Debian Bug report logs -
#796103
conntrack: CVE-2015-6496: conntrackd crash on unexpected network traffic
Reported by: Moritz Muehlenhoff <jmm@debian.org>
Date: Wed, 19 Aug 2015 13:45:06 UTC
Severity: grave
Tags: security
Found in versions conntrack/1:1.2.1-1, conntrack/1:0.9.14-2, conntrack/1:1.4.2-2
Fixed in versions conntrack/1:0.9.14-2+deb6u1, conntrack/1:1.4.2-3, conntrack/1:1.2.1-1+deb7u1, conntrack/1:1.4.2-2+deb8u1
Done: Salvatore Bonaccorso <carnil@debian.org>
Bug is archived. No further changes may be made.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Alexander Wirt <formorer@debian.org>:
Bug#796103; Package conntrack.
(Wed, 19 Aug 2015 13:45:09 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Muehlenhoff <jmm@debian.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, secure-testing-team@lists.alioth.debian.org, Alexander Wirt <formorer@debian.org>.
(Wed, 19 Aug 2015 13:45:09 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Package: conntrack
Version: 1:1.4.2-2
Severity: grave
Tags: security
Please see http://www.openwall.com/lists/oss-security/2015/08/14/4
for details.
Cheers,
Moritz
Changed Bug title to 'conntrack: CVE-2015-6496: conntrackd crash on unexpected network traffic' from 'CVE-2015-6496'
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Wed, 19 Aug 2015 13:54:03 GMT) (full text, mbox, link).
Marked as found in versions conntrack/1:1.2.1-1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Wed, 19 Aug 2015 13:54:04 GMT) (full text, mbox, link).
Marked as found in versions conntrack/1:0.9.14-2.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 20 Aug 2015 06:57:03 GMT) (full text, mbox, link).
Marked as fixed in versions conntrack/1:0.9.14-2+deb6u1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Thu, 20 Aug 2015 06:57:04 GMT) (full text, mbox, link).
Reply sent
to Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>:
You have taken responsibility.
(Thu, 20 Aug 2015 07:36:17 GMT) (full text, mbox, link).
Notification sent
to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer.
(Thu, 20 Aug 2015 07:36:17 GMT) (full text, mbox, link).
Message #18 received at 796103-close@bugs.debian.org (full text, mbox, reply):
Source: conntrack
Source-Version: 1:1.4.2-3
We believe that the bug you reported is fixed in the latest version of
conntrack, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 796103@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> (supplier of updated conntrack package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.8
Date: Wed, 19 Aug 2015 20:08:53 +0200
Source: conntrack
Binary: conntrack conntrackd nfct
Architecture: source amd64
Version: 1:1.4.2-3
Distribution: unstable
Urgency: medium
Maintainer: Alexander Wirt <formorer@debian.org>
Changed-By: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com>
Description:
conntrack - Program to modify the conntrack tables
conntrackd - Connection tracking daemon
nfct - Tool to interact with the connection tracking system
Closes: 796103
Changes:
conntrack (1:1.4.2-3) unstable; urgency=medium
.
