deb
      Size/MD5 checksum:    44382 231d8671abb4aae44fc54991668a15ef

  HP Precision architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_hppa.deb
      Size/MD5 checksum:   237048 b276c82af8eecf61c48d75de24d086fe
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_hppa.deb
      Size/MD5 checksum:    34168 fad0a2a3045895e4c4b091de3aa19c21

  Motorola 680x0 architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_m68k.deb
      Size/MD5 checksum:   210608 20fc0efde347e1c6641b698d6313465b
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_m68k.deb
      Size/MD5 checksum:    29460 2a85d86c33c287b909f69d65902ade15

  Big endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_mips.deb
      Size/MD5 checksum:   203154 ce97ea51862960ad3aacbb6c4c1984df
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_mips.deb
      Size/MD5 checksum:    26412 1dbef7b1080e1af1944eefcca980dcc9

  Little endian MIPS architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_mipsel.deb
      Size/MD5 checksum:   203586 757112215cdc752608c39cd28097c6fa
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_mipsel.deb
      Size/MD5 checksum:    26616 e12ed3aff462b581ac950782ee5611a3

  PowerPC architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_powerpc.deb
      Size/MD5 checksum:   230912 a2154d90a3fde7031b577b0cc8447664
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_powerpc.deb
      Size/MD5 checksum:    33566 86341f5c54c9f77600dd014b9e8aa1ff

  IBM S/390 architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_s390.deb
      Size/MD5 checksum:   205216 663b7a54b58b9e94945fffbb39d34ae6
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_s390.deb
      Size/MD5 checksum:    28146 055c6a32bf2ff31ed96517d6bc180ff2

  Sun Sparc architecture:

    http://security.debian.org/pool/updates/main/e/ecartis/ecartis_0.129a+1.0.0-snap20020514-1.1_sparc.deb
      Size/MD5 checksum:   244436 fd62ecb7515ec274e1052e49f0f02ead
    http://security.debian.org/pool/updates/main/e/ecartis/ecartis-cgi_0.129a+1.0.0-snap20020514-1.1_sparc.deb
      Size/MD5 checksum:    33726 92bcb1cf248a1400b4a1110a8e02b8e3


  These files will probably be moved into the stable distribution on
  its next revision.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show ' and http://packages.debian.org/;
Web Webster

Web Webster

Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.

Linux Today Logo

LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.

facebook
linkedin
x

Company

Contact us

Categories

News IT Management Infrastructure Developer Security High Performance Storage Blog

Property of TechnologyAdvice. © 2026 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

Terms of Service Privacy Policy California - Do Not Sell My Information