[USN-739-1] Amarok vulnerabilities

Marc Deslauriers marc.deslauriers at canonical.com
Tue Mar 17 17:29:25 UTC 2009 

===========================================================
Ubuntu Security Notice USN-739-1             March 17, 2009
amarok vulnerabilities
CVE-2009-0135, CVE-2009-0136
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 7.10
Ubuntu 8.04 LTS
Ubuntu 8.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 7.10:
  amarok                          2:1.4.7-0ubuntu3.2

Ubuntu 8.04 LTS:
  amarok                          2:1.4.9.1-0ubuntu3.2

Ubuntu 8.10:
  amarok                          2:1.4.10-0ubuntu3.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that Amarok did not correctly handle certain malformed
tags in Audible Audio (.aa) files. If a user were tricked into opening a
crafted Audible Audio file, an attacker could execute arbitrary code with
the privileges of the user invoking the program.


Updated packages for Ubuntu 7.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2.diff.gz
      Size/MD5:   257112 c9e74edffcb691c16e1128aa887c1bfd
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2.dsc
      Size/MD5:     1066 e0d1dd2ce612be33f143bdaac11e3959
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7.orig.tar.gz
      Size/MD5: 16103569 74cd355c6d4838695a8d5b914a5b7d77

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.7-0ubuntu3.2_amd64.deb
      Size/MD5:    62660 f88ae4c42572936a5ea969f42535b0b9
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2_amd64.deb
      Size/MD5: 10060154 e93c8ffb9db8004cbd1d702cadaaec28
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.7-0ubuntu3.2_amd64.deb
      Size/MD5:      880 3bd14c1eed61be2a4992f3282bc6b0a4

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.7-0ubuntu3.2_i386.deb
      Size/MD5:    56632 ebf26ee4dd076e54782cf276a3cc888c
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2_i386.deb
      Size/MD5:  9848998 b22ddae4b1ef24a58c42a65a0cb17c49
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.7-0ubuntu3.2_i386.deb
      Size/MD5:      882 037d4a5a94a88f3f09a25c0e7de86baf

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-xine_1.4.7-0ubuntu3.2_lpia.deb
      Size/MD5:    56376 d22b49f1bd640bed50d86ce8b630515b
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2_lpia.deb
      Size/MD5:  9840226 4bc0d7e4e7e0791d2af94e53f106a9c2
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engines_1.4.7-0ubuntu3.2_lpia.deb
      Size/MD5:      880 7a48684acb8056df94e9ae04dbcb18e8

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.7-0ubuntu3.2_powerpc.deb
      Size/MD5:    62376 ba074f1110dc982df3a0d89321407dfc
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2_powerpc.deb
      Size/MD5: 10058400 40ebc6949db67a6d169f03400e73f0bb
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.7-0ubuntu3.2_powerpc.deb
      Size/MD5:      884 17d6eb924c7960391e9192e92c7715f3

  sparc architecture (Sun SPARC/UltraSPARC):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.7-0ubuntu3.2_sparc.deb
      Size/MD5:    56966 54091e39c8cf0bc1d15335bfd760730a
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.7-0ubuntu3.2_sparc.deb
      Size/MD5:  9941278 7549394f977da613ced46cb06569c970
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.7-0ubuntu3.2_sparc.deb
      Size/MD5:      882 b07d32a7a9b65eba984692ff89281361

Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2.diff.gz
      Size/MD5:    35541 ae027294b9ecd0cfef274bd7821e55d8
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2.dsc
      Size/MD5:     1236 963e00d25ce78cea1cb687653382ffac
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.9.1.orig.tar.gz
      Size/MD5: 16055681 a4365f559f0d42a0a09c3e9a17f9a140

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.9.1-0ubuntu3.2_amd64.deb
      Size/MD5:    61972 e22ebf1259d6efc8df04a63c5f1f239b
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2_amd64.deb
      Size/MD5:  9852912 749c0955241f580f604ec3cf737e29ba
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.9.1-0ubuntu3.2_amd64.deb
      Size/MD5:      892 8935cf386c89808423b31a971b8ba8f5

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-xine_1.4.9.1-0ubuntu3.2_i386.deb
      Size/MD5:    55162 a708e7f15c28a78dbde8b0760a3c51e9
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2_i386.deb
      Size/MD5:  9613228 7ad352acc25cb075a86a712b9dc9cde7
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.9.1-0ubuntu3.2_i386.deb
      Size/MD5:      894 327a4fab283176840a5c19c20da82a60

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-xine_1.4.9.1-0ubuntu3.2_lpia.deb
      Size/MD5:    55434 7e3ec4dd258b53d229e2a62f10f24ee0
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2_lpia.deb
      Size/MD5:  9634246 00939b00ed248dcb20ba48cb0f7d4e85
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engines_1.4.9.1-0ubuntu3.2_lpia.deb
      Size/MD5:      892 08de17b51f8dc7e1718a538354793d96

