MDKSA-2004:004 - Updated slocate packages fix vulnerability

From: Mandrake Linux Security Team (security_at_linux-mandrake.com)
Date: 01/23/04

  • Next message: Elizabeth Zwicky: "Re: vulnerabilities of postscript printers" 
    Date: 23 Jan 2004 22:11:04 -0000
To: bugtraq@securityfocus.com

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

     _______________________________________________________________________

                    Mandrake Linux Security Update Advisory
     _______________________________________________________________________

     Package name: slocate
     Advisory ID: MDKSA-2004:004
     Date: January 23rd, 2004

     Affected versions: 9.1, 9.2, Corporate Server 2.1
     ______________________________________________________________________

     Problem Description:

     A vulnerability was discovered by Patrik Hornik in slocate versions up
     to and including 2.7 where a carefully crafted database could overflow
     a heap-based buffer. This could be exploited by a local user to gain
     privileges of the 'slocate' group. The updated packages contain a
     patch from Kevin Lindsay that causes slocate to drop privileges before
     reading a user-supplied database.
     _______________________________________________________________________

     References:

      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848
     ______________________________________________________________________

     Updated Packages:
      
     Corporate Server 2.1:
     671ffe86f5f126c12cef97de694a382c corporate/2.1/RPMS/slocate-2.7-2.1.C21mdk.i586.rpm
     a8bc7ae36c40ab05cda054c0faee616a corporate/2.1/SRPMS/slocate-2.7-2.1.C21mdk.src.rpm

     Corporate Server 2.1/x86_64:
     4ef15319c849f40ee280a78809e2792e x86_64/corporate/2.1/RPMS/slocate-2.7-2.1.C21mdk.x86_64.rpm
     a8bc7ae36c40ab05cda054c0faee616a x86_64/corporate/2.1/SRPMS/slocate-2.7-2.1.C21mdk.src.rpm

     Mandrake Linux 9.1:
     178a0c6c116e64c67887c56fcf8f24ff 9.1/RPMS/slocate-2.7-2.1.91mdk.i586.rpm
     b33e093e2178db9b22b8c7dc84f506d2 9.1/SRPMS/slocate-2.7-2.1.91mdk.src.rpm

     Mandrake Linux 9.1/PPC:
     d77bee6d3e3dfb380b78feedb2647f51 ppc/9.1/RPMS/slocate-2.7-2.1.91mdk.ppc.rpm
     b33e093e2178db9b22b8c7dc84f506d2 ppc/9.1/SRPMS/slocate-2.7-2.1.91mdk.src.rpm

     Mandrake Linux 9.2:
     d84f9a28b73dce95ef8948efcec4129b 9.2/RPMS/slocate-2.7-2.1.92mdk.i586.rpm
     c69b0fd21ff789e387609eef25765f07 9.2/SRPMS/slocate-2.7-2.1.92mdk.src.rpm

     Mandrake Linux 9.2/AMD64:
     6ebc353d5ea7c470dfc23020fc29d80a amd64/9.2/RPMS/slocate-2.7-2.1.92mdk.amd64.rpm
     c69b0fd21ff789e387609eef25765f07 amd64/9.2/SRPMS/slocate-2.7-2.1.92mdk.src.rpm
     _______________________________________________________________________

     To upgrade automatically use MandrakeUpdate or urpmi. The verification
     of md5 checksums and GPG signatures is performed automatically for you.

     A list of FTP mirrors can be obtained from:

      http://www.mandrakesecure.net/en/ftp.php

     All packages are signed by MandrakeSoft for security. You can obtain
     the GPG public key of the Mandrake Linux Security Team by executing:

      gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98

     Please be aware that sometimes it takes the mirrors a few hours to
     update.

     You can view other update advisories for Mandrake Linux at:

      http://www.mandrakesecure.net/en/advisories/

     MandrakeSoft has several security-related mailing list services that
     anyone can subscribe to. Information on these lists can be obtained by
     visiting:

      http://www.mandrakesecure.net/en/mlist.php

     If you want to report vulnerabilities, please contact

      security_linux-mandrake.com

     Type Bits/KeyID Date User ID
     pub 1024D/22458A98 2000-07-10 Linux Mandrake Security Team
      <security linux-mandrake.com>
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQFAEZv4mqjQ0CJFipgRAgnnAJ0Q3Z9AvhW384tilcc4HVg1OnOhkQCfZPqD
    3kyxJMP/Sa3Gvr8tkU2/9MQ=
    =1E4d
    -----END PGP SIGNATURE-----

  • Next message: Elizabeth Zwicky: "Re: vulnerabilities of postscript printers"

    Relevant Pages

    • [Full-Disclosure] MDKSA-2004:004 - Updated slocate packages fix vulnerability
      ... A vulnerability was discovered by Patrik Hornik in slocate versions up ... to and including 2.7 where a carefully crafted database could overflow ... Mandrake Linux 9.1/PPC: ... All packages are signed by MandrakeSoft for security. ...
      (Full-Disclosure)
    • MDKSA-2002:016-1 - squid update
      ... Three security issues were found in the 2.x versions of the Squid proxy ... Denial of Service attack on ther server if the SNMP interface is ... The squid updates for all versions other than Mandrake Linux were ... All packages are signed by MandrakeSoft for security. ...
      (Bugtraq)
    • [Security Announce] MDKSA-2001:086 - tetex update
      ... of some teTeX filters by zen-parse. ... You can get the GPG public key of the Mandrake Linux Security Team at ... of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". ...
      (Bugtraq)
    • MDKSA-2001:069 - openldap update
      ... CERT released an advisory that details a number of vulnerabilities as ... You can get the GPG public key of the Mandrake Linux Security Team at ... of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm". ...
      (Bugtraq)
    • MDKSA-2002:044 - squid update
      ... Numerous security problems were fixed in squid-2.4.STABLE7. ... Mandrake Linux 8.0/ppc: ... To upgrade automatically, use MandrakeUpdate. ... All packages are signed by MandrakeSoft for security. ...
      (Bugtraq)