copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
Search this site

On this site

 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login


ESB-2007.0492 -- [Linux][Debian] -- New fireflier-server packages fix unsafe temporary files

Date: 03 July 2007

Click here for printable version
Click here for PGP verifiable version
Hash: SHA1

             AUSCERT External Security Bulletin Redistribution

                     ESB-2007.0492 -- [Linux][Debian]
         New fireflier-server packages fix unsafe temporary files
                                3 July 2007


        AusCERT Security Bulletin Summary

Product:              fireflier-server
Publisher:            Debian
Operating System:     Debian GNU/Linux
                      Linux variants
Impact:               Delete Arbitrary Files
Access:               Existing Account
CVE Names:            CVE-2007-2837

Original Bulletin:

Comment: This advisory references vulnerabilities in products which run on
         platforms other than Debian. It is recommended that administrators
         running fireflier-server check for an updated version of the
         software for their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------

Hash: SHA1

- - ------------------------------------------------------------------------
Debian Security Advisory DSA-1326                                         Steve Kemp
July 01, 2007
- - ------------------------------------------------------------------------

Package        : fireflier-server
Vulnerability  : insecure temporary files
Problem type   : local
Debian-specific: no
CVE Id(s)      : CVE-2007-2837

Steve Kemp from the Debian Security Audit project discovered that
fireflier-server, an interactive firewall rule creation tool, uses
temporary files in an unsafe manner which may be exploited to remove
arbitary files from the local system.

For the old stable distribution (sarge) this problem has been fixed in
version 1.1.5-1sarge1.

For the stable distribution (etch) this problem has been fixed in
version 1.1.6-3etch1.

For the unstable distribution (sid) this problem will be fixed shortly.

We recommend that you upgrade your fireflier-server package.

Upgrade instructions
- - --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GN/Linux 3.1 alias sarge
- - -------------------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:
    Size/MD5 checksum:      754 fd653a7d7e2c4475d1a2c2640b3e142a
    Size/MD5 checksum:   499949 4ae52e40866c6ca977ddcbf8a8b5fd65

alpha architecture (DEC Alpha)
    Size/MD5 checksum:    75194 8c878fe74627e6a6246333d5b14c228f
    Size/MD5 checksum:   177850 027ca26aabb6aafae2acdc748d3f4050
    Size/MD5 checksum:    74840 d5a498e131e51d76f4044218f9298e24
    Size/MD5 checksum:    51402 84350d096372ab3f0aa41608adf3772f

amd64 architecture (AMD x86_64 (AMD64))
    Size/MD5 checksum:    66538 34a5b65429e8ebdf4646d93ae8fc37c7
    Size/MD5 checksum:    66370 6f3614d84a690531039e5b7b0adc2b6b
    Size/MD5 checksum:    47130 68d9276db6afc61f3eec2091c6e57634
    Size/MD5 checksum:   147046 d0aafacb99d698957a91df99ff6eddd5

arm architecture (ARM)
    Size/MD5 checksum:    61610 ad9b1e6b0d0532a3494f22e6811798a9
    Size/MD5 checksum:    64002 50b762fe9a28aa55bda45d134de95a5e
    Size/MD5 checksum:    46878 dc55fb97f5d9a4bf8fc192d7f1f22620
    Size/MD5 checksum:   163486 70254f114e19769e74a02f977e70856c

i386 architecture (Intel ia32)
    Size/MD5 checksum:    66070 f65bbd16b3b9349271dd643b67fe5fe6
    Size/MD5 checksum:    45686 d43fa251a29fde160e5be343ac18a5e8
    Size/MD5 checksum:   145080 803aa15f76f167ec61751ab4d4726011
    Size/MD5 checksum:    63804 8935c1620e21f806b72ac23567cfde7b

ia64 architecture (Intel ia64)
    Size/MD5 checksum:    77904 c6470c91822ba6864b58f901e0ed0415
    Size/MD5 checksum:    57184 d40677eb94d117307e0a2279d6b46b37
    Size/MD5 checksum:    86190 785c0e110f76b92fbf9fecec864ddfdc
    Size/MD5 checksum:   181778 6599a98a4e1bdda9350f336b38d134a5

m68k architecture (Motorola Mc680x0)
    Size/MD5 checksum:    43666 e6bda51d4e19dc5a822d1368cb7a5950
    Size/MD5 checksum:   153246 54e8eb7687c145a29ba5c2f831ef3f58
    Size/MD5 checksu
m:    67476 656375bc297d17c24cf61287a071b858
    Size/MD5 checksum:    64976 0a277af76d4329a96fba035fa11f951f

mipsel architecture (MIPS (Little Endian))
    Size/MD5 checksum:    64736 676d8b2b2937960d3f2201b4009cc728
    Size/MD5 checksum:    48914 42326fdf138ab674ea5ad26c9f1a6c5e
    Size/MD5 checksum:    65704 6131b6260d1a5804b993c06d6402607e
    Size/MD5 checksum:   143918 e2a4420876ce51a371b4c04daf477299

s390 architecture (IBM S/390)
    Size/MD5 checksum:    58278 915f54bb4e7bac404a189d9d303ebde1
    Size/MD5 checksum:    58024 2c6e553cbf4e7ceedaa3e68dd7c90592
    Size/MD5 checksum:   126864 a63df68efa70c549c98a72dda362000b
    Size/MD5 checksum:    46378 e3c0faeb7643582a0f86ead593ef3392

sparc architecture (Sun SPARC/UltraSPARC)
    Size/MD5 checksum:   137770 02079ebc00539a25d28c7c3f2323087e
    Size/MD5 checksum:    44604 1f48977051d6b684a97d3bc11849e3d3
    Size/MD5 checksum:    63408 d5849c13c7f841f0779511628604f174
    Size/MD5 checksum:    62406 19d9df652340d502a46bea63631c69b8

