LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: October 31st, 2014
Linux Security Week: October 27th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: 2010:122: fastjar Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake A vulnerability has been discovered and corrected in fastjar: Directory traversal vulnerability in the extract_jar function in jartool.c in FastJar 0.98 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in a non-initial [More...]
 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2010:122
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : fastjar
 Date    : June 22, 2010
 Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0
 _______________________________________________________________________

 Problem Description:

 A vulnerability has been discovered and corrected in fastjar:
 
 Directory traversal vulnerability in the extract_jar function
 in jartool.c in FastJar 0.98 allows remote attackers to create
 or overwrite arbitrary files via a .. (dot dot) in a non-initial
 pathname component in a filename within a .jar archive, a related
 issue to CVE-2005-1080.  NOTE: this vulnerability exists because of
 an incomplete fix for CVE-2006-3619 (CVE-2010-0831).
 
 Packages for 2008.0 and 2009.0 are provided as of the Extended
 Maintenance Program. Please visit this link to learn more:
 http://store.mandriva.com/product_info.php?cPath=149&products_id=490
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0831
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2008.0:
 29cfbaec7e6255eb665bc78192b65bd4  2008.0/i586/fastjar-0.95-1.1mdv2008.0.i586.rpm 
 14db3823db1af8e68f5f5691ca360a4f  2008.0/SRPMS/fastjar-0.95-1.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 6d30855f5164f15ada36fb6560d5e98d  2008.0/x86_64/fastjar-0.95-1.1mdv2008.0.x86_64.rpm 
 14db3823db1af8e68f5f5691ca360a4f  2008.0/SRPMS/fastjar-0.95-1.1mdv2008.0.src.rpm

 Mandriva Linux 2009.0:
 f77fefb84163a9c08ed43444464ca745  2009.0/i586/fastjar-0.95-3.1mdv2009.0.i586.rpm 
 cb1a7db7aa0df9f9cf4fec3c2a2e76f8  2009.0/SRPMS/fastjar-0.95-3.1mdv2009.0.src.rpm

 Mandriva Linux 2009.0/X86_64:
 a7ec5bded41e309a47f11e58b7ce4294  2009.0/x86_64/fastjar-0.95-3.1mdv2009.0.x86_64.rpm 
 cb1a7db7aa0df9f9cf4fec3c2a2e76f8  2009.0/SRPMS/fastjar-0.95-3.1mdv2009.0.src.rpm

 Mandriva Linux 2009.1:
 c2df3e75f81444460e5bef18bc537a0d  2009.1/i586/fastjar-0.97-1.1mdv2009.1.i586.rpm 
 ea0e50c4339801ef26b3731d381c43a8  2009.1/SRPMS/fastjar-0.97-1.1mdv2009.1.src.rpm

 Mandriva Linux 2009.1/X86_64:
 acbc81b4f44458db7b3d4e4936f2243d  2009.1/x86_64/fastjar-0.97-1.1mdv2009.1.x86_64.rpm 
 ea0e50c4339801ef26b3731d381c43a8  2009.1/SRPMS/fastjar-0.97-1.1mdv2009.1.src.rpm

 Mandriva Linux 2010.0:
 235889aecb0c352a7fa79a78db132635  2010.0/i586/fastjar-0.98-1.1mdv2010.0.i586.rpm 
 0319890b30ed72964f5061e8c668f868  2010.0/SRPMS/fastjar-0.98-1.1mdv2010.0.src.rpm

 Mandriva Linux 2010.0/X86_64:
 8d57e00fa9a90d9f99a80fda6ca93be0  2010.0/x86_64/fastjar-0.98-1.1mdv2010.0.x86_64.rpm 
 0319890b30ed72964f5061e8c668f868  2010.0/SRPMS/fastjar-0.98-1.1mdv2010.0.src.rpm

