Date: Wed, 22 Nov 2000 12:31:27 -0500
From: Daniel Jacobowitz
To: debian-security-announce@lists.debian.org
Subject: [SECURITY] New Debian xmcd packages released
Debian Security Advisory security@debian.org
http://www.debian.org/security/ Daniel Jacobowitz
November 21, 2000
Package: xmcd
Vulnerability: untrustworthy privileged binaries
Debian-specific: yes
Vulnerable: yes
The Debian GNU/Linux xmcd package has historically installed two
setuid helpers for accessing cddb databases and SCSI cdrom drives.
More recently, the package offered the administrator the chance to
remove these setuid flags, but did so incorrectly.
A buffer overflow in ncurses, linked to the “cda” binary,
allowed a root exploit. Fixed ncurses packages have been released,
as well as fixed xmcd packages which do not install this binary
with a setuid flag.
The problem is fixed in xmcd 2.5pl1-7.1, and we recommend all
users with xmcd installed upgrade to this release. You may need to
add users of xmcd to the “audio” and “cdrom” groups in order for
them to continue using xmcd.
Debian GNU/Linux 2.1 alias slink
Slink is no longer being supported by the Debian Security Team.
We highly recommend an upgrade to the current stable release.
Debian GNU/Linux 2.2 (stable) alias potato
Fixes are currently available for the Alpha, ARM, Intel ia32,
Motorola 680×0, PowerPC and Sun SPARC architectures, and will be
included in 2.2r2.
Source archives:
http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.diff.gz
MD5 checksum: 88eb19b072950d0c00fadf90c46a0386
http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1-7.1.dsc
MD5 checksum: 78e6765e7bc526e200344ba400504602
http://security.debian.org/dists/potato/updates/main/source/xmcd_2.5pl1.orig.tar.gz
MD5 checksum: 316dd535081bc714c0745217471cfd65
Alpha architecture:
http://security.debian.org/dists/potato/updates/main/binary-alpha/cddb_2.5pl1-7.1_alpha.deb
MD5 checksum: 4352ea9c83aae49abd985a4e5bd0f8d4
http://security.debian.org/dists/potato/updates/main/binary-alpha/xmcd_2.5pl1-7.1_alpha.deb
MD5 checksum: 46e713b153ee70ad284ce3dcab305b45
ARM architecture:
http://security.debian.org/dists/potato/updates/main/binary-arm/cddb_2.5pl1-7.1_arm.deb
MD5 checksum: ba951094501062a45098c90de62c8b0c
http://security.debian.org/dists/potato/updates/main/binary-arm/xmcd_2.5pl1-7.1_arm.deb
MD5 checksum: cde12639f97883537e958c7444ad6c0b
Intel ia32 architecture:
http://security.debian.org/dists/potato/updates/main/binary-i386/cddb_2.5pl1-7.1_i386.deb
MD5 checksum: 117f75f3f9f03680268fe2d12a023bab
http://security.debian.org/dists/potato/updates/main/binary-i386/xmcd_2.5pl1-7.1_i386.deb
MD5 checksum: a8a318f6ecb6b38a2cb0a36d984c3ec8
Motorola 680×0 architecture:
http://security.debian.org/dists/potato/updates/main/binary-m68k/cddb_2.5pl1-7.1_m68k.deb
MD5 checksum: 6e724e2f9ebd0b7c5143f268d7630502
http://security.debian.org/dists/potato/updates/main/binary-m68k/xmcd_2.5pl1-7.1_m68k.deb
MD5 checksum: dcf12acab522d74f30ad3f5c7a4bd603
PowerPC architecture:
http://security.debian.org/dists/potato/updates/main/binary-powerpc/cddb_2.5pl1-7.1_powerpc.deb
MD5 checksum: d0ffd57cb596e93f383013fdc9607569
http://security.debian.org/dists/potato/updates/main/binary-powerpc/xmcd_2.5pl1-7.1_powerpc.deb
MD5 checksum: 132094382de56fb7087d470c052f0644
Sun Sparc architecture:
http://security.debian.org/dists/potato/updates/main/binary-sparc/cddb_2.5pl1-7.1_sparc.deb
MD5 checksum: 48c43a24d9c6c9ae86ffceeb6bfe0a36
http://security.debian.org/dists/potato/updates/main/binary-sparc/xmcd_2.5pl1-7.1_sparc.deb
MD5 checksum: 20b35079db60411b586e75a7ed196b9a
Debian GNU/Linux Unstable alias woody
This version of Debian is not yet released.
Fixes will be made available for Alpha, ARM, Intel ia32,
Motorola 680×0, PowerPC, and SPARC in the Debian archive in the
next day. The packages listed above may also be installed on
unstable systems.
For apt-get: deb http://security.debian.org/
stable/updates main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/
<pkg>