Operating System:

[Debian]

Published:

20 December 2019

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.4747
                     debian-edu-config security update
                             20 December 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           debian-edu-config
Publisher:         Debian
Operating System:  Debian GNU/Linux 9
                   Debian GNU/Linux 10
Impact/Access:     Unauthorised Access -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-3467  

Reference:         ESB-2019.4717
                   ESB-2019.4716

Original Bulletin: 
   http://www.debian.org/security/2019/dsa-4589

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4589-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
December 18, 2019                     https://www.debian.org/security/faq
- - -------------------------------------------------------------------------

Package        : debian-edu-config
CVE ID         : CVE-2019-3467
Debian Bug     : 946797

It was discovered that debian-edu-config, a set of configuration files
used for the Debian Edu blend, configured too permissive ACLs for the
Kerberos admin server, which allowed password changes for other user
principals.

For the oldstable distribution (stretch), this problem has been fixed
in version 1.929+deb9u4.

For the stable distribution (buster), this problem has been fixed in
version 2.10.65+deb10u3.

We recommend that you upgrade your debian-edu-config packages.

For the detailed security status of debian-edu-config please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/debian-edu-config

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl36qpMACgkQEMKTtsN8
TjaKSBAAjXOOr5I57eoEY2jJXEWblgb/qbjcLdgwgkDuxhD1lN1mXDRDK7uOdKif
g4s4omVNlVe/g3rwJCqBByqBDeUK2KCYk2mqdbsbhQrZbz6HrPjwh309ewuORh+o
uWFF8ieD0yHKzE4VnbwNMcKInFzszALFP7zSbIdCKV/JDigUo/CrpPRTpYIa8Z3W
Xak7QqXotFE1qPlXQZURqgHcO9ZcdStwHxWpEZo5FpiF9oUl2KHsEKhv2lfdopzW
B477GpaCufa8nH2X4ahw3W4Idlm2GAJma6Sagk7BHqlHQAvE46q/qLLVjfCTFcis
je5J0vaVZg5OIiAE1D+mS4bYeio4OZJWaLOf7/6rArWHN3lcrfhMuFDYrSvaURJs
i+bMJxbguNZ/V66Ij5mQmq8PfSM3+nxEp5LbUrQ2KFZAx5/c1LtxzlUi5y3YKXrS
bMEuk+6w9NFWx1KGzPRM9aa+4a95DpJlof67VE3sSeXBc6YtBxf5VqXm6bh1jE7Z
S4uXyYdaMXpJT4lIjKX7LC1g1Z7j8X8tNKuIx7F5LDYnQEZK+aKuCKRZai5a0B4g
OtkgTROsJ2zQ+xg5go3zorqx6WJECwWRyFJwVdItqyBrlJ1QX2UeaYuvFB7KS/BO
8yCLdYR1oHR6FEMOxK7NfuR7gjW4VHBscsGlxUIZyu2IMF0Suec=
=6lpd
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXfxe2maOgq3Tt24GAQieNBAA1wRsxfKKtqQ+9aS565hcYUqewBBsGDXz
rWCAbONvuOSt1ze2uCew/c/p1wrJTT6mXpjNH8ytUb620jJJZ21mdQFnEnAH5o/Y
lZmo8fwRbcop03vSJwEGoP61gaYNVOiEsc1sy1pB7Tss4R05i0H4fNIjRaGNKrc2
SW5BtTUI9eKocW4nP4QpgSmEiIMoEmLuU+k8Y1jWCqAQReIU+FDYQYvFH0YfUi1k
JMzqCuiL1whTKqd2OPGSdqW2C/6Gxsd4mSl42i7Yk0kXLE8ktq3q83vxrsTegYtF
SGk68SZQct3mVLsTFf8C46mXGGCOkSixWxjNbAb1wOHmbx+3BEYgJqhUM8y0hZpz
6QcHDdNEutbA9P3QzsjvAvl+lQMtayF4zhZmR99GzspgZxpEUs7FJsRYeKtsY4K3
/KvG/IgwFOTg6cJpbdoDT3O2C6s6If7H625CKxboYRy0xMw/rkEK/wBs/6kPzB3u
XQvmWGZoClV9Oi1jRVow24mFExTr8agKhZzFAiDgcmEgRFX+qgt9IGNZK9SvyzRx
FkRtk5ovQ1fwIHffxdEjGTy5m62MgcyT7/mLIy20M6dMuRHTJr/WLYAEsXDgFoub
wx+EXYe6CzxIevYNBAKCd8KugnfWSEUVY2ulrUK130FyFMWFvBjImpIsFHEmk2e7
52jLmAFuSxM=
=fmNO
-----END PGP SIGNATURE-----