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-xine_1.4.9.1-0ubuntu3.2_powerpc.deb
      Size/MD5:    60480 78a345b9355403c9e15fc40b2060729a
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2_powerpc.deb
      Size/MD5:  9814058 c455622225259b65b52190de1ac2f411
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engines_1.4.9.1-0ubuntu3.2_powerpc.deb
      Size/MD5:      894 21fee2e334c017d67035c1a855a76232

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-xine_1.4.9.1-0ubuntu3.2_sparc.deb
      Size/MD5:    55462 b7b35cb1a49407c5b1744e75be35be96
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.9.1-0ubuntu3.2_sparc.deb
      Size/MD5:  9703894 cbbc84b5f72149a1e6b77e2a3767b32a
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engines_1.4.9.1-0ubuntu3.2_sparc.deb
      Size/MD5:      894 ec9b2171cfa95bb7d5f5eb00234a29c7

Updated packages for Ubuntu 8.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1.diff.gz
      Size/MD5:   122128 dfa7f91f4b47877f2ae0ad628cd1cb34
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1.dsc
      Size/MD5:     1692 85e473b48ec7618853a7ef4ec9f676f3
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.10.orig.tar.gz
      Size/MD5: 16207150 3d0670537b74e929909aa9fa5dc98ccf

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-common_1.4.10-0ubuntu3.1_all.deb
      Size/MD5:  7189098 14810af1ad0beaceaa6d4ffdef262303
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engines_1.4.10-0ubuntu3.1_all.deb
      Size/MD5:    20876 5e4197198c821aa5ba7b4bf4aa880c48

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-dbg_1.4.10-0ubuntu3.1_amd64.deb
      Size/MD5: 11263374 3cd56f5c0137f627c7a1b6cf4da65b8f
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-engine-xine_1.4.10-0ubuntu3.1_amd64.deb
      Size/MD5:    77300 ec981ba68cfd40da2c0d1bcc732bb6ad
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1_amd64.deb
      Size/MD5:  2555918 aa8ca60da603dde4ad17abf9a3f9413c
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engine-yauap_1.4.10-0ubuntu3.1_amd64.deb
      Size/MD5:    44786 19864173750f5e0cfecb9cd0e5ecb93c

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-dbg_1.4.10-0ubuntu3.1_i386.deb
      Size/MD5: 11214674 209fb4b55cccb46924b49aa311cd7fd2
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok-engine-xine_1.4.10-0ubuntu3.1_i386.deb
      Size/MD5:    73120 ac2195787b0f20e49f0f2c4600af8e0a
    http://security.ubuntu.com/ubuntu/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1_i386.deb
      Size/MD5:  2455166 10a4d45271de505b27335b03e63e65e7
    http://security.ubuntu.com/ubuntu/pool/universe/a/amarok/amarok-engine-yauap_1.4.10-0ubuntu3.1_i386.deb
      Size/MD5:    42068 27fda4967f148fae1cc9368c2a864580

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-dbg_1.4.10-0ubuntu3.1_lpia.deb
      Size/MD5: 11001132 58d91d53551248da242004538f8cf4e1
    http://ports.ubuntu.com/pool/main/a/amarok/amarok-engine-xine_1.4.10-0ubuntu3.1_lpia.deb
      Size/MD5:    72996 700366415eb1979682355bf3321116eb
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1_lpia.deb
      Size/MD5:  2466854 1e8371a2ecd057dd132b734dd90123ae
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engine-yauap_1.4.10-0ubuntu3.1_lpia.deb
      Size/MD5:    42324 46e91ba8d21b8a07bb55908baa31ff36

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-dbg_1.4.10-0ubuntu3.1_powerpc.deb
      Size/MD5: 11630608 f396b5277dae7a48eb99f96d0286f5ef
    http://ports.ubuntu.com/pool/main/a/amarok/amarok-engine-xine_1.4.10-0ubuntu3.1_powerpc.deb
      Size/MD5:    77218 14a66ad0995715007e05ae0c4391ee36
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1_powerpc.deb
      Size/MD5:  2553480 8b214c82fd0facc88be1784c4cf72c0c
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engine-yauap_1.4.10-0ubuntu3.1_powerpc.deb
      Size/MD5:    46030 fcdb0545bd8a26124a2bb70604e3ac18

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/a/amarok/amarok-dbg_1.4.10-0ubuntu3.1_sparc.deb
      Size/MD5: 11005590 628b0d7d4425387d5aaf37a3ea983964
    http://ports.ubuntu.com/pool/main/a/amarok/amarok-engine-xine_1.4.10-0ubuntu3.1_sparc.deb
      Size/MD5:    72268 c8b1b20037f189d7237cbdad98756147
    http://ports.ubuntu.com/pool/main/a/amarok/amarok_1.4.10-0ubuntu3.1_sparc.deb
      Size/MD5:  2398662 ee7c646f35ddc367817de4e0922a36d7
    http://ports.ubuntu.com/pool/universe/a/amarok/amarok-engine-yauap_1.4.10-0ubuntu3.1_sparc.deb
      Size/MD5:    41892 f5579da5c9e5da9a312dd61e13d1d6e2


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20090317/cb4aa89c/attachment.sig>

More information about the ubuntu-security-announce mailing list