 Corporate 4.0:
 8ae0be32bc0c26d6a5b4b44b28a8be24  corporate/4.0/i586/gcc-4.0.1-5.4.20060mlcs4.i586.rpm
 79f01b28da32b36221815ecb9c6b0800  corporate/4.0/i586/gcc-c++-4.0.1-5.4.20060mlcs4.i586.rpm
 5d500cfca2c534a9c3dae5285b090921  corporate/4.0/i586/gcc-colorgcc-4.0.1-5.4.20060mlcs4.i586.rpm
 8a3db9618eee24158e715753ab85c87c  corporate/4.0/i586/gcc-cpp-4.0.1-5.4.20060mlcs4.i586.rpm
 e38e095b4a82f6f34185404dd4e24f9d  corporate/4.0/i586/gcc-doc-4.0.1-5.4.20060mlcs4.i586.rpm
 e29739a30fcf203f690809d4d5a1b7dc  corporate/4.0/i586/gcc-doc-pdf-4.0.1-5.4.20060mlcs4.i586.rpm
 a52b298e755784e350671213c048e347  corporate/4.0/i586/gcc-gfortran-4.0.1-5.4.20060mlcs4.i586.rpm
 739f22bac9eff8ff1ce925a35913ec4d  corporate/4.0/i586/gcc-gnat-4.0.1-5.4.20060mlcs4.i586.rpm
 5c6d85c2596ebe896599282d1246ac51  corporate/4.0/i586/gcc-java-4.0.1-5.4.20060mlcs4.i586.rpm
 c58741df491cbe7ec865aa8abfb223b8  corporate/4.0/i586/gcc-objc-4.0.1-5.4.20060mlcs4.i586.rpm
 b3b6f955e048d4c4484cb8abca5b024f  corporate/4.0/i586/gcj-tools-4.0.1-5.4.20060mlcs4.i586.rpm
 7481fccd210e1b05ee680d3b82b1958f  corporate/4.0/i586/libffi4-devel-4.0.1-5.4.20060mlcs4.i586.rpm
 6812a0c08289f467d9d7f87689193f50  corporate/4.0/i586/libgcc1-4.0.1-5.4.20060mlcs4.i586.rpm
 71ec24cb023ea717a873caca52094de7  corporate/4.0/i586/libgcj6-4.0.1-5.4.20060mlcs4.i586.rpm
 cba3e17bf4a6bb4db07e81530e61bbfe  corporate/4.0/i586/libgcj6-base-4.0.1-5.4.20060mlcs4.i586.rpm
 5d2ea3afb4f9ddb67702ccbf3eaf1dc8  corporate/4.0/i586/libgcj6-devel-4.0.1-5.4.20060mlcs4.i586.rpm
 90a2ddd64e638cebc99353e9ed1b9007  corporate/4.0/i586/libgcj6-src-4.0.1-5.4.20060mlcs4.i586.rpm
 e560796ba713a55d72ef46d50dc064a0  corporate/4.0/i586/libgcj6-static-devel-4.0.1-5.4.20060mlcs4.i586.rpm
 fcf35776137fe8b4f2bdd6105a887823  corporate/4.0/i586/libgfortran0-4.0.1-5.4.20060mlcs4.i586.rpm
 ab1cd67788ae4b69544a101f36f5a706  corporate/4.0/i586/libgnat1-4.0.1-5.4.20060mlcs4.i586.rpm
 fecffb2b88e2695a3b88d8f804f020bb  corporate/4.0/i586/libmudflap0-4.0.1-5.4.20060mlcs4.i586.rpm
 40307f8fa9f4e4ba74fd713279ebf76f  corporate/4.0/i586/libmudflap0-devel-4.0.1-5.4.20060mlcs4.i586.rpm
 c834d7ea558059c7c89e0b7d4aac2079  corporate/4.0/i586/libobjc1-4.0.1-5.4.20060mlcs4.i586.rpm
 c5120c50910e9008f2ae6723b5928caa  corporate/4.0/i586/libstdc++6-4.0.1-5.4.20060mlcs4.i586.rpm
 1ca5368024a7bc2a84ab3ed7cd90553a  corporate/4.0/i586/libstdc++6-devel-4.0.1-5.4.20060mlcs4.i586.rpm
 31bc41b0d17d3065f9987efcafb69dd6  corporate/4.0/i586/libstdc++6-static-devel-4.0.1-5.4.20060mlcs4.i586.rpm 
 f418034fdacecb6bc1b7726e56a447dc  corporate/4.0/SRPMS/gcc-4.0.1-5.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 63bfefa0e490a6aa08967adc3a06f925  corporate/4.0/x86_64/gcc-4.0.1-5.4.20060mlcs4.x86_64.rpm
 49eb12c3c36742dc0cb559b5c750b190  corporate/4.0/x86_64/gcc-c++-4.0.1-5.4.20060mlcs4.x86_64.rpm
