Please sync ziproxy 3.1.3-1 (universe) from Debian unstable

[David Sugar]

Binary package hint: ziproxy

As per Debian #584933 and CVE-2010-1513 there is a remote network exploit allowing arbitrary code to be executed. This has been fixed in 3.0.1, though Debian presently packages 3.1.3-1. We package 2.7.2, which is vulnerable and carries a couple of arm specific patches. I have verified the new package from sid at least minimally builds on Maverick unmodified for x86. I will review the patch we have made to see if it is still valid and needed for armel (originally LP: #539874), but it is a very simple one and should be easy to include if needed.

[David Sugar (dyfet-deactivatedaccount)]

3..1.3 builds fine from sid on Maverick unmodified, including on armel. Since this is a security vulnerability with a remote network exploit, I think it should be targeted as a SRU.

[David Sugar (dyfet-deactivatedaccount)]

The change required for addressing this security issue might be isolated to a change between 3.0.0 and 3.0.1. I am going to see if that change can be backported to our 2.7.2 and if it does fully address the security issue. My initial impression from reading the upstream changelog is that perhaps other changes in other upstream releases were also relevant.

[Loïc Minier (lool)]

I don't know whether this security issue affects older releases than lucid, but it certainly affects lucid.

[Loïc Minier (lool)]

I reviewed the Ubuntu diff; Debian patched out the Nameservers support, so our fix for the build affecting this code isn't needed anymore. I wrote to upstream author Daniel Mealha Cabrita to tell him about the Ubuntu fix though.

Ack for the sync to natty.

[Colin Watson (cjwatson)]

[Updating] ziproxy (2.7.2-1.1ubuntu2 [Ubuntu] < 3.1.3-1 [Debian])
 * Trying to add ziproxy...
2010-10-22 15:36:26 INFO - <ziproxy_3.1.3-1.dsc: downloading from http://ftp.debian.org/debian/>
2010-10-22 15:36:26 INFO - <ziproxy_3.1.3-1.debian.tar.gz: downloading from http://ftp.debian.org/debian/>
2010-10-22 15:36:27 INFO - <ziproxy_3.1.3.orig.tar.bz2: downloading from http://ftp.debian.org/debian/>
I: ziproxy [universe] -> ziproxy_2.7.2-1.1ubuntu2 [universe].

[Colin Watson (cjwatson)]

2010-10-22 15:36:54 INFO - <ziproxy_3.1.3-1.dsc: cached>
2010-10-22 15:36:54 INFO - <ziproxy_3.1.3-1.debian.tar.gz: cached>
2010-10-22 15:36:54 INFO - <ziproxy_3.1.3.orig.tar.bz2: cached>
[Updating] ziproxy (2.7.2-1.1ubuntu2 [Ubuntu] < 3.1.3-1 [Debian])
 * Trying to add ziproxy...
I: ziproxy [universe] -> ziproxy_2.7.2-1.1ubuntu2 [universe].

[Colin Watson (cjwatson)]

The security updates for stable releases would need to be done by somebody other than the archive administration team, so I'm unsubscribing ubuntu-archive. Feel free to resubscribe us if there's an action for us to take that falls within our remit.

[Loïc Minier (lool)]

Oh yes, thanks; the intent was to track that this had to be done, not for the archive team to do anything here -- I guess the team just remained subscribed subscribed after the sync to the development release

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. maverick has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against maverick is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".