[FLSA-2005:2155] Updated sharutils package fixes security issues

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 03/25/05

  • Next message: Marc Deslauriers: "[FLSA-2005:2129] Updated mysql packages fix security issues" 
    Date: Thu, 24 Mar 2005 18:06:54 -0500
To: bugtraq@securityfocus.com, full-disclosure@lists.grok.org.uk

    ---------------------------------------------------------------------
                    Fedora Legacy Update Advisory

    Synopsis: Updated sharutils package fixes security issues
    Advisory ID: FLSA:2155
    Issue date: 2005-03-24
    Product: Red Hat Linux, Fedora Core
    Keywords: Bugfix
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2155
    CVE Names: N/A
    ---------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    Updated sharutils packages that fix several security issues are now
    available.

    The sharutils package contains a set of tools for encoding and decoding
    packages of files in binary or text format.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386
    Fedora Core 1 - i386

    3. Problem description:

    Ulf Harnhammar discovered a buffer overflow in shar.c, where the length
    of data returned by the wc command is not checked. Florian Schilhabel
    discovered another buffer overflow in unshar.c. Shaun Colley discovered
    a stack-based buffer overflow vulnerability in the -o command-line
    option handler. An attacker could exploit these vulnerabilities to
    execute arbitrary code as the user running one of the sharutils
    programs.

    All users of sharutils should upgrade to these packages, which resolve
    these issues.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www.fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - bug #2155 - GNU Sharutils Multiple Buffer
    Overflows

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.7.x.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/sharutils-4.2.1-12.7.x.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.1.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/sharutils-4.2.1-16.9.1.legacy.i386.rpm

    Fedora Core 1:

    SRPM:
    http://download.fedoralegacy.org/fedora/1/updates/SRPMS/sharutils-4.2.1-17.2.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/1/updates/i386/sharutils-4.2.1-17.2.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------

    192306ce2a6cecb89a950040b850f86a28b26998
    redhat/7.3/updates/i386/sharutils-4.2.1-12.7.x.legacy.i386.rpm
    25fdf9cb3237bb9a7f9cd5fd211412d74f4f05c6
    redhat/7.3/updates/SRPMS/sharutils-4.2.1-12.7.x.legacy.src.rpm
    d6f2e705ae07f48f5dbbc742f44cbc4dea4c446d
    redhat/9/updates/i386/sharutils-4.2.1-16.9.1.legacy.i386.rpm
    678acff4ea03db0aa8bc8f8d90630ffe51d27625
    redhat/9/updates/SRPMS/sharutils-4.2.1-16.9.1.legacy.src.rpm
    457f8c7a9bc795c5d33bd8bb3e508e2b1e884df0
    fedora/1/updates/i386/sharutils-4.2.1-17.2.legacy.i386.rpm
    7fad3189ab60428f22869daf15304aa1c24b3037
    fedora/1/updates/SRPMS/sharutils-4.2.1-17.2.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy.org/about/security.php

    You can verify each package with the following command:

         rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

         sha1sum <filename>

    8. References:

    http://www.securityfocus.com/advisories/7268

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

  • Next message: Marc Deslauriers: "[FLSA-2005:2129] Updated mysql packages fix security issues"

    Relevant Pages