 c6e9330378e6f1ec70a9354518c7db16  corporate/4.0/x86_64/gcc-colorgcc-4.0.1-5.4.20060mlcs4.x86_64.rpm
 2f8c1cee7fc98bf8f10d543e4c415708  corporate/4.0/x86_64/gcc-cpp-4.0.1-5.4.20060mlcs4.x86_64.rpm
 613fad43e7bb87461dd5bc68f8862038  corporate/4.0/x86_64/gcc-doc-4.0.1-5.4.20060mlcs4.x86_64.rpm
 0bab884d8bdb58c5b3be5496dab428f6  corporate/4.0/x86_64/gcc-doc-pdf-4.0.1-5.4.20060mlcs4.x86_64.rpm
 b69bfa9652946c2707475582c7406d18  corporate/4.0/x86_64/gcc-gfortran-4.0.1-5.4.20060mlcs4.x86_64.rpm
 3f6774d2585a2349661c6fb31c84ab41  corporate/4.0/x86_64/gcc-gnat-4.0.1-5.4.20060mlcs4.x86_64.rpm
 045915b26d3bb9add72f3dd1205418ca  corporate/4.0/x86_64/gcc-java-4.0.1-5.4.20060mlcs4.x86_64.rpm
 b3ca49d5474b61c30b8f5b6a9cbd3840  corporate/4.0/x86_64/gcc-objc-4.0.1-5.4.20060mlcs4.x86_64.rpm
 6514bab1ccc69984b0320c301b39fb50  corporate/4.0/x86_64/gcj-tools-4.0.1-5.4.20060mlcs4.x86_64.rpm
 3abd67ccf72a2bb6b288a6d633f1abf8  corporate/4.0/x86_64/lib64gcj6-4.0.1-5.4.20060mlcs4.x86_64.rpm
 6f7387060f5450d9a4123471b46ee85c  corporate/4.0/x86_64/lib64gcj6-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm
 291e1108c8649f3358f1a2e4fcc2951e  corporate/4.0/x86_64/lib64gcj6-static-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm
 99c3f5dd17599103b36192949d8bef4d  corporate/4.0/x86_64/libffi4-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm
 ee4e4b0d50d243eafb8ca330efb3fa76  corporate/4.0/x86_64/libgcc1-4.0.1-5.4.20060mlcs4.x86_64.rpm
 ed3fab0bb728e81ef2f05712fed3170a  corporate/4.0/x86_64/libgcj6-base-4.0.1-5.4.20060mlcs4.x86_64.rpm
 334fbf494c48521e2d1e6fd25dc04060  corporate/4.0/x86_64/libgcj6-src-4.0.1-5.4.20060mlcs4.x86_64.rpm
 5465686d44c49a4fdb66f12d86463b71  corporate/4.0/x86_64/libgfortran0-4.0.1-5.4.20060mlcs4.x86_64.rpm
 f5a6f8f05eeba6756d0d95392ff2df1b  corporate/4.0/x86_64/libgnat1-4.0.1-5.4.20060mlcs4.x86_64.rpm
 f463eb6f69b9a8476339d12d955d3999  corporate/4.0/x86_64/libmudflap0-4.0.1-5.4.20060mlcs4.x86_64.rpm
 571a27d904dc147513037de3d9750e5d  corporate/4.0/x86_64/libmudflap0-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm
 5d79033dd3213df96acdbc780d8ff749  corporate/4.0/x86_64/libobjc1-4.0.1-5.4.20060mlcs4.x86_64.rpm
 e3fc96bc5b4eb9eeae2abb434dc9cf32  corporate/4.0/x86_64/libstdc++6-4.0.1-5.4.20060mlcs4.x86_64.rpm
 895909a6655f11d782c14a1c482a2851  corporate/4.0/x86_64/libstdc++6-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm
 3148e7eb8d655ec4740d6bc3f2cef9b6  corporate/4.0/x86_64/libstdc++6-static-devel-4.0.1-5.4.20060mlcs4.x86_64.rpm 
 f418034fdacecb6bc1b7726e56a447dc  corporate/4.0/SRPMS/gcc-4.0.1-5.4.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Pirate Bay founder guilty in historic hacker case
Parallels CTO: Linux container security is not the problem
Advisory says to assume all Drupal 7 websites are compromised
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.