Nom du paquet
lvm
Date
2004-12-06
Advisory ID
MDKSA-2004:144
Affected versions
9.2 amd64 , CS2.1 x86_64 , 10.0 amd64 , 10.1 i586 , 10.0 i586 , 9.2 i586 , CS2.1 i586 , 10.1 x86_64

Problem description

The Trustix developers discovered that the lvmcreate_initrd script, part of the lvm1 package, created a temporary directory in an insecure manner. This could allow for a symlink attack to create or overwrite arbitrary files with the privileges of the user running the script. The updated packages have been patched to prevent this problem.

Updated packages

9.2 amd64

 59071b4206b86c306a1acb5287326076  amd64/9.2/RPMS/lvm-1.0.7-2.1.92mdk.amd64.rpm
9b677088ac2f0142b1d20cc743e71330  amd64/9.2/SRPMS/lvm-1.0.7-2.1.92mdk.src.rpm

CS2.1 x86_64

 6a46c69afb9fba2eb34c44088d5ba9ef  x86_64/corporate/2.1/RPMS/lvm-1.0.1-2.1.C21mdk.x86_64.rpm
a3b6553b2a09c67e071e7e848de80f50  x86_64/corporate/2.1/SRPMS/lvm-1.0.1-2.1.C21mdk.src.rpm

10.0 amd64

 09b02989d8b53f199771631f103db1d0  amd64/10.0/RPMS/lvm1-1.0.8-3.1.100mdk.amd64.rpm
87b5dfffb0fcae360a6bf15428837759  amd64/10.0/SRPMS/lvm1-1.0.8-3.1.100mdk.src.rpm

10.1 i586

 8e1650b55651b69b8fa24042485a93fc  10.1/RPMS/lvm1-1.0.8-3.1.101mdk.i586.rpm
703c69ea27f00b93825c0003b719412a  10.1/SRPMS/lvm1-1.0.8-3.1.101mdk.src.rpm

10.0 i586

 84d43ec2e89d54fde87b297433a1a827  10.0/RPMS/lvm1-1.0.8-3.1.100mdk.i586.rpm
87b5dfffb0fcae360a6bf15428837759  10.0/SRPMS/lvm1-1.0.8-3.1.100mdk.src.rpm

9.2 i586

 fed619af65f9bbc180301e379d017d33  9.2/RPMS/lvm-1.0.7-2.1.92mdk.i586.rpm
9b677088ac2f0142b1d20cc743e71330  9.2/SRPMS/lvm-1.0.7-2.1.92mdk.src.rpm

CS2.1 i586

 6c2e28a2b290b73e53cdebc81601778b  corporate/2.1/RPMS/lvm-1.0.1-2.1.C21mdk.i586.rpm
a3b6553b2a09c67e071e7e848de80f50  corporate/2.1/SRPMS/lvm-1.0.1-2.1.C21mdk.src.rpm

10.1 x86_64

 51e458895046be08a56f8117baee3fa2  x86_64/10.1/RPMS/lvm1-1.0.8-3.1.101mdk.x86_64.rpm
703c69ea27f00b93825c0003b719412a  x86_64/10.1/SRPMS/lvm1-1.0.8-3.1.101mdk.src.rpm

References