Jesse Keating
14/02/04, 14:55
=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated slocate resolves security vulnerabilities
Advisory ID: FLSA:1232
Issue date: 2004-02-11
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1232
CVE Names: CAN-2003-0848, CAN-2003-0056
=2D -----------------------------------------------------------------------
1. Topic:
Updated slocate packages are now available that fix security=20
vulnerabilities which may allow local users to gain "slocate" group=20
privileges.
2. Relevant releases/architectures:
Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
3. Problem description:
Slocate is a security-enhanced version of locate, designed to find files on
a system via a central database.
A vulnerability has been found in Slocate versions up to and including 2.7=
=20
where a carefully crafted database could overflow a heap-based buffer. A=20
local user could exploit this vulnerability to gain "slocate" group=20
privileges and then read the entire slocate database. The Common=20
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the=20
name CAN-2003-0848 to this issue.
These packages also fix a buffer overflow that affected unpatched versions=
=20
of Slocate prior to 2.7. This vulnerability could also allow a local user=20
to gain "slocate" group privileges. The Common Vulnerabilities and=20
Exposures project (cve.mitre.org) has assigned the name CAN-2003-0056 to=20
this issue.
Users of slocate should update to these update packages, which contain a=20
backported security patch that corrects this issue.
=46edora Legacy would like to thank Patrik Hornik and Kevin Lindsay fir=20
disclosing these issues, as well as Michael Schwendt for providing a=20
backported fix for Red Hat Linux 7.2, 7.3, and 8.0.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www.fedoralegacy.org/download for directions on how to configure=20
yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1232 - slocate security fix rh72, rh73, rh80 /=
=20
CAN-2003-0848
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
http://download.fedoralegacy.org/redhat/7.2/updates/SRPMS/slocate-2.7-1.7.2=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.2/updates/i386/slocate-2.7-1.7.2.=
legacy.i386.rpm
Red Hat Linux 7.3:
SRPMS:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/slocate-2.7-1.7.3=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/slocate-2.7-1.7.3.=
legacy.i386.rpm
Red Hat Linux 8.0:
SRPMS:
http://download.fedoralegacy.org/redhat/8.0/updates/SRPMS/slocate-2.7-1.8.0=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/8.0/updates/i386/slocate-2.7-1.8.0.=
legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
50b9bf61a1c6066c2c0671cb9c38a18f07c9e5fa =20
7.2/updates/SRPMS/slocate-2.7-1.7.2.legacy.src.rpm
47b001b499d89b75a8bad2dafb884d9c393c1e9a =20
7.2/updates/i386/slocate-2.7-1.7.2.legacy.i386.rpm
=20
b3654ebce54ae26617f2f18457fa9731542971ab =20
7.3/updates/SRPMS/slocate-2.7-1.7.3.legacy.src.rpm
eae25387e00a671974e0c43aa5b7f478dd04636f =20
7.3/updates/i386/slocate-2.7-1.7.3.legacy.i386.rpm
=20
b2238d14cec50187139883c34265c905b8495109 =20
8.0/updates/SRPMS/slocate-2.7-1.8.0.legacy.src.rpm
a22d3b45922b0123a0ca9035dd9f66093d63651d =20
8.0/updates/i386/slocate-2.7-1.8.0.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0056
http://rhn.redhat.com/errata/RHSA-2004-041.html
https://bugzilla.fedora.us/show_bug.cgi?id=3D1232
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFAKx7q4v2HLvE71NURApJvAJ0Rb2bMl3clQn/o01EceNVBlw4o1gCgiExh
exovlLtzTvi0t4XDfr8OT+8=3D
=3DlmAX
=2D----END PGP SIGNATURE-----
Hash: SHA1
=2D -----------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated slocate resolves security vulnerabilities
Advisory ID: FLSA:1232
Issue date: 2004-02-11
Product: Red Hat Linux
Keywords: Security
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=3D1232
CVE Names: CAN-2003-0848, CAN-2003-0056
=2D -----------------------------------------------------------------------
1. Topic:
Updated slocate packages are now available that fix security=20
vulnerabilities which may allow local users to gain "slocate" group=20
privileges.
