AusCERT - ESB-2013.0649 - [Linux][FreeBSD][OSX][Ubuntu] gpsd: Multiple vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Training
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
ESB-2013.0649 - [Linux][FreeBSD][OSX][Ubuntu] gpsd: Multiple vulnerabilities
Date: 09 May 2013

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2013.0649
                            gpsd vulnerability
                                9 May 2013

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           gpsd
Publisher:         Ubuntu
Operating System:  Ubuntu
                   OS X
                   Linux variants
                   FreeBSD
Impact/Access:     Execute Arbitrary Code/Commands -- Remote with User Interaction
                   Denial of Service               -- Remote with User Interaction
Resolution:        Patch/Upgrade
CVE Names:         CVE-2013-2038  

Original Bulletin: 
   http://www.ubuntu.com/usn/usn-1820-1

Comment: This advisory references vulnerabilities in products which run on 
         platforms other than Ubuntu. It is recommended that administrators 
         running gpsd check for an updated version of the software for their
         operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

==========================================================================
Ubuntu Security Notice USN-1820-1
May 08, 2013

gpsd vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- - Ubuntu 12.04 LTS

Summary:

gpsd could be made to crash or possibly run programs if it received
specially crafted input.

Software Description:
- - gpsd: Global Positioning System - daemon

Details:

It was discovered that gpsd incorrectly handled certain malformed GPS data.
An attacker could use this issue to cause gpsd to crash, resulting in a
denial of service, or possibly execute arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  gpsd                            3.4-2ubuntu0.1

In general, a standard system update will make all the necessary changes.

References:
  http://www.ubuntu.com/usn/usn-1820-1
  CVE-2013-2038

Package Information:
  https://launchpad.net/ubuntu/+source/gpsd/3.4-2ubuntu0.1

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUYrfiu4yVqjM2NGpAQLkWQ/+NKZDpYSGmkaT6+ojVC6g8SyT50PUaBdI
OSHPgNTPAvf4d898u8lq7UFrIALug/DSP3oVwK89q/40NeVklp8erMv1mSGNxWvE
2LJeZ2XPDsrhaKj62fuSYzDYcyTQaSJiaO85pgBlqp5dTRivMxgL5UzsD35wE5Bu
hoEhLj06Y0Z0AvzKhLS+pI8F1rY6Gzl7cuAsgINY0Vsd4+Zr7ZOrptfmmIKF6vBV
s0o1ODl0X954hs5EkvDqaG+F12sKyDJf3/L/WloWbskbcoWZPbGoMOkRkpY3b5QT
osYDhktiJf6N+mTahPBucgp1+/r0bF9l5LyYB7ndUdxV7XZerq+EbluRcms8OUxx
6ExX1AHWlzgt8WDXzXiQawlY6VBWyBmRE8FRyZL0QmsO08AewF9DVRgE20T4mnB7
9fcGN592h7C81YZ/lYDYQXAVaJXIk7yJNm0I5Yjc3iDx/YLD+7aNPbx9DdzprAJ5
PJIQfuGCbgAbiihKA632iFIvBqIl3v6J+vLWB0YDYEEmOd+jAlKGhHzkbq3V7J9V
uXr+qRhfJA3GyaKec9s1VjPl/JwckhViklQ7T5O6vFAK2dyyBRRxKULjfYuK5p6C
HdrN3VFyDncbmIiuK70aIcC7+vlkYyQCdGy4rkrwAtR25yFNk+KtHnoBR18wvhHv
hyYWzO/ULAg=
=+nP8
-----END PGP SIGNATURE-----