Update aMule to 2.2.5 ASAP (security issue fixed)

Bug #382215 reported by PowerUser
268
This bug affects 1 person
Affects Status Importance Assigned to Milestone
amule (Debian)
Fix Released
Unknown
amule (Ubuntu)
Fix Released
Medium
Unassigned
Jaunty
Fix Released
Undecided
Unassigned

Bug Description

Binary package hint: amule

Ubuntu 9.04 provides aMule version 2.2.4 and I found no any logs about fixing recent security problem

Problem description: http://www.securityfocus.com/bid/34683/info
Severity: medium or high. Issue can potentially lead to unwanted remote shell commands execution if user downloads file with uncommon name containing quotes in filename.
Version where issue fixed: 2.2.5

CVE References

Revision history for this message
Jamie Strandboge (jdstrand) wrote :

Thank you for using Ubuntu and taking the time to report a bug. This package is in universe and is community supported. If you are able, perhaps you could prepare debdiffs to fix this by following https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures.

visibility: private → public
Changed in amule (Ubuntu):
status: New → Confirmed
Revision history for this message
Scott Ritchie (scottritchie) wrote :

I'll try and push the update into Karmic and then backport.

Changed in amule (Ubuntu):
assignee: nobody → Scott Ritchie (scottritchie)
importance: Undecided → Medium
status: Confirmed → Triaged
Revision history for this message
Scott Ritchie (scottritchie) wrote :

amule 2.2.5 is functional in Karmic already, I've uploaded it to jaunty-proposed, where it awaits approval.

Revision history for this message
Martin Pitt (pitti) wrote :

amule | 2.2.5-1ubuntu1 | karmic/universe | source, amd64, i386

Changed in amule (Ubuntu):
status: Triaged → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

Since it's a security issue, shouldn't it rather go to jaunty-security?

Revision history for this message
Scott Ritchie (scottritchie) wrote :

I guess, though it also includes some bugfixes as well. It's kind of like another firefox point release.

Revision history for this message
Cody A.W. Somerville (cody-somerville) wrote :

Scott: Please prepare a security upload that fixes just the security issue. Afterward, you can speak with the backport team to get 2.2.5 backported.

Revision history for this message
Scott Ritchie (scottritchie) wrote :

I don't have the ability to separate out an individual patch at the moment.

I'm fairly sure there's low regression potential though. Here's the changelog: http://www.amule.org/wiki/index.php/Changelog_2.2.5

Changed in amule (Ubuntu):
assignee: Scott Ritchie (scottritchie) → nobody
Revision history for this message
Scott Ritchie (scottritchie) wrote :

On second thought, I think 2.2.5 is more appropriate for an SRU than a backport due to the minimal nature of the changes.

Revision history for this message
Cody A.W. Somerville (cody-somerville) wrote :

You do realize that some folks don't have -updates enabled but do have -security enabled? If you do an SRU and don't do the security update, some folks won't get the security update. This is why I've encouraged you to do the security upload.

If you still want to move forward with an SRU, you can't play off the security fix. You need to provide the additional details that a normal SRU request would provide.

Changed in amule (Debian):
status: Unknown → Fix Released
Revision history for this message
Jonathan Riddell (jr) wrote :

Rejecting from jaunty-proposed queue due to lack of activity in this bug.

Changed in amule (Ubuntu Jaunty):
status: New → Incomplete
Revision history for this message
Artur Rona (ari-tczew) wrote :

As bug #382215 has been fixed, I think that security issue is fixed.

Changed in amule (Ubuntu Jaunty):
status: Incomplete → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.