Emanuele Gentili | emgent blog

emgent@emanuele-gentili:~$ history|awk ‘{a[$2]++ } END{for(i in a){print a[i] ” ” i}}’ |sort -rn|head
108 ls
97 vim
97 cd
27 sudo
20 bzr
18 rm
16 git
11 python
10 quilt
9 wget

Affected by security bug quite significant, lighttpd is still be vulnerable to Ubuntu repositories.

Lighttpd 1.4.19 and earlier allows remote attackers to cause a denial of service (active SSL connection loss) by triggering an SSL error, such as disconnecting before a download has finished, which causes all active SSL connections to be lost.

Vulnerable Version:

• Hardy (upgraded)
• Gutsy
• Feisty
• Edgy

CVE

• 2008-1531

Debdiffs:

• hardy_lighttpd_1.4.19-0ubuntu3.debdiff
• gutsy_security_lighttpd_1.4.18-1ubuntu1.4.debdiff
• feisty_security_lighttpd_1.4.13-9ubuntu4.6.debdiff
• edgy_security_lighttpd_1.4.13~r1370-1ubuntu1.7.debdiff

Upgrade by .deb packages:

• lighttpd_1.4.18-1ubuntu1.4~emgentsecurity0_i386.deb (Gutsy i386)
• lighttpd_1.4.18-1ubuntu1.4~emgentsecurity0_amd64.deb (Gutsy amd64)
• lighttpd_1.4.13-9ubuntu4.6~emgentsecurity0_i386.deb (Feisty i386)
• lighttpd_1.4.13-9ubuntu4.6~emgentsecurity0_amd64.deb (Feisty amd64)
• lighttpd_1.4.13~r1370-1ubuntu1.7~1emgentsecurity0_i386.deb (Edgy i386)
• lighttpd_1.4.13~r1370-1ubuntu1.7~1emgentsecurity0_amd64.deb (Edgy amd64)

Upgrade by Repository:

• Gutsy

deb http://ppa.launchpad.net/emgent/ubuntu gutsy main
deb-src http://ppa.launchpad.net/emgent/ubuntu gutsy main

apt-get update

apt-get upgrade

•  Feisty

deb http://ppa.launchpad.net/emgent/ubuntu feisty main
deb-src http://ppa.launchpad.net/emgent/ubuntu feisty main

 apt-get update

 apt-get upgrade

• Edgy

deb http://ppa.launchpad.net/emgent/ubuntu edgy main
deb-src http://ppa.launchpad.net/emgent/ubuntu edgy main

 apt-get update

 apt-get upgrade

Affected by security bug quite significant, horde3 is still be vulnerable to Ubuntu repositories.

Directory traversal vulnerability in Horde 3.1.6, Groupware before 1.0.5, and Groupware Webmail Edition before 1.0.6, when running with certain
configurations, allows remote authenticated users to read and execute arbitrary files via “..” sequences and a null byte in the theme name.
Fix directory traversal vulnerability in Registry.php which allows an attacker to read and execute arbitrary local files via crafted
path sequences.

Vulnerable Version:

• Hardy (upgraded)
• Gutsy
• Feisty
• Edgy
• Dapper

CVE

• 2008-1284

Debdiffs:

• gutsy_horde3_3.1.4-1ubuntu0.1.debdiff
• feisty_horde3_3.1.3-4ubuntu0.1.debdiff
• edgy_horde3_3.1.3-1ubuntu0.1.debdiff
• dapper_horde3_3.1.1-1ubuntu0.1.debdiff

Upgrade by .deb packages:

• horde3_3.1.4-1ubuntu0.1~emgentsecurity0_all.deb (Gutsy)
• horde3_3.1.3-4ubuntu0.1~emgentsecurity0_all.deb (Feisty)
• horde3_3.1.3-1ubuntu0.1~emgentsecurity0_all.deb (Edgy)
• horde3_3.1.1-1ubuntu0.1~emgentsecurity0_all.deb (Dapper)

Upgrade by Repository:

• Gutsy

deb http://ppa.launchpad.net/emgent/ubuntu gutsy main
deb-src http://ppa.launchpad.net/emgent/ubuntu gutsy main

 apt-get update

apt-get upgrade

•  Feisty

deb http://ppa.launchpad.net/emgent/ubuntu feisty main
deb-src http://ppa.launchpad.net/emgent/ubuntu feisty main

 apt-get update

 apt-get upgrade

• Edgy

deb http://ppa.launchpad.net/emgent/ubuntu edgy main
deb-src http://ppa.launchpad.net/emgent/ubuntu edgy main

 apt-get update

 apt-get upgrade

• Dapper

deb http://ppa.launchpad.net/emgent/ubuntu dapper main
deb-src http://ppa.launchpad.net/emgent/ubuntu dapper main

 apt-get update

 apt-get upgrade

Affected by security bug quite significant, lighttpd is still be vulnerable to Ubuntu repositories.

mod_userdir in lighttpd 1.4.18 and earlier, when userdir.path is not set, uses a default of $HOME, which might allow remote attackers to read arbitrary files, as demonstrated by accessing the ~nobody directory.

Hence a preview of the bug and my relative debdiff that will be placed in a circle in the mirror:

lighttpd

Vulnerable Version:

• Hardy
• Gutsy
• Feisty
• Edgy
• Dapper

CVE

• 2008-1270

Debdiff Relatives:

• hardy_lighttpd_1.4.18-1ubuntu6.debdiff (uploaded in hardy)
• gutsy_lighttpd_1.4.18-1ubuntu1.3.debdiff
• feisty_lighttpd_1.4.13-9ubuntu4.5.debdiff
• edgy_lighttpd_1.4.13~r1370-1ubuntu1.6.debdiff
• dapper_lighttpd_1.4.11-3ubuntu3.8.debdiff

Affected by security bug quite significant, VLC is still be vulnerable to Ubuntu repositories.

Hence a preview of the bug and my relative debdiff that will be placed in a circle in the mirror:

VLC

Vulnerable Version:

• Hardy
• Gutsy
• Feisty
• Edgy
• Dapper

CVE

• 2008-0984

Debdiff Relatives:

• hardy_vlc_0.8.6.release.d-0ubuntu3.1.debdiff
• gutsy_vlc_0.8.6.release.c-0ubuntu5.1.debdiff
• feisty_vlc_0.8.6.release-0ubuntu4.1.debdiff
• dapper_vlc_0.8.4.debian-1ubuntu6.2.debdiff

This is the first post in my ENGRISH blog