dcsimg
Linux Today: Linux News On Internet Time.





More on LinuxToday


Mandrake Linux Security Update Advisory: xli/xloadimage update

Sep 13, 2001, 05:25 (0 Talkback[s])

WEBINAR:
On-Demand

Re-Imagining Linux Platforms to Meet the Needs of Cloud Service Providers


Date: Wed, 12 Sep 2001 15:10:16 -0600
From: Linux Mandrake Security Team 
Subject: MDKSA-2001:073-1 - xli/xloadimage update

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           xli/xloadimage
Date:                   September 12th, 2001
Original Advisory Date: August 31st, 2001
Advisory ID:            MDKSA-2001:073-1

Affected versions:      7.1, 7.2, 8.0, Corporate Server 1.0.1
______________________________________________________________________

Problem Description:

 A buffer overflow exists in xli due to missing boundary checks.  This
 could be triggered by an external attacker to execute commands on the
 victim's machine.  An exploit is publically available.  xli is an image
 viewer that is used by Netscape's plugger to display TIFF, PNG, and
 Sun-Raster images.

Update:

 The xloadimage package uses the same code as xli and is likewise
 vulnerable.  An update is provided for xloadimage which was only
 provided with Linux-Mandrake 7.2.
______________________________________________________________________

References:

______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
994bc689c7ab60fac976816abfa71a8e  7.1/RPMS/xli-1.16-4.1mdk.i586.rpm
32eebf37c2562a088409a31b363555c4  7.1/SRPMS/xli-1.16-4.1mdk.src.rpm

Linux-Mandrake 7.2:
2a4a20ba543f917b41ec8b92bda3107a  7.2/RPMS/xli-1.16-7.1mdk.i586.rpm
2f3464a4fcee7a3215de4a765e5fd328  7.2/RPMS/xloadimage-4.1-6.1mdk.i586.rpm
3cf0768d88055b81011b9d56224f3858  7.2/SRPMS/xli-1.16-7.1mdk.src.rpm
61c138ea07acbe91d5c466d70493bea2  7.2/SRPMS/xloadimage-4.1-6.1mdk.src.rpm

Mandrake Linux 8.0:
f1eff4c239eaebb0ff41f169de8ccd3e  8.0/RPMS/xli-1.17.0-1.1mdk.i586.rpm
b3aa5d5d8598e02c8bff9132dd312e06  8.0/SRPMS/xli-1.17.0-1.1mdk.src.rpm

Mandrake Linux 8.0 (PPC):
ae86f1d74de0a0b6fa15b699530a1c6d  ppc/8.0/RPMS/xli-1.17.0-1.1mdk.ppc.rpm
4608ff87dc4de7b0686ceb3a0a67b8dc  ppc/8.0/SRPMS/xli-1.17.0-1.1mdk.src.rpm

Corporate Server 1.0.1:
994bc689c7ab60fac976816abfa71a8e  1.0.1/RPMS/xli-1.16-4.1mdk.i586.rpm
32eebf37c2562a088409a31b363555c4  1.0.1/SRPMS/xli-1.16-4.1mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Mandrake Linux has two security-related mailing list services that
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security