Your message dated Sat, 02 Apr 2005 21:17:36 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#301372: fixed in kernel-source-2.6.11 2.6.11-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 25 Mar 2005 12:37:20 +0000
>From [EMAIL PROTECTED] Fri Mar 25 04:37:20 2005
Return-path: <[EMAIL PROTECTED]>
Received: from inutil.org (vserver151.vserver151.serverflex.de)
[193.22.164.111]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DEo40-0005rI-00; Fri, 25 Mar 2005 04:37:20 -0800
Received: from p54894427.dip.t-dialin.net ([84.137.68.39]
helo=localhost.localdomain)
by vserver151.vserver151.serverflex.de with esmtpsa
(TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.44)
id 1DEo3y-0001kf-H0
for [EMAIL PROTECTED]; Fri, 25 Mar 2005 13:37:18 +0100
Received: from jmm by localhost.localdomain with local (Exim 4.50)
id 1DEo3u-0001sl-HX; Fri, 25 Mar 2005 13:37:14 +0100
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Moritz Muehlenhoff <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: kernel-source-2.6.8: [CAN-2005-0839] Insecure restriction of access to
the
N_MOUSE line disciple for TTYs
X-Mailer: reportbug 3.9
Date: Fri, 25 Mar 2005 13:37:14 +0100
Message-Id: <[EMAIL PROTECTED]>
X-SA-Exim-Connect-IP: 84.137.68.39
X-SA-Exim-Mail-From: [EMAIL PROTECTED]
X-SA-Exim-Scanned: No (on vserver151.vserver151.serverflex.de); SAEximRunCond
expanded to false
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: kernel-source-2.6.8
Version: 2.6.8-15
Severity: grave
Tags: security
Kernels before 2.6.11 do not properly restrict access to the N_MOUSE line
disciple for TTYs, which allows local users to inject mouse or keyboard
events into other's users sessions and possibly gain extended privileges.
A fix is referenced at
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0839 (I currently
don't have a mouse and typing Bitkeeper web URLs is too weird :-))
Cheers,
Moritz
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)
Versions of packages kernel-source-2.6.8 depends on:
ii binutils 2.15-5 The GNU assembler, linker and bina
ii bzip2 1.0.2-5 high-quality block-sorting file co
ii coreutils [fileutils] 5.2.1-2 The GNU core utilities
---------------------------------------
Received: (at 301372-close) by bugs.debian.org; 3 Apr 2005 02:30:35 +0000
>From [EMAIL PROTECTED] Sat Apr 02 18:30:35 2005
Return-path: <[EMAIL PROTECTED]>
Received: from gluck.debian.org [192.25.206.10]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DHusl-0005RX-00; Sat, 02 Apr 2005 18:30:35 -0800
Received: from newraff.debian.org [208.185.25.31] (mail)
by gluck.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1DHusk-0002uL-00; Sat, 02 Apr 2005 19:30:34 -0700
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1DHugC-0008LG-00; Sat, 02 Apr 2005 21:17:36 -0500
From: Andres Salomon <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#301372: fixed in kernel-source-2.6.11 2.6.11-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Sat, 02 Apr 2005 21:17:36 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 2
Source: kernel-source-2.6.11
Source-Version: 2.6.11-2
We believe that the bug you reported is fixed in the latest version of
kernel-source-2.6.11, which is due to be installed in the Debian FTP archive:
kernel-doc-2.6.11_2.6.11-2_all.deb
to pool/main/k/kernel-source-2.6.11/kernel-doc-2.6.11_2.6.11-2_all.deb
kernel-patch-debian-2.6.11_2.6.11-2_all.deb
to
pool/main/k/kernel-source-2.6.11/kernel-patch-debian-2.6.11_2.6.11-2_all.deb
kernel-source-2.6.11_2.6.11-2.diff.gz
to pool/main/k/kernel-source-2.6.11/kernel-source-2.6.11_2.6.11-2.diff.gz
kernel-source-2.6.11_2.6.11-2.dsc
to pool/main/k/kernel-source-2.6.11/kernel-source-2.6.11_2.6.11-2.dsc
kernel-source-2.6.11_2.6.11-2_all.deb
to pool/main/k/kernel-source-2.6.11/kernel-source-2.6.11_2.6.11-2_all.deb
kernel-tree-2.6.11_2.6.11-2_all.deb
to pool/main/k/kernel-source-2.6.11/kernel-tree-2.6.11_2.6.11-2_all.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Andres Salomon <[EMAIL PROTECTED]> (supplier of updated kernel-source-2.6.11
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sat, 02 Apr 2005 20:32:53 -0500
Source: kernel-source-2.6.11
Binary: kernel-source-2.6.11 kernel-patch-debian-2.6.11 kernel-tree-2.6.11
kernel-doc-2.6.11
Architecture: source all
Version: 2.6.11-2
Distribution: unstable
Urgency: low
Maintainer: Debian kernel team <debian-kernel@lists.debian.org>
Changed-By: Andres Salomon <[EMAIL PROTECTED]>
Description:
kernel-doc-2.6.11 - Linux kernel specific documentation for version 2.6.11
kernel-patch-debian-2.6.11 - Debian patches to Linux 2.6.11
kernel-source-2.6.11 - Linux kernel source for version 2.6.11 with Debian
patches
kernel-tree-2.6.11 - Linux kernel source tree for building Debian kernel images
Closes: 301372 301603 301613 301936 302252 302352
Changes:
kernel-source-2.6.11 (2.6.11-2) unstable; urgency=low
.