2. Relevant releases/architectures:
Red Hat Linux 7.2 - i386
Red Hat Linux 7.3 - i386
Red Hat Linux 8.0 - i386
3. Problem description:
Slocate is a security-enhanced version of locate, designed to find files on
a system via a central database.
A vulnerability has been found in Slocate versions up to and including 2.7=
=20
where a carefully crafted database could overflow a heap-based buffer. A=20
local user could exploit this vulnerability to gain "slocate" group=20
privileges and then read the entire slocate database. The Common=20
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the=20
name CAN-2003-0848 to this issue.
These packages also fix a buffer overflow that affected unpatched versions=
=20
of Slocate prior to 2.7. This vulnerability could also allow a local user=20
to gain "slocate" group privileges. The Common Vulnerabilities and=20
Exposures project (cve.mitre.org) has assigned the name CAN-2003-0056 to=20
this issue.
Users of slocate should update to these update packages, which contain a=20
backported security patch that corrects this issue.
=46edora Legacy would like to thank Patrik Hornik and Kevin Lindsay fir=20
disclosing these issues, as well as Michael Schwendt for providing a=20
backported fix for Red Hat Linux 7.2, 7.3, and 8.0.
4. Solution:
Before applying this update, make sure all previously released errata=20
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those=20
RPMs which are currently installed will be updated. Those RPMs which are=20
not installed but included in the list will not be updated. Note that you=
=20
can also use wildcards (*.rpm) if your current directory *only* contains=20
the desired RPMs.
Please note that this update is also available via yum and apt. Many=20
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the appropriate=
=20
RPMs being upgraded on your system. This assumes that you have yum or=20
apt-get configured for obtaining Fedora Legacy content. Please visit=20
http://www.fedoralegacy.org/download for directions on how to configure=20
yum and apt-get.
5. Bug IDs fixed:
http://bugzilla.fedora.us - 1232 - slocate security fix rh72, rh73, rh80 /=
=20
CAN-2003-0848
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
http://download.fedoralegacy.org/redhat/7.2/updates/SRPMS/slocate-2.7-1.7.2=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.2/updates/i386/slocate-2.7-1.7.2.=
legacy.i386.rpm
Red Hat Linux 7.3:
SRPMS:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/slocate-2.7-1.7.3=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/slocate-2.7-1.7.3.=
legacy.i386.rpm
Red Hat Linux 8.0:
SRPMS:
http://download.fedoralegacy.org/redhat/8.0/updates/SRPMS/slocate-2.7-1.8.0=
=2Elegacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/8.0/updates/i386/slocate-2.7-1.8.0.=
legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
=2D -----------------------------------------------------------------------=
=2D---
50b9bf61a1c6066c2c0671cb9c38a18f07c9e5fa =20
7.2/updates/SRPMS/slocate-2.7-1.7.2.legacy.src.rpm
47b001b499d89b75a8bad2dafb884d9c393c1e9a =20
7.2/updates/i386/slocate-2.7-1.7.2.legacy.i386.rpm
=20
b3654ebce54ae26617f2f18457fa9731542971ab =20
7.3/updates/SRPMS/slocate-2.7-1.7.3.legacy.src.rpm
eae25387e00a671974e0c43aa5b7f478dd04636f =20
7.3/updates/i386/slocate-2.7-1.7.3.legacy.i386.rpm
=20
b2238d14cec50187139883c34265c905b8495109 =20
8.0/updates/SRPMS/slocate-2.7-1.8.0.legacy.src.rpm
a22d3b45922b0123a0ca9035dd9f66093d63651d =20
8.0/updates/i386/slocate-2.7-1.8.0.legacy.i386.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is=20
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or=20
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=3DCAN-2003-0056
http://rhn.redhat.com/errata/RHSA-2004-041.html
https://bugzilla.fedora.us/show_bug.cgi?id=3D1232
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More=20
project details at http://www.fedoralegacy.org
=2D --=20
Jesse Keating RHCE (http://geek.j2solutions.net)
=46edora Legacy Team (http://www.fedoralegacy.org)
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
iD8DBQFAKx7q4v2HLvE71NURApJvAJ0Rb2bMl3clQn/o01EceNVBlw4o1gCgiExh
exovlLtzTvi0t4XDfr8OT+8=3D
=3DlmAX
=2D----END PGP SIGNATURE-----