Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.1045
sharutils security update
6 April 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: sharutils
Publisher: Debian
Operating System: Debian GNU/Linux 8
Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-1000097
Reference: ESB-2018.0832
Original Bulletin:
http://www.debian.org/security/2018/dsa-4167
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4167-1 security@debian.org
https://www.debian.org/security/ Luciano Bello
April 05, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : sharutils
CVE ID : CVE-2018-1000097
Debian Bug : 893525
A buffer-overflow vulnerability was discovered in Sharutils, a set of
utilities handle Shell Archives. An attacker with control on the input of
the unshar command, could crash the application or execute arbitrary code
in the its context.
For the oldstable distribution (jessie), this problem has been fixed
in version 4.14-2+deb8u1.
For the stable distribution (stretch), this problem has been fixed in
version 1:4.15.2-2+deb9u1.
We recommend that you upgrade your sharutils packages.
For the detailed security status of sharutils please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/sharutils
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEayzFlnvRveqeWJspbsLe9o/+N3QFAlrGU8EACgkQbsLe9o/+
N3SX9Q/6A6qLYBDrTSnlqUqjWKiQXTUGMGndookV24BCpSapSXYtFjPph6N5WVny
55vq3Ume6rZuSix8D4+WWktZTPKS2iDgVtCZWRG7Onl0WJGgkXUETrd31/hvT8PJ
izGyhzlbDaQtjerZxIMXzqtjlMyUmN0cDyhRd6JxT6Uu2FMCUqkCZenfxxSbo2W9
N322K98cU20C3WO/1KnMWpVMSEEaBTnW612gcfN59eR10pilQK/Pst2PCfEaf83K
6LVI07HHIHxe3sS2WJB2CMkClYCNB9Xzcp+PyHcn9oFhmwPNFo3jix3/0ueG/Agt
YOshVmk/wsRN+Kqx+b8R9/i+aZaNQV2sr9Ml0C+nHREBWxE5wykSe+F25b7Gq3AD
XabbQmQouEDFtIkNQ8tVBhnhLh3HxWD35l2WQV98A1XYPCllwVqrBj7c9d2DaQDF
63zin1gCivzUtaQWmNjOTA2ATbKfDZHgqFfMvcBuIbCCykHYctHKJiEXC/5LeoI+
d61iRxytLy+l5oDDsaRi9KWFabDmgb+65asvEHwgz2nbtcxMfilanYuO7aS5ET9+
ZcEFTmhUqMb8Ly8Ln4ikLNeAtcR4MrrTXm+ZIWkzhF2eLWKuRswVL6ZdkAAls8/W
fwi0b13695gwpsleoGuNOJCLQwiCOm8xmzbnNaua3LQLZmBGWmg=
=dr+o
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWsbGEYx+lLeg9Ub1AQiZKhAAj2csWtJUxsBwWEgmcTG+Rp859YjoX9wu
8FYow0Cd/JwQLGPizwMlRQcHI8LZqPS2GflK4WGoDD0hzmi3r303YTUS62z9/ZwY
dhVRWC8F1baV6IJxre9Iaj3pfu2IeZwjUwKWT1lm8GH2I5CL03uLBc1LyjB9SW80
rRIQphSqh14n/SvT75zcPxChdyIbkHsubYyzCvqRQy8bJMlGA6Dga9F2A6EC9vYM
Q65kyhXxFebPCuh1hqd5r2cTaWZADaNOjmhveGRnA8bSrXTxZLTANHkQQvM4s1fu
y20Rel/a3cyxXoQtTYekvIWruRnDx5g62k/1/7AXElqxFCg4LWLB9h4khEZz2Gvl
zXQq26W6meI2BJcjNtH7gDh66mZDHqjDHtHgH0kzusq31UPLFxYz4PxHopRKr4UC
Y4cjG9hxYMpuzIr+e7+EGB0bjp7/R1u89IrhscXyspBuvObTyv8OH4KYIWwVxm/r
2sktthu9p5H4/7riGI97qBlPfrveSSyRrA35OyZ3ZZ69JzDJMhiYW8jmZoRCKHB8
2OxGL5ekVXWQrsfVJszHsDAhxeoHyKeq2xFuIwFQLijNWv4+XOuKQPFWQzF8WpZP
+AyNxG7fdMzaA0uHvoR7Xf0vHlUeSL2hYg8vJZaDygmKlXtatYXl7rti5tnu/oJL
AcC+kewtjU8=
=l7Xn
-----END PGP SIGNATURE-----