Mageia alert MGASA-2012-0321 (bacula)
| From: | Mageia Updates <buildsystem-daemon@mageia.org> | |
| To: | updates-announce@ml.mageia.org | |
| Subject: | [updates-announce] MGASA-2012-0321: bacula-5.0.3-2.1.mga1 (1/core), bacula-5.0.3-3.1.mga2 (2/core) | |
| Date: | Tue, 6 Nov 2012 20:22:00 +0100 | |
| Message-ID: | <20121106192200.GA8638@valstar.mageia.org> |
MGASA-2012-0321 Date: November 6th, 2012 Affected releases: 1, 2 Description: Updated bacula packages fix security vulnerabilities: Some of the mtx-changer example autochangers in bacula before 5.2.1 could allow local users to overwrite any local file via a symlink attack, due to insecure temp file naming (CVE-2008-5373). An information leak flaw was found in the way Bacula before 5.2.11 enforced access control list (ACL) rules prior providing information about a particular resource. A remote attacker could use this flaw to obtain (possibly sensitive) information (CVE-2012-4430). Additionally, two other security-related fixes from upstream have been included. One is a fix for a possible fnmatch problem, and the other adds rate limiting of bad connections. Updated Packages: Mageia 1: bacula-bat-5.0.3-2.1.mga1 bacula-common-5.0.3-2.1.mga1 bacula-console-5.0.3-2.1.mga1 bacula-console-wx-5.0.3-2.1.mga1 bacula-dir-common-5.0.3-2.1.mga1 bacula-dir-mysql-5.0.3-2.1.mga1 bacula-dir-pgsql-5.0.3-2.1.mga1 bacula-dir-sqlite3-5.0.3-2.1.mga1 bacula-fd-5.0.3-2.1.mga1 bacula-gui-bimagemgr-5.0.3-2.1.mga1 bacula-gui-brestore-5.0.3-2.1.mga1 bacula-gui-web-5.0.3-2.1.mga1 bacula-sd-5.0.3-2.1.mga1 bacula-tray-monitor-5.0.3-2.1.mga1 lib(64)bacula-5.0.3-2.1.mga1 Mageia 2: bacula-bat-5.0.3-3.1.mga2 bacula-common-5.0.3-3.1.mga2 bacula-console-5.0.3-3.1.mga2 bacula-console-wx-5.0.3-3.1.mga2 bacula-dir-common-5.0.3-3.1.mga2 bacula-dir-mysql-5.0.3-3.1.mga2 bacula-dir-pgsql-5.0.3-3.1.mga2 bacula-dir-sqlite3-5.0.3-3.1.mga2 bacula-fd-5.0.3-3.1.mga2 bacula-gui-bimagemgr-5.0.3-3.1.mga2 bacula-gui-brestore-5.0.3-3.1.mga2 bacula-gui-web-5.0.3-3.1.mga2 bacula-sd-5.0.3-3.1.mga2 bacula-tray-monitor-5.0.3-3.1.mga2 lib(64)bacula-5.0.3-3.1.mga2 References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5373 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4430 http://www.bacula.org/git/cgit.cgi/bacula/tree/bacula/Rel... http://www.bacula.org/git/cgit.cgi/bacula/tree/bacula/Cha... http://lists.fedoraproject.org/pipermail/package-announce... https://bugzilla.redhat.com/show_bug.cgi?id=857955 http://www.debian.org/security/2012/dsa-2558 https://bugs.mageia.org/show_bug.cgi?id=7470 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-...