Ubuntu Tutorials

===========================================================
Ubuntu Security Notice USN-885-1           January 14, 2010
transmission vulnerabilities
CVE-2009-1757, CVE-2010-0012
===========================================================

It was discovered that the Transmission web interface was vulnerable to cross-site request forgery (CSRF) attacks. If a user were tricked into opening a specially crafted web page in a browser while Transmission was running, an attacker could trigger commands in Transmission. This issue affected Ubuntu 9.04. (CVE-2009-1757)

Dan Rosenberg discovered that Transmission did not properly perform input validation when processing torrent files. If a user were tricked into opening a crafted torrent file, an attacker could overwrite files via directory traversal. (CVE-2010-0012)

The problem can be corrected by upgrading your system to the following package versions:

Ubuntu 8.04 LTS:
transmission-cli                1.06-0ubuntu6.1
transmission-gtk                1.06-0ubuntu6.1

Ubuntu 8.10:
transmission-cli                1.34-0ubuntu2.3
transmission-gtk                1.34-0ubuntu2.3

Ubuntu 9.04:
transmission-cli                1.51-0ubuntu3.1
transmission-gtk                1.51-0ubuntu3.1

Ubuntu 9.10:
transmission-cli                1.75-0ubuntu2.2
transmission-gtk                1.75-0ubuntu2.2
transmission-qt                 1.75-0ubuntu2.2

After a standard system upgrade you need to restart Transmission to effect the necessary changes.

===========================================================
Ubuntu Security Notice USN-884-1           January 14, 2010
openssl vulnerability
CVE-2009-4355
===========================================================

It was discovered that OpenSSL did not correctly free unused memory in certain situations.  A remote attacker could trigger this flaw in services that used SSL, causing the service to use all available system memory, leading to a denial of service.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 6.06 LTS:
libssl0.9.8                     0.9.8a-7ubuntu0.11

Ubuntu 8.04 LTS:
libssl0.9.8                     0.9.8g-4ubuntu3.9

Ubuntu 8.10:
libssl0.9.8                     0.9.8g-10.1ubuntu2.6

Ubuntu 9.04:
libssl0.9.8                     0.9.8g-15ubuntu3.4

Ubuntu 9.10:
libssl0.9.8                     0.9.8g-16ubuntu3.1

After a standard system upgrade you need to restart any applications using OpenSSL, especially Apache, to effect the necessary changes.