Ubuntu alert USN-917-1 (puppet)
| From: | Marc Deslauriers <marc.deslauriers@canonical.com> | |
| To: | ubuntu-security-announce@lists.ubuntu.com | |
| Subject: | [USN-917-1] Puppet vulnerabilities | |
| Date: | Wed, 24 Mar 2010 09:52:23 -0400 | |
| Message-ID: | <1269438744.3406.28.camel@mdlinux.technorage.com> | |
| Cc: | full-disclosure@lists.grok.org.uk, bugtraq@securityfocus.com | |
| Archive‑link: | Article |
=========================================================== Ubuntu Security Notice USN-917-1 March 24, 2010 puppet vulnerabilities CVE-2009-3564, CVE-2010-0156 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.10: puppet 0.24.8-2ubuntu4.1 In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: It was discovered that Puppet did not drop supplementary groups when being run as a different user. A local user may be able to use this flaw to bypass security restrictions and gain access to restricted files. (CVE-2009-3564) It was discovered that Puppet did not correctly handle temporary files. A local user can exploit this flaw to bypass security restrictions and overwrite arbitrary files. (CVE-2010-0156) Updated packages for Ubuntu 9.10: Source archives: http://security.ubuntu.com/ubuntu/pool/main/p/puppet/pupp... Size/MD5: 16108 228231bb7fafde0cd8555618017939ce http://security.ubuntu.com/ubuntu/pool/main/p/puppet/pupp... Size/MD5: 1517 22118d6cf21742ca62796a0957bee5f8 http://security.ubuntu.com/ubuntu/pool/main/p/puppet/pupp... Size/MD5: 1093533 db02f46288794225d54b36f89e2725a7 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/p/puppet/pupp... Size/MD5: 518402 b050c03fffa3df3dc31faa12b17f6aa2 http://security.ubuntu.com/ubuntu/pool/main/p/puppet/pupp... Size/MD5: 47806 5fb4e692c93a7388d34f6a284f4a5e92 http://security.ubuntu.com/ubuntu/pool/universe/p/puppet/... Size/MD5: 418926 5785eb3a1e0d6373f0d891f72afca170 -- ubuntu-security-announce mailing list ubuntu-security-announce@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security...