[Full-Disclosure] [FLSA-2005:1944] GNOME VFS updates address extfs vulnerability

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 02/20/05

  • Next message: Marc Deslauriers: "[Full-Disclosure] [FLSA-2005:2058] Updated cdrtools packages fix a security issue" 
    Date: Sun, 20 Feb 2005 17:27:47 -0500
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com

    -----------------------------------------------------------------------
                    Fedora Legacy Update Advisory

    Synopsis: GNOME VFS updates address extfs vulnerability
    Advisory ID: FLSA:1944
    Issue date: 2005-02-20
    Product: Red Hat Linux
    Keywords: Security
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=1944
    CVE Names: CAN-2004-0494
    -----------------------------------------------------------------------

    -----------------------------------------------------------------------
    1. Topic:

    Updated GNOME VFS packages that remove potential extfs-related
    vulnerabilities are now available.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386

    3. Problem description:

    GNOME VFS is the GNOME virtual file system. It provides a modular
    architecture and ships with several modules that implement support for
    file systems, HTTP, FTP, and others. The extfs backends make it possible
    to implement file systems for GNOME VFS using scripts.

    Flaws have been found in several of the GNOME VFS extfs backend scripts.
    Red Hat Linux ships with vulnerable scripts, but they are not used by
    default. An attacker who is able to influence a user to open a
    specially-crafted URI using gnome-vfs could perform actions as that
    user. The Common Vulnerabilities and Exposures project (cve.mitre.org)
    has assigned the name CAN-2004-0494 to this issue.

    Users of Red Hat Linux should upgrade to these updated packages, which
    remove these unused scripts.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - 1944 - CAN-2004-0494 GNOME VFS extfs
    vulnerability

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/gnome-vfs-1.0.5-4.1.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gnome-vfs-1.0.5-4.1.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/gnome-vfs-devel-1.0.5-4.1.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gnome-vfs-1.0.5-13.1.legacy.src.rpm
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/gnome-vfs2-2.2.2-4.1.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs-1.0.5-13.1.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs2-2.2.2-4.1.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs2-devel-2.2.2-4.1.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/gnome-vfs-devel-1.0.5-13.1.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ------------------------------------------------------------------------

    1b2e233aa6ae55ae23a6789fb13c5b6448a2a949
    7.3/updates/i386/gnome-vfs-1.0.5-4.1.legacy.i386.rpm
    7a651d8d5ddfc1838664551c97f0326a385f80d1
    7.3/updates/i386/gnome-vfs-devel-1.0.5-4.1.legacy.i386.rpm
    95d81f3f9744e57c41b80057fd9c1d210cb3f772
    7.3/updates/SRPMS/gnome-vfs-1.0.5-4.1.legacy.src.rpm
    0c4d06767ec7ffefbcdb77b66f8845502204d5da
    9/updates/i386/gnome-vfs-1.0.5-13.1.legacy.i386.rpm
    8f5c82ba289b2e7b51079af4867ddddaf66006d4
    9/updates/i386/gnome-vfs2-2.2.2-4.1.legacy.i386.rpm
    65650947bcc05f583b0833ad429e8204e7533fa2
    9/updates/i386/gnome-vfs2-devel-2.2.2-4.1.legacy.i386.rpm
    e702fbcd55b20e6208fe460eb83035173e25a1c4
    9/updates/i386/gnome-vfs-devel-1.0.5-13.1.legacy.i386.rpm
    5a6db00010fefa6117f5b417262279c7d2645a6a
    9/updates/SRPMS/gnome-vfs-1.0.5-13.1.legacy.src.rpm
    b48bb8e86f9300f2a0b6da398bf3004cba2c19c3
    9/updates/SRPMS/gnome-vfs2-2.2.2-4.1.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy org/about/security.php

    You can verify each package with the following command:

         rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

         sha1sum <filename>

    8. References:

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0494

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Marc Deslauriers: "[Full-Disclosure] [FLSA-2005:2058] Updated cdrtools packages fix a security issue"

    Relevant Pages