Debian Lintian Multiple Local Vulnerabilities

Bugtraq ID:	37975
Class:	Unknown
CVE:	CVE-2009-4013 CVE-2009-4014 CVE-2009-4015
Remote:	No
Local:	Yes
Published:	Jan 27 2010 12:00AM
Updated:	Jan 28 2010 08:51AM
Credit:	Debian
Vulnerable:	Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Debian lintian 0
Not Vulnerable:

Debian Lintian Multiple Local Vulnerabilities

Debian Lintian is prone to multiple local vulnerabilities:

- Multiple directory-traversal vulnerabilities
- Multiple format-string vulnerabilities
- An arbitrary-command-execution vulnerability

Local attackers can exploit these issues to execute arbitrary code and commands with elevated privileges and obtain sensitive information. Other attacks are also possible.

Debian Lintian Multiple Local Vulnerabilities

To exploit these issues, an attacker can use readily available command-line utilities.

Debian Lintian Multiple Local Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 9.10 sparc

• Ubuntu lintian_2.2.17ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.17ub untu1.1_all.deb

Debian Linux 4.0 arm

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 5.0 ia-64

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu lintian_1.23.46ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.46u buntu0.1_all.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu lintian_1.24.3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.24.3ub untu0.1_all.deb

Debian Linux 4.0 powerpc

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu lintian_1.23.46ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.46u buntu0.1_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu lintian_1.24.3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.24.3ub untu0.1_all.deb

Debian Linux 4.0 m68k

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 9.10 powerpc

• Ubuntu lintian_2.2.17ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.17ub untu1.1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu lintian_1.23.16ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.16u buntu2.1_all.deb

Debian Linux 5.0 alpha

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 5.0 ia-32

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu lintian_1.23.16ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.16u buntu2.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu lintian_1.23.46ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.46u buntu0.1_all.deb

Debian Linux 5.0 s/390

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 9.10 lpia

• Ubuntu lintian_2.2.17ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.17ub untu1.1_all.deb

Debian Linux 5.0 mipsel

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu lintian_2.2.5ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.5ubu ntu1.1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu lintian_1.23.46ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.46u buntu0.1_all.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu lintian_2.2.5ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.5ubu ntu1.1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu lintian_1.23.16ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.16u buntu2.1_all.deb

Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu lintian_1.24.3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.24.3ub untu0.1_all.deb

Debian Linux 4.0 amd64

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS amd64

• Ubuntu lintian_1.23.16ubuntu2.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.16u buntu2.1_all.deb

Debian Linux 4.0 ia-32

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 5.0 hppa

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 4.0 hppa

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu lintian_2.2.5ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.5ubu ntu1.1_all.deb

Debian Linux 4.0 sparc

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 4.0 s/390

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu lintian_2.2.5ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.5ubu ntu1.1_all.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu lintian_1.24.3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.24.3ub untu0.1_all.deb

Debian Linux 5.0 m68k

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 9.10 i386

• Ubuntu lintian_2.2.17ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.17ub untu1.1_all.deb

Debian Linux 5.0 arm

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 4.0 alpha

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 4.0 armel

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 5.0 armel

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 5.0

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 9.10 amd64

• Ubuntu lintian_2.2.17ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.17ub untu1.1_all.deb

Debian Linux 4.0

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu lintian_1.23.46ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.23.46u buntu0.1_all.deb

Debian Linux 4.0 mipsel

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 5.0 amd64

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 5.0 mips

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu lintian_2.2.5ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_2.2.5ubu ntu1.1_all.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu lintian_1.24.3ubuntu0.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/main/l/lintian/lintian_1.24.3ub untu0.1_all.deb

Debian Linux 5.0 powerpc

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Linux 4.0 ia-64

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 4.0 mips

• Debian lintian_1.23.28+etch1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.23.28 +etch1_all.deb

Debian Linux 5.0 sparc

• Debian lintian_1.24.2.1+lenny1_all.deb
  http://security.debian.org/pool/updates/main/l/lintian/lintian_1.24.2. 1+lenny1_all.deb

Debian Lintian Multiple Local Vulnerabilities

References:

• Lintian Homepage (Debian)