Debian GNU/Linux 4.0 alias etch
- - -------------------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:
    Size/MD5 checksum:   615953 7db5f641d31cf389baf0882f2f2288ef
    Size/MD5 checksum:      719 8ec24268cc89bb1472dcd4f023109a55

alpha architecture (DEC Alpha)
    Size/MD5 checksum:   147300 c6b3ba67a793555ec96c3714d5028d4e
    Size/MD5 checksum:    52922 4f29a555ae0c60a283054869a2deef0d
    Size/MD5 checksum:    76210 db82d7e8c25d5b778bbc22de591f23ae
    Size/MD5 checksum:    74646 f39baaca7abcf1a64b6920398d545dc0

amd64 architecture (AMD x86_64 (AMD64))
    Size/MD5 checksum:    68414 9c1c112e4535e71ea86154c861e0b688
    Size/MD5 checksum:   121268 bdf7ba3b1cce5e9b4a0563c77dc9bd38
    Size/MD5 checksum:    47430 698f016cb66f731fda7b87b1f192709e
    Size/MD5 checksum:    67766 84d8735acffe2567fc8c9739788f0fea

arm architecture (ARM)
    Size/MD5 checksum:    46330 d147b04a73a65fe2966948ac58445cf7
    Size/MD5 checksum:    64868 1af069cf70c678eddaa8e28802df3e89
    Size/MD5 checksum:   130688 f97d13337085b8ade757c1fb10095d6f
    Size/MD5 checksum:    66356 64ef68a531883b23afeacde58e7d2727

i386 architecture (Intel ia32)
    Size/MD5 checksum:    46250 62dde84e79919f2b5d1b2b8a44cedcee
    Size/MD5 checksum:    65748 c908187a9e144b7d3debeb43c611f168
    Size/MD5 checksum:   123604 d14dd2b328d0a5f4886bae8ab388965b
    Size/MD5 checksum:    66552 71aad601121e92cab60380f7d92928e6

ia64 architecture (Intel ia64)
    Size/MD5 checksum:   155964 3989a1a5b59db29ce3b0f16d074ccd6d
    Size/MD5 checksum:    59392 07e514db9113670e6931f9683efcbfbc
    Size/MD5 checksum:    85446 3ca0771eb5d1e65a80912772444edd85
    Size/MD5 checksum:    77862 c0e83adfc8826c0a944cd96786e96b5b

mipsel architecture (MIPS (Little Endian))
    Size/MD5 checksum:    49918 8fdb8bff3171e00c81318dff7c2834bc
    Size/MD5 checksum:    67298 15b806ed030c3a71fce8390078739f32
    Size/MD5 checksum:   126054 51aa1ce345ea539a46ff4fc5a8353c6f
    Size/MD5 checksum:    67824 a5e8bcabc6192397f6701ebd62466a0c

powerpc architecture (PowerPC)
    Size/MD5 checksum:    65700 ae5de1b34ce04bdcb9f47a644b145548
    Size/MD5 checksum:   122762 3631252bcd61ca3f01d2ee0403ee8730
    Size/MD5 checksum:    62716 4abac4b6596b76653ca790c226095171
    Size/MD5 checksum:    49218 e9e2fa7a61de8ad67360c5b034f83694

s390 architecture (IBM S/390)
    Size/MD5 checksum:   109020 dbd1d3274cedec161eec4a25b0a79ece
    Size/MD5 checksum:    59542 8a39c0ef45c9890646da6c9d5a93d3f4
    Size/MD5 checksum:    47148 cd7df14ccffcdec9cb8f769777d066ee
    Size/MD5 checksum:    63242 7678da0d666839e0e458c5c5c8a49e22

sparc architecture (Sun SPARC/UltraSPARC)
    Size/MD5 checksum:    63500 303fc154d47f870590584a7cc3cb7bd2
    Size/MD5 checksum:    44856 efdcc4126731ed16f10260e7900c697a
    Size/MD5 checksum:    66338 f440f822c71d8c2ee0654390426b0207
    Size/MD5 checksum:   119628 cd5422a03308735ed84a6877c9dff8c6

  These files will probably be moved into the stable distribution on
  its next update.

- - ---------------------------------------------------------------------------------
For apt-get: deb stable/updates main
For dpkg-ftp: dists/stable/updates/main
Mailing list:
Package info: `apt-cache show <pkg>' and<pkg>
Version: GnuPG v1.4.6 (GNU/Linux)


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

Australian Computer Emergency Response Team
The University of Queensland
Qld 4072

Internet Email:
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.