* [d2fe984] d/patches: add CVE-2015-6496.patch (Closes: #796103)
Checksums-Sha1:
2c1a9d1bc6b79852bdc74fdf10e4a235f121f3f7 2235 conntrack_1.4.2-3.dsc
a421250e9307261d5a958d1bf5eff89b6b6c8fac 7216 conntrack_1.4.2-3.debian.tar.xz
c717f6904008d37f02986d6ddbb6fc22b5d53e55 27274 conntrack_1.4.2-3_amd64.deb
448e7eea5d09d080b8c4de5457a9fa72f0d0f319 102554 conntrackd_1.4.2-3_amd64.deb
a4d2c16303842741bd0edc07b4dc904e9088f298 12674 nfct_1.4.2-3_amd64.deb
Checksums-Sha256:
8178ea2822254e0f2c0fd8f34e28dc73657cfa8615a48db31bc7cbe1611b7554 2235 conntrack_1.4.2-3.dsc
0c69339796dd9945887169b94e4b31758bfb6859ec80d5d3b8cae865b086f072 7216 conntrack_1.4.2-3.debian.tar.xz
0b0b24e143c06f086323f3de76e94b46fbe1af4cb3110cfca79a9e440d4a8432 27274 conntrack_1.4.2-3_amd64.deb
769350e58828b581685283aaea48d4595ffdcfd223aa485d9a651dfdb95d1a3e 102554 conntrackd_1.4.2-3_amd64.deb
2af0529446f73e783cae98d4c94a99329384b691f5c2546df9b2d4bb323e05c7 12674 nfct_1.4.2-3_amd64.deb
Files:
ebd610e50fe224d7c062ae8a1fe94a09 2235 net optional conntrack_1.4.2-3.dsc
7baec583d481be8550792a3520e1b24f 7216 net optional conntrack_1.4.2-3.debian.tar.xz
ee1d74ffa3491fc7e2aa35b975f8442a 27274 net optional conntrack_1.4.2-3_amd64.deb
432fe67b3593d9ea64b215a168fe53b1 102554 net optional conntrackd_1.4.2-3_amd64.deb
1af2b62903083e1d1b612805504b1067 12674 net optional nfct_1.4.2-3_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJV1YGcAAoJEGjnE5gdFRX4wjkP/2e+zNnaxDNeRhUJAwHJ1GSk
IDcHGvxSmTFRgd14fMGaby/4iiMwBJ5egem19DzpJYvtMR9Zz/T1x6dEVvguM7nx
p7y90J1ZhFjue9NNzyQDyrU+Nq7nkq2o9jvI+TUXSTvIrUxK5+HrU09HWmLb4oFg
OdCx3NPgstURbbW9iBEQbb9n+XqUwn94SO7m9aBl3rVPwIkq9R4EOaBr8+YlabSS
Wy2HkeYs5TcLAA7Q7aVbl73iKSpkXIUmYHW80hYbg8mLkfGjhmyIf3hBZaJaofg7
gbv08abSF0G+/mBwC7gyiqZ8SN5wCoV5dxMM4WFsJoPm5AqWGTUhfCGnWU85QpsO
BGVbzzNTK+lIX7EQ6+nYd9OiFcCKMIOpUOw9YrH/ErGV6DTYNcrRcVH6ec3tDyZB
Lq6GGBT1uKHIdbC8/SwlfASirfRG9xJULEmqGIm4N/ZcEabD5lEeS/GJ7OMeipdI
I6MNWhRq9FB12phFX4EnlHKRRsSNP/A/zQHqQs24na9ic0eaOgAUoFWP8xi5S0nc
KdLUI3AWb+Ey5AL82AyKg2AclBEJZie5jMbDxXT+W1w6+IE+JYuTfZRC5TKcHKzl
x3WHMcsCDhpzIwT3mPmm41FNZVx/rrSM7zrX5uGiWcNiRvXKc4OKUMH/jlRmxsje
sH2mF85S8/o9Uv0NWG2Z
=MNrO
-----END PGP SIGNATURE-----
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility.
(Fri, 21 Aug 2015 10:18:17 GMT) (full text, mbox, link).
Notification sent
to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer.
(Fri, 21 Aug 2015 10:18:17 GMT) (full text, mbox, link).
Message #23 received at 796103-close@bugs.debian.org (full text, mbox, reply):
Source: conntrack
Source-Version: 1:1.2.1-1+deb7u1
We believe that the bug you reported is fixed in the latest version of
conntrack, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 796103@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated conntrack package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 19 Aug 2015 16:54:23 +0200
Source: conntrack
Binary: conntrack conntrackd
Architecture: source amd64
