Your message dated Thu, 18 Aug 2005 17:32:04 -0700
with message-id <[EMAIL PROTECTED]>
and subject line Bug#323365: fixed in bluez-utils 2.19-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 16 Aug 2005 09:35:30 +0000
>From [EMAIL PROTECTED] Tue Aug 16 02:35:30 2005
Return-path: <[EMAIL PROTECTED]>
Received: from (vserver151.vserver151.serverflex.de) [193.22.164.111]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1E4xr0-0001me-00; Tue, 16 Aug 2005 02:35:30 -0700
Received: from wlan-client-273.informatik.uni-bremen.de ([134.102.117.23]
helo=localhost.localdomain)
by vserver151.vserver151.serverflex.de with esmtpsa
(TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.50)
id 1E4xqw-0002EC-NR
for [EMAIL PROTECTED]; Tue, 16 Aug 2005 11:35:26 +0200
Received: from jmm by localhost.localdomain with local (Exim 4.52)
id 1E4xrL-00022Y-GP; Tue, 16 Aug 2005 11:35:51 +0200
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Moritz Muehlenhoff <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: bluez-utils: Arbitrary command execution through inproper escaping in
hcid's
security.c
X-Mailer: reportbug 3.15
Date: Tue, 16 Aug 2005 11:35:51 +0200
Message-Id: <[EMAIL PROTECTED]>
X-SA-Exim-Connect-IP: 134.102.117.23
X-SA-Exim-Mail-From: [EMAIL PROTECTED]
X-SA-Exim-Scanned: No (on vserver151.vserver151.serverflex.de); SAEximRunCond
expanded to false
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Package: bluez-utils
Severity: grave
Tags: security patch
Justification: user security hole
A vulnerability in hcid has been found. Please see this URL for details:
http://sourceforge.net/mailarchive/forum.php?thread_id=7893206&forum_id=1881
https://bugs.gentoo.org/show_bug.cgi?id=101557
Upstream fix available at:
http://cvs.sourceforge.net/viewcvs.py/bluez/utils/hcid/security.c?r1=1.31&r2=1.34
This is CAN-2005-2547.
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-rc5
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)
---------------------------------------
Received: (at 323365-close) by bugs.debian.org; 19 Aug 2005 00:49:50 +0000
>From [EMAIL PROTECTED] Thu Aug 18 17:49:50 2005
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1E5unk-00058p-00; Thu, 18 Aug 2005 17:32:04 -0700
From: Edd Dumbill <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.56 $
Subject: Bug#323365: fixed in bluez-utils 2.19-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Thu, 18 Aug 2005 17:32:04 -0700
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: bluez-utils
Source-Version: 2.19-1
We believe that the bug you reported is fixed in the latest version of
bluez-utils, which is due to be installed in the Debian FTP archive:
bluez-bcm203x_2.19-1_i386.deb
to pool/contrib/b/bluez-utils/bluez-bcm203x_2.19-1_i386.deb
bluez-cups_2.19-1_i386.deb
to pool/main/b/bluez-utils/bluez-cups_2.19-1_i386.deb
bluez-pcmcia-support_2.19-1_i386.deb
to pool/main/b/bluez-utils/bluez-pcmcia-support_2.19-1_i386.deb
bluez-utils_2.19-1.diff.gz
to pool/main/b/bluez-utils/bluez-utils_2.19-1.diff.gz
bluez-utils_2.19-1.dsc
to pool/main/b/bluez-utils/bluez-utils_2.19-1.dsc
bluez-utils_2.19-1_i386.deb
to pool/main/b/bluez-utils/bluez-utils_2.19-1_i386.deb
bluez-utils_2.19.orig.tar.gz
to pool/main/b/bluez-utils/bluez-utils_2.19.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Edd Dumbill <[EMAIL PROTECTED]> (supplier of updated bluez-utils package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Fri, 19 Aug 2005 01:12:02 +0100
Source: bluez-utils
Binary: bluez-pcmcia-support bluez-bcm203x bluez-cups bluez-utils
Architecture: source i386
Version: 2.19-1
Distribution: unstable
Urgency: high
Maintainer: Edd Dumbill <[EMAIL PROTECTED]>
Changed-By: Edd Dumbill <[EMAIL PROTECTED]>
Description:
bluez-bcm203x - Firmware loader for Broadcom 203x based Bluetooth devices
bluez-cups - Bluetooth printer driver for CUPS
bluez-pcmcia-support - PCMCIA support files for BlueZ 2.0 Bluetooth tools
bluez-utils - Bluetooth tools and daemons
Closes: 323365
Changes:
bluez-utils (2.19-1) unstable; urgency=high
.
* New upstream release.
* Urgency high as fixes hcid pin helper vulnerability (CAN-2005-2547)
(Closes: #323365)
* Bump libbluetooth1-dev build dependency to 2.19
* Add note about new features in debian/NEWS
Files:
52d0490621bdfd7c444a1eb2ea29bd43 710 admin optional bluez-utils_2.19-1.dsc
8f9fb314bbe0041c47bf34f1465dbed4 496241 admin optional
bluez-utils_2.19.orig.tar.gz
f8547aba5c219bffa04629efeaa26e51 21162 admin optional
bluez-utils_2.19-1.diff.gz
fafc315b9bed5de74adee00b7f6f0f76 163674 admin optional
bluez-utils_2.19-1_i386.deb
cd153ababcddde08189639d97e6ec4af 14846 admin extra
bluez-pcmcia-support_2.19-1_i386.deb
8b7c6b9d3be1b833e63675b47905970b 18726 admin optional
bluez-cups_2.19-1_i386.deb
8616faa3eaa8eedfa9a3476101fd80e8 17158 contrib/admin optional
bluez-bcm203x_2.19-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDBSaUrxbtsbubhxERAjuFAJ965cJ9E711/V4IU/94JfJ2QXFWcACgr+ff
OF1uGlAG5HeCYLyIIUqkthU=
=ZFLc
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
