-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2011:102 http://www.mandriva.com/security/ _______________________________________________________________________ Package : rdesktop Date : May 28, 2011 Affected: 2009.0, 2010.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: A vulnerability has been identified and fixed in rdesktop: Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname (CVE-2011-1595). Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php\?cPath=149\&products_id=490 The updated packages have been patched to correct this issue. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1595 _______________________________________________________________________ Updated Packages: Mandriva Linux 2009.0: 918cfba3795494f163c9d6ee5729a500 2009.0/i586/rdesktop-1.6.0-4.1mdv2009.0.i586.rpm 4510e318899bc8e082c1d2425a669fd7 2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: d2822a3d35f810b358303524f5b8b59e 2009.0/x86_64/rdesktop-1.6.0-4.1mdv2009.0.x86_64.rpm 4510e318899bc8e082c1d2425a669fd7 2009.0/SRPMS/rdesktop-1.6.0-4.1mdv2009.0.src.rpm Mandriva Linux 2010.1: 4993b0be42653f8a24ea1b9e2cbfe02c 2010.1/i586/rdesktop-1.6.0-11.1mdv2010.2.i586.rpm 25e8f153a3cd642e9993cdabae897b62 2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm Mandriva Linux 2010.1/X86_64: c591e1214b1c5f92b7188b388c7cea16 2010.1/x86_64/rdesktop-1.6.0-11.1mdv2010.2.x86_64.rpm 25e8f153a3cd642e9993cdabae897b62 2010.1/SRPMS/rdesktop-1.6.0-11.1mdv2010.2.src.rpm Corporate 4.0: 440e2625f77de1c862bf4babf1f6e8ba corporate/4.0/i586/rdesktop-1.4.1-1.2.20060mlcs4.i586.rpm 3771560586bffcfe6fa7a833127c5068 corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm Corporate 4.0/X86_64: 301f64a655c16678069e43c7d999e6fa corporate/4.0/x86_64/rdesktop-1.4.1-1.2.20060mlcs4.x86_64.rpm 3771560586bffcfe6fa7a833127c5068 corporate/4.0/SRPMS/rdesktop-1.4.1-1.2.20060mlcs4.src.rpm Mandriva Enterprise Server 5: c2f395818fad39c475aadc8884ce664e mes5/i586/rdesktop-1.6.0-4.1mdvmes5.2.i586.rpm 85f0ac66db03e44f2bf03434786cda8e mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm Mandriva Enterprise Server 5/X86_64: bfdfb7a5e8818e6f7a250b849dc1f45e mes5/x86_64/rdesktop-1.6.0-4.1mdvmes5.2.x86_64.rpm 85f0ac66db03e44f2bf03434786cda8e mes5/SRPMS/rdesktop-1.6.0-4.1mdvmes5.2.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFN4OWImqjQ0CJFipgRArj2AKDIaAayNWXXIbLGYPY9/n4zPYFc3gCgj9WT 5TEdWZTfsdYs7XBjHGSKfAk= =Gffu -----END PGP SIGNATURE-----
