[Full-Disclosure] [FLSA-2004:1257] Updated netpbm packages fix security vulnerabilities

From: Dominic Hargreaves (dom_at_earth.li)
Date: 10/08/04

  • Next message: Simon Lorentsen: "RE: [Full-Disclosure] Fw: Citibank reminder: please update your data" 
    To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com
Date: Fri, 8 Oct 2004 10:01:22 +0100

    -----------------------------------------------------------------------
                   Fedora Legacy Update Advisory

    Synopsis: Updated netpbm resolves security vulnerabilities
    Advisory ID: FLSA:1257
    Issue date: 2004-10-08
    Product: Red Hat Linux
    Keywords: Security
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1257
    CVE Names: CVE-2003-0924
    -----------------------------------------------------------------------

    -----------------------------------------------------------------------
    1. Topic:

    Updated netpbm packages that fix security vulnerabilities are now
    available.

    The netpbm package contains a library of functions that support
    programs for handling various graphics file formats, including .pbm
    (portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),
    .ppm (portable pixmaps), and others.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386

    3. Problem description:

    A number of temporary file bugs have been found in versions of NetPBM.
    These could make it possible for a local user to overwrite or create files
    as a different user who happens to run one of the the vulnerable utilities.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2003-0924 to this issue.

    Users are advised to upgrade to the erratum packages, which contain patches
    from Debian that correct these bugs.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which are
    not installed but included in the list will not be updated. Note that you
    can also use wildcards (*.rpm) if your current directory *only* contains
    the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the appropriate
    RPMs being upgraded on your system. This assumes that you have yum or
    apt-get configured for obtaining Fedora Legacy content. Please visit
    http://www.fedoralegacy.org/docs/ for directions on how to configure yum
    and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - 1257 - CAN-2003-0924: Temp file vuln in NetPBM

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------------

    79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18 7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm
    4a0e11ad855172ce86042d0f85991b6f28f4811b 7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
    d69d449139408cf50de7557f38fd9f3a3f86b4c3 7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
    173fa566ed92e222581817c4326b3dd501f24313 7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm

    729fd0be3b7f6ff031436cd8a563edbc57b76ad6 9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm
    ac5ee4489c0632057ef6d9844ad2c935e5754053 9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
    0d59209ef7e8e4d7630d8f23c372f01adeddeea5 9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
    8076a88d1c299a80db24e7559d0ea6853e6520b9 9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy org/about/security.php

    You can verify each package with the following command:

        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

        sha1sum <filename>

    8. References:

    http://www.kb.cert.org/vuls/id/487102
    https://rhn.redhat.com/errata/RHSA-2004-031.html

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Simon Lorentsen: "RE: [Full-Disclosure] Fw: Citibank reminder: please update your data"

    Relevant Pages