zoneminder: CVE-2008-1381 arbitrary code execution via crafted URL

Debian Bug report logs - #479034
zoneminder: CVE-2008-1381 arbitrary code execution via crafted URL

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Steffen Joeris <steffen.joeris@skolelinux.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2008-2033: Multiple vulnerabilities

Date: Sat, 03 May 2008 05:46:56 +1000

Package: zoneminder
Severity: grave
Tags: security
Justification: user security hole

Hi

The following CVE(1) has been issued against zoneminder.

CVE-2008-2033
Multiple unspecified vulnerabilities in ZoneMinder before 1.23.3
allow remote authenticated users to execute arbitrary code via unknown attack vectors.

Cheers
Steffen

(1) http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2033

Message #10 received at 479034@bugs.debian.org (full text, mbox, reply):

From: Tomas Hoger <thoger@redhat.com>

To: 479034@bugs.debian.org

Subject: Re: CVE-2008-2033: Multiple vulnerabilities

Date: Fri, 2 May 2008 16:22:23 +0200

Hi!

This is a duplicate of CVE-2008-1381.  See references for CVE-2008-1381
for details.

HTH

-- 
Tomas Hoger

Message #19 received at 479034@bugs.debian.org (full text, mbox, reply):

From: Nico Golde <nion@debian.org>

To: 479034@bugs.debian.org

Subject: intent to NMU

Date: Sun, 4 May 2008 14:41:28 +0200

[Message part 1 (text/plain, inline)]

tags 479034 + patch
thanks

Hi,
I intent to NMU this bug. Attached is a patch to fix this 
issue. It will be also archived on:
http://people.debian.org/~nion/nmu-diff/zoneminder-1.23.2-2_1.23.2-2.1.patch

Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.

[zoneminder-1.23.2-2_1.23.2-2.1.patch (text/x-diff, attachment)]

[Message part 3 (application/pgp-signature, inline)]

Message #26 received at 479034-close@bugs.debian.org (full text, mbox, reply):

From: Peter Howard <pjh@northern-ridge.com.au>

To: 479034-close@bugs.debian.org

Subject: Bug#479034: fixed in zoneminder 1.23.3-1

Date: Mon, 05 May 2008 05:02:03 +0000

Source: zoneminder
Source-Version: 1.23.3-1

We believe that the bug you reported is fixed in the latest version of
zoneminder, which is due to be installed in the Debian FTP archive:

zoneminder_1.23.3-1.diff.gz
  to pool/main/z/zoneminder/zoneminder_1.23.3-1.diff.gz
zoneminder_1.23.3-1.dsc
  to pool/main/z/zoneminder/zoneminder_1.23.3-1.dsc
zoneminder_1.23.3-1_i386.deb
  to pool/main/z/zoneminder/zoneminder_1.23.3-1_i386.deb
zoneminder_1.23.3.orig.tar.gz
  to pool/main/z/zoneminder/zoneminder_1.23.3.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 479034@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Peter Howard <pjh@northern-ridge.com.au> (supplier of updated zoneminder package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 19 Mar 2008 01:02:50 +1000
Source: zoneminder
Binary: zoneminder
Architecture: source i386
Version: 1.23.3-1
Distribution: unstable
Urgency: high
Maintainer: Peter Howard <pjh@northern-ridge.com.au>
Changed-By: Peter Howard <pjh@northern-ridge.com.au>
Description: 
 zoneminder - Linux video camera security and surveillance solution
Closes: 479034
Changes: 
 zoneminder (1.23.3-1) unstable; urgency=high
 .
   * Initial version for 1.23.3 - security fix.
     (closes: #479034)
Checksums-Sha1: 
 19fa939f56cb5d9b9fc7d8f0699edd4b94aaed82 1181 zoneminder_1.23.3-1.dsc
 c71609a7e790ec14984d59ec315613cf0d32f865 770154 zoneminder_1.23.3.orig.tar.gz
 f7d6688f0addb9d577c4842a74f48fcfca1743d8 31690 zoneminder_1.23.3-1.diff.gz
 174aebda4e79e933ecd239e24505d2a3d7474577 965294 zoneminder_1.23.3-1_i386.deb
Checksums-Sha256: 
 4d4944ce9954ceb740ccac9310c9c56bcd614347b0b6d85d7fe30dec93090d96 1181 zoneminder_1.23.3-1.dsc
 8cd7c17955facfd762dfac5c76b9ec12c7b4ed90286e3644cbb762398a921c39 770154 zoneminder_1.23.3.orig.tar.gz
 e1679a5043215875f23f1f084381249fc108515767af2d34db32184cbd40cdbc 31690 zoneminder_1.23.3-1.diff.gz
 7547856104e3d8629df2a29a0df946a215c5b2ed3a9601e700cf61bbddf6281c 965294 zoneminder_1.23.3-1_i386.deb
Files: 
 50a7b738f3c71659a056ff073ced745d 1181 net optional zoneminder_1.23.3-1.dsc
 96b0df91f162ff65576347ff343f11ed 770154 net optional zoneminder_1.23.3.orig.tar.gz
 fde3bbed065bbdbe23424659c43e3b95 31690 net optional zoneminder_1.23.3-1.diff.gz
 46bc0d4b6b8e61b0facb5b8ab8e41895 965294 net optional zoneminder_1.23.3-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFIHpD+CfB0CMh//C8RAo2hAKC/gVb+KOWbRsJKLM3f8qY9cDWA+QCgkK6Q
EaXQKlhRRgduZ+h4eNF5vHg=
=wEE+
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.