A new BackupPC vulnerability update is available for Ubuntu Linux. Here the announcement:
Ubuntu Security Notice USN-843-1 October 06, 2009
backuppc vulnerability
CVE-2009-3369
==========================
==========================
=========
A security issue affects the following Ubuntu releases:
Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 8.04 LTS:
backuppc 3.0.0-4ubuntu1.1
Ubuntu 8.10:
backuppc 3.1.0-3ubuntu2.1
Ubuntu 9.04:
backuppc 3.1.0-4ubuntu1.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that BackupPC did not restrict normal users from setting
the ClientNameAlias parameter. An authenticated user could exploit this to
gain access to unauthorized hosts. This update fixed the issue by
preventing normal users from modifying the ClientNameAlias configuration
parameter.
Updated packages for Ubuntu 8.04 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4=
ubuntu1.1.diff.gz
Size/MD5: 21923 9900a0a3545140aa8dfa99c82325c2a6
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4=
ubuntu1.1.dsc
Size/MD5: 725 b95b75a4b08f5d51b0cc498e3b11abd5
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0.o=
rig.tar.gz
Size/MD5: 432200 dc37728c1dc9225354523f279045f3f3
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4=
ubuntu1.1_all.deb
Size/MD5: 491322 b09233c28365bca07e7589cde9e70f29
Updated packages for Ubuntu 8.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3=
ubuntu2.1.diff.gz
Size/MD5: 24091 e9caaf9693e4222226e523d383844cfd
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3=
ubuntu2.1.dsc
Size/MD5: 1123 655eb9b56a61072ee29f5c12096c1cbb
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.o=
rig.tar.gz
Size/MD5: 474981 84b4471852ef910768eae9963ef932d2
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3=
ubuntu2.1_all.deb
Size/MD5: 537934 8ba6638c0e0c971db6c0b5a8635cd54e
Updated packages for Ubuntu 9.04:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4=
ubuntu1.1.diff.gz
Size/MD5: 27074 395e09fdee61feb651812c68d447e1c7
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4=
ubuntu1.1.dsc
Size/MD5: 1123 b71592b894e37a3e08a42f13b0884f2c
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.o=
rig.tar.gz
Size/MD5: 474981 84b4471852ef910768eae9963ef932d2
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4=
ubuntu1.1_all.deb
Size/MD5: 540222 b52db5cf3ec5b95fa34eeff76046e318
--=-rgYkdU7adWNhkssmATBv
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEABECAAYFAkrLfosACgkQLMAs/0C4zNq44gCgj9myxOYJhdmQj0JMmnEhxlCJ
39MAnjoGGn8MC3DEwuNGfTEG/WBdRnwy
=DgXn
-----END PGP SIGNATURE-----
