[Full-disclosure] [USN-843-1] BackupPC vulnerability

[Marc Deslauriers <marc.deslauriers@xxxxxxxxxxxxx>]

===========================================================
Ubuntu Security Notice USN-843-1           October 06, 2009
backuppc vulnerability
CVE-2009-3369
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 8.10
Ubuntu 9.04

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
  backuppc                        3.0.0-4ubuntu1.1

Ubuntu 8.10:
  backuppc                        3.1.0-3ubuntu2.1

Ubuntu 9.04:
  backuppc                        3.1.0-4ubuntu1.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that BackupPC did not restrict normal users from setting
the ClientNameAlias parameter. An authenticated user could exploit this to
gain access to unauthorized hosts. This update fixed the issue by
preventing normal users from modifying the ClientNameAlias configuration
parameter.


Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1.diff.gz
      Size/MD5:    21923 9900a0a3545140aa8dfa99c82325c2a6
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1.dsc
      Size/MD5:      725 b95b75a4b08f5d51b0cc498e3b11abd5
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0.orig.tar.gz
      Size/MD5:   432200 dc37728c1dc9225354523f279045f3f3

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.0.0-4ubuntu1.1_all.deb
      Size/MD5:   491322 b09233c28365bca07e7589cde9e70f29

Updated packages for Ubuntu 8.10:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1.diff.gz
      Size/MD5:    24091 e9caaf9693e4222226e523d383844cfd
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1.dsc
      Size/MD5:     1123 655eb9b56a61072ee29f5c12096c1cbb
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.orig.tar.gz
      Size/MD5:   474981 84b4471852ef910768eae9963ef932d2

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-3ubuntu2.1_all.deb
      Size/MD5:   537934 8ba6638c0e0c971db6c0b5a8635cd54e

Updated packages for Ubuntu 9.04:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1.diff.gz
      Size/MD5:    27074 395e09fdee61feb651812c68d447e1c7
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1.dsc
      Size/MD5:     1123 b71592b894e37a3e08a42f13b0884f2c
    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0.orig.tar.gz
      Size/MD5:   474981 84b4471852ef910768eae9963ef932d2

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/main/b/backuppc/backuppc_3.1.0-4ubuntu1.1_all.deb
      Size/MD5:   540222 b52db5cf3ec5b95fa34eeff76046e318

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/