==========================================================================
Ubuntu Security Notice USN-2142-1
March 10, 2014

udisks, udisks2 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

– Ubuntu 13.10
– Ubuntu 12.10
– Ubuntu 12.04 LTS

Summary:

UDisks could be made to manipulate directories as the administrator.

Software Description:
– udisks: service to access and manipulate storage devices
– udisks2: service to access and manipulate storage devices

Details:

Florian Weimer discovered that UDisks incorrectly handled certain long path
names. A local attacker could use this issue to cause udisks to create
certain directory structures, possibly leading to privilege escalation.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 13.10:
udisks 1.0.4-8ubuntu1.1
udisks2 2.1.0-4ubuntu0.1

Ubuntu 12.10:
udisks 1.0.4-6ubuntu0.1
udisks2 2.0.0-1ubuntu1.1

Ubuntu 12.04 LTS:
udisks 1.0.4-5ubuntu2.2

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2142-1
CVE-2014-0004

Package Information:
https://launchpad.net/ubuntu/+source/udisks/1.0.4-8ubuntu1.1
https://launchpad.net/ubuntu/+source/udisks2/2.1.0-4ubuntu0.1
https://launchpad.net/ubuntu/+source/udisks/1.0.4-6ubuntu0.1
https://launchpad.net/ubuntu/+source/udisks2/2.0.0-1ubuntu1.1
https://launchpad.net/ubuntu/+source/udisks/1.0.4-5ubuntu2.2

—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
Comment: Using GnuPG with Thunderbird – http://www.enigmail.net/

iQIcBAEBCgAGBQJTHavPAAoJEGVp2FWnRL6TVxcQAJgvwlfdx5HxV1az1TE6G202
eCYgdLkK2n9Ej3/u/o2sd0fKfX8yQega8mDA/UdaOq5CcVD6D6zy3YWhkgLb831S
bXqkJI1R27lK6mlujSA93Wgrap4Jb3sP1ZivIDsmVKk9qwHfUZR5f8CTj+H8ngvB
bh69R0kJhHWz5aR6J2Zs2gOvbuyaEOzzb+lRB2asvHAHTkR9aYUswSTXFY+VVWIv
qtcn5nh5WwqvtLhm7y+O2hzTW9MHnqW7Kq4LzcwS8UohJ135+uTx/bMWJ/pLNHf8
PLSMRNWFRWRWfpNCIniEiDq3M24RQj9zc6ZDcyW4S207GRx+3XlsOVEFbySQyaQu
+yzgvoDc7zqN2YO+7uYYlzkM1m+IipKk4AhhzOYfDlEBH+elzhREiB66DQ44NbWX
H8TVz1k3V22bOtg0BRCHWZFgyEjP6fm8rczyXgF49V/eUSZzEnApE2rmX9Oq1xzx
k9xcJOfeA7AG1dJSTQB6A1nPp6JMQ6nr0gniSWMirw5Wvfuf81bJoTAyZnftQzd7
0AKwVxd9d1kuzf636Kme43zG0NvtiCC6xHw37fl1zETla9sTJPczCC2qc8q2kml4
xBPEPs9bWQDw5GeI0fDsk+GdcBe8gjdZjDdEJCzvBbxsjune8Mwoerw3Ek+wdd0K
qFBAAbZrVH4qLiJ7gwy0
=TuB+
—–END PGP SIGNATURE—–
—