[slackware-security] wicd (SSA:2009-040-01)

[news 28]

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

[slackware-security] wicd (SSA:2009-040-01)

 

New wicd packages are available for Slackware 12.2 and -current to fix a

security issue with the D-Bus configuration file that could allow local

information disclosure (such as network credentials).

 

More details about this issue may be found in the Common

Vulnerabilities and Exposures (CVE) database:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0489

 

 

Here are the details from the Slackware 12.2 ChangeLog:

+--------------------------+

patches/packages/wicd/wicd-1.5.9-noarch-1.tgz: Upgraded to wicd-1.5.9.

This fixes a security problem with the D-Bus configuration file that allows

local users to intercept D-Bus messages, possibly including wireless network

credentials.

For more information, see:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0489

(* Security fix *)

+--------------------------+

 

 

Where to find the new packages:

+-----------------------------+

 

HINT: Getting slow download speeds from ftp.slackware.com?

Give slackware.osuosl.org a try. This is another primary FTP site

for Slackware that can be considerably faster than downloading

directly from ftp.slackware.com.

 

Thanks to the friendly folks at the OSU Open Source Lab

(http://osuosl.org) for donating additional FTP and rsync hosting

to the Slackware project! :-)

 

Also see the "Get Slack" section on http://slackware.com for

additional mirror sites near you.

 

Updated package for Slackware 12.2:

ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/wicd-1.5.9-noarch-1_slack12.2.tgz

 

Updated package for Slackware -current:

ftp://ftp.slackware.com/pub/slackware/slackware-current/extra/wicd/wicd-1.5.9-noarch-1.tgz

 

 

MD5 signatures:

+-------------+

 

Slackware 12.2 package:

503d6dd8cce8fe148d6799727a51f5a6 wicd-1.5.9-noarch-1_slack12.2.tgz

 

Slackware -current package:

f98aab4483d4aa1f6c16c4517e560b81 wicd-1.5.9-noarch-1.tgz

 

 

Installation instructions:

+------------------------+

 

Kill any instances of wicd-client:

# killall wicd-client

 

Upgrade the package as root:

# upgradepkg wicd-1.5.9-noarch-1_slack12.2.tgz

 

Reload D-Bus:

# /etc/rc.d/rc.messagebus reload

 

Restart wicd:

# /etc/rc.d/rc.wicd restart

 

Finally, restart any stopped instances of wicd-client as the normal user(s).

 

Alternate approach: Upgrade the wicd package and reboot.

 

 

+-----+

 

Slackware Linux Security Team

http://slackware.com/gpg-key

security ( -at -) slackware.com

 

+------------------------------------------------------------------------+