[USN-953-1] fastjar vulnerability

Marc Deslauriers marc.deslauriers at canonical.com
Mon Jun 21 18:48:49 UTC 2010 

===========================================================
Ubuntu Security Notice USN-953-1              June 21, 2010
fastjar vulnerability
CVE-2010-0831
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 8.04 LTS
Ubuntu 9.04
Ubuntu 9.10
Ubuntu 10.04 LTS

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 8.04 LTS:
  fastjar                         2:0.95-1ubuntu2.1

Ubuntu 9.04:
  fastjar                         2:0.97-3ubuntu0.1

Ubuntu 9.10:
  fastjar                         2:0.98-1ubuntu0.9.10.1

Ubuntu 10.04 LTS:
  fastjar                         2:0.98-1ubuntu0.10.04.1

In general, a standard system update will make all the necessary changes.

Details follow:

Dan Rosenberg discovered that fastjar incorrectly handled file paths
containing ".." when unpacking archives. If a user or an automated system
were tricked into unpacking a specially crafted jar file, arbitrary files
could be overwritten with user privileges.


Updated packages for Ubuntu 8.04 LTS:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1.diff.gz
      Size/MD5:    14652 0bbecbfd445a41af5fac64225180626f
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1.dsc
      Size/MD5:      688 37c0afbe767cd560f19f444c518f9e9a
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95.orig.tar.gz
      Size/MD5:   593955 92a70f9e56223b653bce0f58f90cf950

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_amd64.deb
      Size/MD5:    84840 92c639fcce37474a468a243a26a9ead6

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_i386.deb
      Size/MD5:    45128 b0d21c6467fe96f13ed0b6c71c96fd76

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_lpia.deb
      Size/MD5:    45394 082ac97eca4af7ed2e04576027240d98

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_powerpc.deb
      Size/MD5:    47688 b5b71b34bd0d6933356e0f667be92d34

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.95-1ubuntu2.1_sparc.deb
      Size/MD5:    46654 cd6104ab543567ea3b9d3af71812cb64

Updated packages for Ubuntu 9.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1.diff.gz
      Size/MD5:     4303 f685e7715cc6ef5f819cb1408d4fadba
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1.dsc
      Size/MD5:     1077 4ea02be4634886678ad56803e595a74c
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97.orig.tar.gz
      Size/MD5:   676393 2659f09c2e43ef8b7d4406321753f1b2

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_amd64.deb
      Size/MD5:    91000 834e980e9d7f6f58ee0a861f96a374f2

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_i386.deb
      Size/MD5:    48910 416f5950f1d5f679aaf69977bdf3e893

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_lpia.deb
      Size/MD5:    49010 4d5680c65c5b00559cfd11eb3d05ab18

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_powerpc.deb
      Size/MD5:    50538 e2dca54f24d0c4a0adc6f8b56639a7f4

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.97-3ubuntu0.1_sparc.deb
      Size/MD5:    50536 6d85158ea3212a93e5dc36ee9829d5e1

Updated packages for Ubuntu 9.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1.diff.gz
      Size/MD5:     4095 fa64ab3ca694288d157c37b4571a1781
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1.dsc
      Size/MD5:     1097 85d8021aa363a9a2ca0025b994408139
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98.orig.tar.gz
      Size/MD5:   717984 d2d264d343d4d0e1575832cc1023c3bf

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_amd64.deb
      Size/MD5:    91004 ed7dedc416f0c2f94c9a941cbffb8f98

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_i386.deb
      Size/MD5:    48924 338dd4ba551b8217917e36846ef6e199

  lpia architecture (Low Power Intel Architecture):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_lpia.deb
      Size/MD5:    49194 1cd1de1d62b913a4ceca1a7f9837d8c0

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_powerpc.deb
      Size/MD5:    50286 4b43f23dbac8b065e984e23906328671

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.9.10.1_sparc.deb
      Size/MD5:    50428 30ff3e7a9e9a88383d2113fcd38a9f1a

Updated packages for Ubuntu 10.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1.diff.gz
      Size/MD5:     4192 d1079eedbcf9a0bfb3fd270a91e49fb9
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1.dsc
      Size/MD5:     1101 feeaadc1dc54e396da69a69ade68116a
    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98.orig.tar.gz
      Size/MD5:   717984 d2d264d343d4d0e1575832cc1023c3bf

  amd64 architecture (Athlon64, Opteron, EM64T Xeon):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_amd64.deb
      Size/MD5:    90958 a088a28e94c4d3240ffa5394d3ead692

  i386 architecture (x86 compatible Intel/AMD):

    http://security.ubuntu.com/ubuntu/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_i386.deb
      Size/MD5:    49018 567ebb9983b24d76b7e0149f8a03a959

  powerpc architecture (Apple Macintosh G3/G4/G5):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_powerpc.deb
      Size/MD5:    50532 47cf2e79000cb83f550d01e9748eedfc

  sparc architecture (Sun SPARC/UltraSPARC):

    http://ports.ubuntu.com/pool/main/f/fastjar/fastjar_0.98-1ubuntu0.10.04.1_sparc.deb
      Size/MD5:    51216 8ce8b35ae84d7f33fb499a99432ffb64



-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: This is a digitally signed message part
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20100621/735c03af/attachment.sig>

More information about the ubuntu-security-announce mailing list