Version: 1:1.2.1-1+deb7u1
Distribution: wheezy-security
Urgency: high
Maintainer: Alexander Wirt <formorer@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Description:
conntrack - Program to modify the conntrack tables
conntrackd - Connection tracking daemon
Closes: 796103
Changes:
conntrack (1:1.2.1-1+deb7u1) wheezy-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* CVE-2015-6496: conntrackd crash on unexpected network traffic
(Closes: #796103)
Checksums-Sha1:
50976558ee23d9cfdda3309c8017b9feaf466285 1874 conntrack_1.2.1-1+deb7u1.dsc
bc077e67db1b4501b393bd41ab5f29fec9259d45 566085 conntrack_1.2.1.orig.tar.gz
e1a52c789a1322cf6c3a15685a34c593c0852cc7 5861 conntrack_1.2.1-1+deb7u1.diff.gz
868d20584cb1b43c3eb8811a461d9ec9cff5ab27 27756 conntrack_1.2.1-1+deb7u1_amd64.deb
a4e7c7df611d55bf8933967ac3f7616b768e4de8 125886 conntrackd_1.2.1-1+deb7u1_amd64.deb
Checksums-Sha256:
69d00528124c1b9f09c9b429c95b32c36ebf7a4b1d5b4d2151e53c21c449bfd9 1874 conntrack_1.2.1-1+deb7u1.dsc
90cf7730b2b17acd17ce5f54b089498e283914c695e9b3102cd24103d3e35f55 566085 conntrack_1.2.1.orig.tar.gz
20ee5d5cf14e794075efbd64774547c230d856ceca4df0c68f49ca56e92f4a08 5861 conntrack_1.2.1-1+deb7u1.diff.gz
db28759fd26a0169b760715c06c69aa927e42ed7e7ec9e5d691b2a40469811a3 27756 conntrack_1.2.1-1+deb7u1_amd64.deb
20a552aa56b37abba550d1505a79be0cfff2de2d06c1b04981f2fe89c4021ce6 125886 conntrackd_1.2.1-1+deb7u1_amd64.deb
Files:
1ba8bff4b83e4f897bd5a52cce0062fc 1874 net optional conntrack_1.2.1-1+deb7u1.dsc
fff6340c8bf845ca08ad534d2f9dd6c8 566085 net optional conntrack_1.2.1.orig.tar.gz
3208fea7c2e4828eb1ee2de4c80fc132 5861 net optional conntrack_1.2.1-1+deb7u1.diff.gz
d6dfd7d6c3e648c608b9002b79521a25 27756 net optional conntrack_1.2.1-1+deb7u1_amd64.deb
229426053d8023ab15a09c7f1be5fa3f 125886 net optional conntrackd_1.2.1-1+deb7u1_amd64.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV1NaaAAoJEAVMuPMTQ89ECQIP/0uznKUB+S/f7LoO4HtlQw95
QxDhR81qDB1VNWcc9Jtj8sUTkjAfYx04tLfpaPoSKo1K7soYq0s++Sr11UYiotuh
YSNkhZNgK37fZHa7z/sIWGdm1WqUNUN0XhllrMjrDUnTRJVxaY91mCJPecaAXaCX
nMTYQuKg8ouC1VjinPm1uAHAcjDhpUrC0s81yzPaYOKOAz3IMrq5Mdcumdu3yXTF
nWDeiWjElYkCVlru18uY+wKfTYc97HOWuM4NmADH+ZQKE6LMgOD+NTjLCY+fueEp
o+wQ1SUz8qVPwtCw3I5H/UIu/MQ8ylsJ1V44bSxPDvL9kFIugPBT6TkPwzxEnIQ0
CJ+SeOKcyv1NPx2n/dw2t0zUjoFAWPi+zqkMv4eBJ6DiDd87pKhgEHq2tgUW4Cix
DjiVwWNE5p0QMG5v47PRjv7ZEhkaF7rcuUz7RQQjSOHZya+3Rw332JISdcOcyW/j
/ZGg0c/lB999gEtS01uwnR4an661QrTqZCgVd9KaKHtnfbN8tzZSED5HRLEoBQy4
7+li/QRcmCpt/86ZpANNESkGyFXDjN1ECFXinglgxLu/XEfURCmGZu2sFuoZ+Mbw
xvIwFH4xmjqB1N69rV1f9Zruw9wHIy3TePNh4GQQQ3PH6+6bglaWZKnHzAIO1+/f
64MyPJjEqsWcIiwI5I20
=Sz7K
-----END PGP SIGNATURE-----
Reply sent
to Salvatore Bonaccorso <carnil@debian.org>:
You have taken responsibility.
(Fri, 21 Aug 2015 12:51:16 GMT) (full text, mbox, link).
Notification sent
to Moritz Muehlenhoff <jmm@debian.org>:
Bug acknowledged by developer.
(Fri, 21 Aug 2015 12:51:16 GMT) (full text, mbox, link).
