Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] [Fwd: [SECURITY] [DSA 159-2] New Python packages fix problem introduced by security fix]

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: "Eric Sandall" <eric AT sandall.us>
  • To: " Source Mage Discuss" <sm-discuss AT lists.ibiblio.org>, " Source Mage Grimoire" <sm-grimoire AT lists.ibiblio.org>
  • Subject: [SM-Discuss] [Fwd: [SECURITY] [DSA 159-2] New Python packages fix problem introduced by security fix]
  • Date: Mon, 9 Sep 2002 16:37:28 -0700 (PDT)

Just FYI...

-------- Original Message --------
Subject: [SECURITY] [DSA 159-2] New Python packages fix problem introduced
by security fix
From: joey AT infodrom.org (Martin Schulze)
Date: Mon, September 9, 2002 8:31
To: debian-security-announce AT lists.debian.org (Debian Security Announcements)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

-
--------------------------------------------------------------------------
Debian Security Advisory DSA 159-2
security AT debian.org http://www.debian.org/security/
Martin Schulze September 9th, 2002
http://www.debian.org/security/faq -
--------------------------------------------------------------------------

Package : python
Vulnerability : insecure temporary files
Problem-Type : local
Debian-specific: no
BugTraq ID : 5581

[The mail just sent was formatted like an attachment due to a
misconception on my side. This mail is only the clearsign version. ]

The bugfix we distributed in DSA 159-1 unfortunately caused Python to
sometimes behave improperly when a non-executable file existed earlier
in the path and an executable file of the same name existed later in the
path. Zack Weinberg fixed this in the Python source. For
reference, here's the original advisory text:

Zack Weinberg discovered an insecure use of a temporary file in
os._execvpe from os.py. It uses a predictable name which could lead
execution of arbitrary code.

This problem has been fixed in several versions of Python: For the
current stable distribution (woody) it has been fixed in version
1.5.2-23.2 of Python 1.5, in version 2.1.3-3.2 of Python 2.1 and in
version 2.2.1-4.2 of Python 2.2. For the old stable distribution
(potato) this has been fixed in version 1.5.2-10potato13 for Python 1.5.
For the unstable distribution (sid) this has been fixed in
version 1.5.2-25 of Python 1.5, in version 2.1.3-9 of Python 2.1 and in
version 2.2.1-11 of Python 2.2. Python 2.3 is not affected by the
original problem.

We recommend that you upgrade your Python packages.


wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 2.2 alias potato
- --------------------------------

Source archives:


http://security.debian.org/pool/updates/main/p/python/python_1.5.2-10potato13.dsc
Size/MD5 checksum: 814 15658c9064507f46d3074af59f7ad218

http://security.debian.org/pool/updates/main/p/python/python_1.5.2-10potato13.diff.gz
Size/MD5 checksum: 85640 bd7d68152dfc35ea8d6b6e30a143a696

http://security.debian.org/pool/updates/main/p/python/python_1.5.2.orig.tar.gz
Size/MD5 checksum: 2533053 e9d677ae6d5a3efc6937627ed8a3e752

Alpha architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_alpha.deb
Size/MD5 checksum: 928808 add635f90434d2021887c36707a2f10c

ARM architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_arm.deb
Size/MD5 checksum: 849298 f9cd68bfaa75b08e0462055c103c53fd

Intel IA-32 architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_i386.deb
Size/MD5 checksum: 825292 3fd77f5f0f90ee904908c3af612b9268

Motorola 680x0 architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_m68k.deb
Size/MD5 checksum: 837688 680297f46cc3ef0214206ece9fd24167

PowerPC architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_powerpc.deb
Size/MD5 checksum: 872488 3b4d05433f2ad9e5b0182ade9edc24e5

Sun Sparc architecture:


http://security.debian.org/pool/updates/main/p/python/python-base_1.5.2-10potato13_sparc.deb
Size/MD5 checksum: 854848 f6760252303686618726f6af12287eb6


Debian GNU/Linux 3.0 alias woody
- --------------------------------

Source archives:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2.dsc
Size/MD5 checksum: 916 aa7b63a8384f37ce644d9bbc2c594a93

http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2.diff.gz
Size/MD5 checksum: 147675 77e1702b4eaf9fde2316dface2bfb118

http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2.orig.tar.gz
Size/MD5 checksum: 2533570 d9ade0d7613466e0353561d277ff02fe

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2.dsc
Size/MD5 checksum: 1283 9cf0222820b3730f885833949ee2752c

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2.diff.gz
Size/MD5 checksum: 70289 23bd09269b47d0c55815d738870f9f26

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3.orig.tar.gz
Size/MD5 checksum: 6194246 1ae739aa5824de263923df3516eeaf80

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2.dsc
Size/MD5 checksum: 1150 a4f837cbefd09fa2fb27b799811aacb1

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2.diff.gz
Size/MD5 checksum: 91722 d3ede617d5b8ddb4dd81e7735640000a

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1.orig.tar.gz
Size/MD5 checksum: 6536167 88aa07574673ccfaf35904253c78fc7d

Alpha architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_alpha.deb
Size/MD5 checksum: 993478 b9b7799ff765a425926b2c56de13443c

