MDKSA-2003:108 - Updated stunnel packagess fix vulnerabilities

From: Mandrake Linux Security Team (security_at_linux-mandrake.com)
Date: 11/26/03

  • Next message: S-Quadra Security Research: "FreeRADIUS <= 0.9.3 rlm_smb module stack overflow vulnerability" 
    Date: 25 Nov 2003 23:23:11 -0000
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

     _______________________________________________________________________

                    Mandrake Linux Security Update Advisory
     _______________________________________________________________________

     Package name: stunnel
     Advisory ID: MDKSA-2003:108
     Date: November 25th, 2003

     Affected versions: 9.0, Corporate Server 2.1
     ______________________________________________________________________

     Problem Description:

     A vulnerability was discovered in stunnel versions 3.24 and earlier,
     as well as 4.00, by Steve Grubb. It was found that stunnel leaks a
     critical file descriptor that can be used to hijack stunnel's services.
     
     All users are encouraged to upgrade to these packages. Note that the
     version of stunnel provided with Mandrake Linux 9.1 and above is not
     vulnerable to this problem.
     _______________________________________________________________________

     References:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0740
      http://marc.theaimsgroup.com/?l=bugtraq&m=106260760211958&w=2
     ______________________________________________________________________

     Updated Packages:
      
     Corporate Server 2.1:
     77c752f98e0685dd677656e56b6a931c corporate/2.1/RPMS/stunnel-3.26-1.1.C21mdk.i586.rpm
     45596e6e50ed995cf4b18f9bd7366828 corporate/2.1/SRPMS/stunnel-3.26-1.1.C21mdk.src.rpm

     Corporate Server 2.1/x86_64:
     f080fa4956c146a3e40dc05ae6dbefe8 x86_64/corporate/2.1/RPMS/stunnel-3.26-1.1.C21mdk.x86_64.rpm
     45596e6e50ed995cf4b18f9bd7366828 x86_64/corporate/2.1/SRPMS/stunnel-3.26-1.1.C21mdk.src.rpm

     Mandrake Linux 9.0:
     6b3eec02f63aa0d7aa64fe79b62e3020 9.0/RPMS/stunnel-3.26-1.1.90mdk.i586.rpm
     14afcc8f0257338107bc60e33919a465 9.0/SRPMS/stunnel-3.26-1.1.90mdk.src.rpm
     _______________________________________________________________________

     To upgrade automatically use MandrakeUpdate or urpmi. The verification
     of md5 checksums and GPG signatures is performed automatically for you.

     A list of FTP mirrors can be obtained from:

      http://www.mandrakesecure.net/en/ftp.php

     All packages are signed by MandrakeSoft for security. You can obtain
     the GPG public key of the Mandrake Linux Security Team by executing:

      gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

     Please be aware that sometimes it takes the mirrors a few hours to
     update.

     You can view other update advisories for Mandrake Linux at:

      http://www.mandrakesecure.net/en/advisories/

     MandrakeSoft has several security-related mailing list services that
     anyone can subscribe to. Information on these lists can be obtained by
     visiting:

      http://www.mandrakesecure.net/en/mlist.php

     If you want to report vulnerabilities, please contact

      security_linux-mandrake.com

     Type Bits/KeyID Date User ID
     pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
      <security linux-mandrake.com>
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQE/w+RemqjQ0CJFipgRAuUIAKDdYwxqoypl0y+wfTEfLG4MJG0f6wCghpjv
    bHqo7kvknxYGU6UCt52D4I0=
    =Bzsl
    -----END PGP SIGNATURE-----

  • Next message: S-Quadra Security Research: "FreeRADIUS <= 0.9.3 rlm_smb module stack overflow vulnerability"

    Relevant Pages

    • MDKSA-2001:079-2 - kernel updaet
      ... Alexander Viro discovered a vulnerability in the devfs implementation ... arbitrary amount of time in the kernel code. ... You can get the GPG public key of the Mandrake Linux Security Team at ...
      (Bugtraq)
    • [Full-Disclosure] MDKSA-2003:108 - Updated stunnel packagess fix vulnerabilities
      ... A vulnerability was discovered in stunnel versions 3.24 and earlier, ... version of stunnel provided with Mandrake Linux 9.1 and above is not ... All packages are signed by MandrakeSoft for security. ...
      (Full-Disclosure)
    • MDKSA-2001:079-1 - kernel 2.4 update
      ... Subject: MDKSA-2001:079-1 - kernel 2.4 update ... Alexander Viro discovered a vulnerability in the devfs implementation ... You can get the GPG public key of the Mandrake Linux Security Team at ...
      (Bugtraq)
    • MDKSA-2001:053-1 - gnupg update
      ... A format string vulnerability exists in gnupg 1.0.5 and previous ... You can get the GPG public key of the Linux-Mandrake Security Team at ... Mandrake Linux 8.0: ...
      (Bugtraq)
    • MDKSA-2003:091 - Updated kdebase packages fix vulnerabilities in KDM
      ... KDM may grant local root access to any user with valid ... It is also possible that this vulnerability ... Mandrake Linux 9.0: ... All packages are signed by MandrakeSoft for security. ...
      (Bugtraq)