[Full-disclosure] [FLSA-2005:154991] Updated sharutils package fixes security issue

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 07/10/05

  • Next message: Marc Deslauriers: "[Full-disclosure] [FLSA-2005:152908] Updated gftp package fixes security issue"
    Date: Sun, 10 Jul 2005 17:23:16 -0400
    To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk
    
    
    
    

    ---------------------------------------------------------------------
                   Fedora Legacy Update Advisory

    Synopsis: Updated sharutils package fixes security issue
    Advisory ID: FLSA:154991
    Issue date: 2005-07-10
    Product: Red Hat Linux, Fedora Core
    Keywords: Bugfix
    CVE Names: CAN-2005-0990
    ---------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    Updated packages for sharutils which fix a security vulnerability are
    now available.

    The sharutils package contains a set of tools for encoding and decoding
    packages of files in binary or text format.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386
    Fedora Core 1 - i386
    Fedora Core 2 - i386

    3. Problem description:

    A bug was found in the way unshar creates temporary files. A local user
    could use symlinks to overwrite arbitrary files the victim running
    unshar has write access to. The Common Vulnerabilities and Exposures
    project (cve.mitre.org) has assigned the name CAN-2005-0990 to this
    issue.

    All users of sharutils should upgrade to these packages, which resolve
    this issue.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www.fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=154991

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.8.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/sharutils-4.2.1-12.8.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/sharutils-4.2.1-16.9.2.legacy.i386.rpm

    Fedora Core 1:

    SRPM:
    http://download.fedoralegacy.org/fedora/1/updates/SRPMS/sharutils-4.2.1-17.3.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/1/updates/i386/sharutils-4.2.1-17.3.legacy.i386.rpm

    Fedora Core 2:

    SRPM:
    http://download.fedoralegacy.org/fedora/2/updates/SRPMS/sharutils-4.2.1-18.3.FC2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/2/updates/i386/sharutils-4.2.1-18.3.FC2.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------

    b7bc64c53c9352cd872da7d6b05087a403eeb342
    redhat/7.3/updates/i386/sharutils-4.2.1-12.8.legacy.i386.rpm
    ecd2c836c88cd4deee0f421695cf69c59dbd6895
    redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.8.legacy.src.rpm
    00132d8850d0db03c6adae00ecece7c99de20223
    redhat/9/updates/i386/sharutils-4.2.1-16.9.2.legacy.i386.rpm
    715cf1cc13d0a99c379466299d67a0028bbc29c8
    redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.2.legacy.src.rpm
    000778eae9c2f079a98f5579669eecf841fba6c7
    fedora/1/updates/i386/sharutils-4.2.1-17.3.legacy.i386.rpm
    3e2f5b5babcd978e4d1ef96af504f8ee6eb50fdc
    fedora/1/updates/SRPMS/sharutils-4.2.1-17.3.legacy.src.rpm
    1211acde10ecca361e1ac19e72a82fd6dcda10f4
    fedora/2/updates/i386/sharutils-4.2.1-18.3.FC2.legacy.i386.rpm
    08292d722a234c43a4fd9f0c24c33e36da8a35ed
    fedora/2/updates/SRPMS/sharutils-4.2.1-18.3.FC2.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy.org/about/security.php

    You can verify each package with the following command:

        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

        sha1sum <filename>

    8. References:

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0990

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

    
    

    
    

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/



  • Next message: Marc Deslauriers: "[Full-disclosure] [FLSA-2005:152908] Updated gftp package fixes security issue"

    Relevant Pages