* Fix naming of NEWS.Debian (Andres Salomon) (closes: #301613).
.
* fs-asfs-2.patch (fs-asfs.patch removed):
Updated asfs patch (Sven Luther)
.
* powerpc-pmac-cache-power34-fix.patch:
[powerpc] do not build pmac_cache.S on power3/4, since it is not needed
and fails to build there (Sven Luther)
.
* drivers-input-serio-nmouse.patch:
[Security] fix N_MOUSE TTY privelage problem. See CAN-2005-0839
(Simon Horman) (closes: #301372)
.
* net-bluetooth-signdness-fix.patch:
[Security] Fix signedness problem at socket creation in bluetooth
which can lead to local root exploit. See CAN-2005-0750
(Simon Horman)
.
* fs-ext2-info-leak.patch:
[Security] Fix information leak in ext2 which leads to
a local information leak. See CAN-2005-0400
(Simon Horman)
.
* fs-isofs-range-check-1.patch, fs-isofs-range-check-2.patch,
fs-isofs-range-check-3.patch:
[Security] Fix range checking in isofs which leads to a local crash
and arbitary code execution. See CAN-2005-0815
(Simon Horman)
.
* fs-binfmt_elf-dos.patch:
Potential DOS in load_elf_library. See CAN-2005-0749
(Simon Horman)
.
* qla2xxx-removed.patch:
The qla2xxx was pruned from the source, however some stray Kconfig
and Makefile entries were left which caused build problems.
(closes: #301936, #301603) (Simon Horman)
.
* drivers-media-video-saa7134-update.patch
drivers-media-video-tuner-update-1.patch
drivers-media-video-tuner-update-2.patch
drivers-media-video-v4l-mpeg-support.patch
saa7134 update (closes: #302252) Simon Horman
N.B: This is a lot more extensive and not as self contained as
I had hoped. Might be better to back it out. But I will
leave it here for now.
* arch-ppc64-hugepage-aio-panic.patch:
fix AIO panic on PPC64 caused by is_hugepage_only_range().
See CAN-2005-0916. (Simon Horman) (closes: #302352)
.
* net-bluetooth-signdness-fix.patch, fs-ext2-info-leak.patch,
fs-isofs-range-check-1.patch, fs-isofs-range-check-2.patch,
fs-isofs-range-check-3.patch, fs-binfmt_elf-dos.patch:
Drop broken out 2.6.11.6 patches (Andres Salomon).
.
* Merge in 2.6.11.6; this includes:
o isofs: more defensive checks against corrupt isofs images
o Potential DOS in load_elf_library [CAN-2005-0749]
o isofs: Handle corupted rock-ridge info slightly better [CAN-2005-0815]
o isofs: more "corrupted iso image" error cases
o Fix signedness problem at socket creation [CAN-2005-0750]
o Suspected information leak (mem pages) in ext2 [CAN-2005-0400]
(Andres Salomon).
.
* drivers-media-video-saa7134-update-2.patch,
drivers-media-video-pll-lib.patch, drivers-media-video-mt352-update.patch,
drivers-media-video-pll-lib-2.patch:
Additional saa7134 fixes; allow building as a non-module, add pll
lib, etc (Andres Salomon).
Files:
7641fbebea126bfb9bfdb859a64f344e 997 devel optional
kernel-source-2.6.11_2.6.11-2.dsc
ef7968e7e1708b994ef7b2a70daba231 292546 devel optional
kernel-source-2.6.11_2.6.11-2.diff.gz
b5565126d6837a172dc45a59cc2860db 289074 devel optional
kernel-patch-debian-2.6.11_2.6.11-2_all.deb
69a4c8e08c6d483b967cc33139af91ea 36219476 devel optional
kernel-source-2.6.11_2.6.11-2_all.deb
c8c4098d74da6e3484ea884ec8dd0bcf 38650 devel optional
kernel-tree-2.6.11_2.6.11-2_all.deb
1303ce24f9efd01aab0164d27d2c30bb 6851786 doc optional
kernel-doc-2.6.11_2.6.11-2_all.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)
iD8DBQFCT08l78o9R9NraMQRAhJEAJsEAqvi7pYqkzY/sQp+VmXeIeIodACgyy6Z
lIxx2ELug6LD/sBTlRSltl8=
=DIsv
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
