-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1109-1 security@debian.org http://www.debian.org/security/ Moritz Muehlenhoff July 16th, 2006 http://www.debian.org/security/faq - -------------------------------------------------------------------------- Package : rssh Vulnerability : programming error Problem-Type : remote Debian-specific: no CVE ID : CVE-2006-1320 Debian Bug : 346322 Russ Allbery discovered that rssh, a restricted shell, performs insufficient checking of incoming commands, which might lead to a bypass of access restrictions. For the stable distribution (sarge) this problem has been fixed in version 2.2.3-1.sarge.2. For the unstable distribution (sid) this problem has been fixed in version 2.3.0-1.1. We recommend that you upgrade your rssh package. Upgrade Instructions - -------------------- wget url will fetch the file for you dpkg -i file.deb will install the referenced file. If you are using the apt-get package manager, use the line for sources.list as given below: apt-get update will update the internal database apt-get upgrade will install corrected packages You may use an automated update by adding the resources from the footer to the proper configuration. Debian GNU/Linux 3.1 alias sarge - -------------------------------- Source archives: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2.dsc Size/MD5 checksum: 589 a8ccbaa1d14d0aa30b3eb0bb1aefd4e5 http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2.diff.gz Size/MD5 checksum: 52207 00e3ad8c7944ed55e1316e414ab3d388 http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3.orig.tar.gz Size/MD5 checksum: 107216 74f40a4fd5d2b097af34a817e21a33cf Alpha architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_alpha.deb Size/MD5 checksum: 48782 0388514b947030f42219c9a615527dd9 AMD64 architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_amd64.deb Size/MD5 checksum: 44472 021a58e5c2591e2a15e4f1804816aa7b ARM architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_arm.deb Size/MD5 checksum: 41974 98eb40b5011e7868b02edfc07591f005 Intel IA-32 architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_i386.deb Size/MD5 checksum: 42596 7236c31d25f8b4cbbb8894112aa585aa Intel IA-64 architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_ia64.deb Size/MD5 checksum: 55530 9c61a904a78c4c6d93763cdb73f9c009 HP Precision architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_hppa.deb Size/MD5 checksum: 44098 334ae1019286051be323bf6994d51c99 Motorola 680x0 architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_m68k.deb Size/MD5 checksum: 41522 0efafd5a441d6d392d1a2490bfb2dcc4 Big endian MIPS architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_mips.deb Size/MD5 checksum: 49520 7126170731d1b5ad12d7afb6d68c16b7 Little endian MIPS architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_mipsel.deb Size/MD5 checksum: 49546 7d8859c87eeb09f3b2502cfbed3c3f66 PowerPC architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_powerpc.deb Size/MD5 checksum: 42936 f68184985e1ec6c27518ac74404afbec IBM S/390 architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_s390.deb Size/MD5 checksum: 42596 29243bae45e1dca2c07ca609617c0bfa Sun Sparc architecture: http://security.debian.org/pool/updates/main/r/rssh/rssh_2.2.3-1.sarge.2_sparc.deb Size/MD5 checksum: 42532 59db16aa282bc182f79418fdd99341c0 These files will probably be moved into the stable distribution on its next update. - --------------------------------------------------------------------------------- For apt-get: deb http://security.debian.org/ stable/updates main For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main Mailing list: debian-security-announce@lists.debian.org Package info: `apt-cache show ' and http://packages.debian.org/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) iD8DBQFEumB3Xm3vHE4uyloRAuQXAJ9koWyjXYOpZ1T4NsCLHQV7j0DXRgCglchW m9Kfb85HK9yepAe6ZOLwMzs= =7cKm -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/