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_alpha.deb
Size/MD5 checksum: 1804304 663466bd39741650c3dd9a49ca89d59a

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_alpha.deb
Size/MD5 checksum: 2139238 6b967a140b2a51d442cfb84891300414

ARM architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_arm.deb
Size/MD5 checksum: 893374 f0c4f0f1c13146b226c9192aaa59e62b

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_arm.deb
Size/MD5 checksum: 1646606 4ad1516f1afae6f106c0c40a37d6fcdf

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_arm.deb
Size/MD5 checksum: 1952210 6c191ffb5b2d77c52c2cadbd20d1298c

Intel IA-32 architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_i386.deb
Size/MD5 checksum: 865938 d3cf0730cc2529807ce59e68395e6396

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_i386.deb
Size/MD5 checksum: 1592166 059df3cfa844b25d292fdf9c1808c8d4

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_i386.deb
Size/MD5 checksum: 1888508 179880aa560f0b9ecf45cca8c57eb451

Intel IA-64 architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_ia64.deb
Size/MD5 checksum: 1123834 0fe1e81eaeb6e51d73c4c86531c5c5f0

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_ia64.deb
Size/MD5 checksum: 2080790 88d771d8ea3f9289ea5b552ea9a01a99

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_ia64.deb
Size/MD5 checksum: 2489548 5d6abd03f4716986bd0ce4599a261297

HP Precision architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_hppa.deb
Size/MD5 checksum: 983286 c4b39bb69d263d95832c2eb9cd34d11d

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_hppa.deb
Size/MD5 checksum: 1832650 bda1279f0bdb2056c30afe9913415bbf

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_hppa.deb
Size/MD5 checksum: 2356192 64fbb9fd51ea7f53e80ff32e11e89b80

Motorola 680x0 architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_m68k.deb
Size/MD5 checksum: 880196 a61ba2de8d3056c252de513cf7b5d8ea

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_m68k.deb
Size/MD5 checksum: 1608796 da4e546766c589378e6117778ff9056a

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_m68k.deb
Size/MD5 checksum: 1894026 0ba9078d8e655ac3e2cb06b3c4761103

Big endian MIPS architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_mips.deb
Size/MD5 checksum: 893284 f02223e7008b0395edad33a78ae030ac

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_mips.deb
Size/MD5 checksum: 1661254 2bf07b8f8aa5383873128029cb1a1d12

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_mips.deb
Size/MD5 checksum: 1952322 142f9fe7a1d68b076a44f70d003ba677

Little endian MIPS architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_mipsel.deb
Size/MD5 checksum: 890812 ab02be8c8dac1dadafa0ad85a1e2d627

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_mipsel.deb
Size/MD5 checksum: 1657988 f05738ac39f731c38ae19b7223603e08

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_mipsel.deb
Size/MD5 checksum: 1947426 ccce0e16862734b23adc9bd4550c31fe

PowerPC architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_powerpc.deb
Size/MD5 checksum: 913446 9a540b7ded9fbae1402f5afe14f359fc

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_powerpc.deb
Size/MD5 checksum: 1681254 314a5cf6599d88bce41c331ebe945059

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_powerpc.deb
Size/MD5 checksum: 1998856 11416c5e75b762bd33085d8966b9a126

IBM S/390 architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_s390.deb
Size/MD5 checksum: 897150 7ffb4636cf3aa63060b107b2b21c2e31

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_s390.deb
Size/MD5 checksum: 1647976 e3ae48fcfc0e8960a3f78ba3b30e0a6c

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_s390.deb
Size/MD5 checksum: 1929358 05fe107035d278bbc4ba84f0503449d1

Sun Sparc architecture:


http://security.debian.org/pool/updates/main/p/python1.5/python1.5_1.5.2-23.2_sparc.deb
Size/MD5 checksum: 963064 6e271de84f9631e9994ae94b5f37e8a3

http://security.debian.org/pool/updates/main/p/python2.1/python2.1_2.1.3-3.2_sparc.deb
Size/MD5 checksum: 1730934 b0b2279b6b86fe9dc9372934accc6f86

http://security.debian.org/pool/updates/main/p/python2.2/python2.2_2.2.1-4.2_sparc.deb
Size/MD5 checksum: 2036598 4c96e6318184cf954299e5c7f7a8ba4b


Please note that all python source packages produce more binary
packages than the ones listed above. They are not relevant for the
fixed problems, though.

These files will probably be moved into the stable distribution on its
next revision.

-
---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main Mailing list:
debian-security-announce AT lists.debian.org
Package info: `apt-cache show <pkg>' and
http://packages.debian.org/<pkg>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQE9fL7bW5ql+IAeqTIRArsdAJ9/fnpXoqvOPPjvIBTOrzLYi5gvZgCfY+mf
XgSlnEIwGp4jaXLdVQY5VyE=
=iK9B
-----END PGP SIGNATURE-----


--
To UNSUBSCRIBE, email to
debian-security-announce-request AT lists.debian.org with a subject of
"unsubscribe". Trouble? Contact listmaster AT lists.debian.org


--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org
http://www.sandall.us/~sandalle | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org #196285 | http://www.shock.wsu.edu/






Archive powered by MHonArc 2.6.24.

Top of Page