Message #28 received at 796103-close@bugs.debian.org (full text, mbox, reply):
Source: conntrack
Source-Version: 1:1.4.2-2+deb8u1
We believe that the bug you reported is fixed in the latest version of
conntrack, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 796103@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Salvatore Bonaccorso <carnil@debian.org> (supplier of updated conntrack package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 19 Aug 2015 16:45:43 +0200
Source: conntrack
Binary: conntrack conntrackd nfct
Architecture: source
Version: 1:1.4.2-2+deb8u1
Distribution: jessie-security
Urgency: high
Maintainer: Alexander Wirt <formorer@debian.org>
Changed-By: Salvatore Bonaccorso <carnil@debian.org>
Closes: 796103
Description:
conntrack - Program to modify the conntrack tables
conntrackd - Connection tracking daemon
nfct - Tool to interact with the connection tracking system
Changes:
conntrack (1:1.4.2-2+deb8u1) jessie-security; urgency=high
.
* Non-maintainer upload by the Security Team.
* Add CVE-2015-6496.patch patch.
CVE-2015-6496: conntrackd crash on unexpected network traffic.
(Closes: #796103)
Checksums-Sha1:
ef4c248ac3108877c927f06ca8652fcf672b33cf 2265 conntrack_1.4.2-2+deb8u1.dsc
50b89305bb689973d42a163c480dc77a5c0f6fe0 472074 conntrack_1.4.2.orig.tar.bz2
1212a1905c5c8dd02a35c21ad383d7e5e8595770 7428 conntrack_1.4.2-2+deb8u1.debian.tar.xz
Checksums-Sha256:
6b11d84238c0fba84e7321cb3c3700e27b1caf1aa36fc07c9b9165f6254d205f 2265 conntrack_1.4.2-2+deb8u1.dsc
e5c423dc077f9ca8767eaa6cf40446943905711c6a8fe27f9cc1977d4d6aa11e 472074 conntrack_1.4.2.orig.tar.bz2
a0b8c4aef67072fa0613b91cadb7fcc268970f910d86259ebf333167b1a2be72 7428 conntrack_1.4.2-2+deb8u1.debian.tar.xz
Files:
227a93aa3c208b631282b67fb2dd39e8 2265 net optional conntrack_1.4.2-2+deb8u1.dsc
b1f9d006e7bf000a77395ff7cd3fac16 472074 net optional conntrack_1.4.2.orig.tar.bz2
0a957c60f810f4bb1d6888c185de5e19 7428 net optional conntrack_1.4.2-2+deb8u1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBCgAGBQJV1NexAAoJEAVMuPMTQ89EMJgQAJ1StXJ8MrJd6XWkLN+gxoxZ
aKl0kOVf6vyjrOxNJ0zGY8Og5j7L+LmGTYL229SzzdRDNFim1PfjOY0IQ7Gx2Qob
YEKyGf9DPVfHZF8INL4uBTEbaeS+hGv9t5O2HP+h4Por2F1qHiRkvL3Nv2SOrUD+
f98ZW6ajvhfOweBsULPfeqkgHKp3q3t1Ginj57x7wLn7a+vM8+6gq8pIwnCOlgFB
nQwmragXNuuj/gRv6AKNlIITnyEzp112+G8QGdUX2ahAq98kyjou4GYT7iDo4dKl
Nk/YUpNTypnM90enrfmpzMD7jzGX6+K/8ixG1OZxYXfOpknNPUYgmAnXke+diwnM
h5i1PuAuDgBdM1gnrnqHgx0iesEkl//befc5m3wZzPdmTnLbgk+SobUVJVVA/iem
XJ5B7VmMjpkTUT4hsY1MMmWQzalqWfJqYs9BEojEk4foRXqElHcyduXLhl1hAajc
5L0ARliN6irZ1SN/XHg5hLUbTn/nCIPzk6ADn/DTowvSQWv/yKGjOVGzWC2y9WHf
h64TiQP1XQFAOEC1jEyaM6i8++o0YlDjt/Efrkvz1CDDikkQ1QwXWZiOjD2zEl9c
Nmzpw0YQx8Sr6nJQaMui+k8+WPOjPJuzz6DpkJigSpHCZgmCRM8K0htyeVYEKhld
/8gGy0ZsEy2AqIh4onHz
=2NOi
-----END PGP SIGNATURE-----
Bug archived.
Request was from Debbugs Internal Request <owner@bugs.debian.org>
to internal_control@bugs.debian.org.
(Sat, 19 Sep 2015 07:25:35 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jun 19 14:43:27 2019;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon