dcsimg
Linux Today: Linux News On Internet Time.





Five Mandrake Linux Update Advisories: gnupg, procmail, Linux kernels 2.2 and 2.4, and teTeX

Nov 21, 2001, 07:55 (1 Talkback[s])
Date: Tue, 20 Nov 2001 08:58:40 -0700
From: Linux Mandrake Security Team 
Subject: MDKSA-2001:053-1 - gnupg update

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           gnupg
Advisory Date:          November 20th, 2001
Original Advisory Date: May 30th, 2001
Advisory ID:            MDKSA-2001:053-1

Affected versions:      7.1, 7.2, 8.0, 8.1, Corporate Server 1.0.1
______________________________________________________________________

Problem Description:

 A format string vulnerability exists in gnupg 1.0.5 and previous
 versions which is fixed in 1.0.6.  This vulnerability can be used to
 invoke shell commands with privileges of the currently logged-in user.

Update:

 The /usr/bin/gpg executable was installed setuid root and setgid root.
 While being setuid root offers locking pages in physical memory to avoid
 writing sensitive material to swap and is of  benefit, being setgid root
 provides no benefits and allows users to write to files that have group
 root access.  This update strips the setgid bit from /usr/bin/gpg.
______________________________________________________________________

References:

 http://archives.indenial.com/hypermail/bugtraq/2001/May2001/0275.html
______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Linux-Mandrake Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
7c92d999d62389409b5b361fb6f6d781  7.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm
f1cabc830673bcbb4211bb55dc0b83ea  7.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm

Linux-Mandrake 7.2:
932d06a4fc7f4d4c61072ece8b01c1ee  7.2/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm
2754b94d115e26cc62dae07ff7af20e7  7.2/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

Mandrake Linux 8.0:
805e5899b4187fccefb5c6de7fe16306  8.0/RPMS/gnupg-1.0.6-2.1mdk.i586.rpm
2754b94d115e26cc62dae07ff7af20e7  8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

Mandrake Linux 8.0 (PPC):
8f0d25a0d7c49532590f85f22fb78b1e  ppc/8.0/RPMS/gnupg-1.0.6-2.1mdk.ppc.rpm
2754b94d115e26cc62dae07ff7af20e7  ppc/8.0/SRPMS/gnupg-1.0.6-2.1mdk.src.rpm

Mandrake Linux 8.1:
94ce027aa75451a1b465e8f573e5b1e0  8.1/RPMS/gnupg-1.0.6-3.1mdk.i586.rpm
30c1821c47d751d3e1bde958bfe42d05  8.1/SRPMS/gnupg-1.0.6-3.1mdk.src.rpm

Corporate Server 1.0.1:
7c92d999d62389409b5b361fb6f6d781  1.0.1/RPMS/gnupg-1.0.6-2.2mdk.i586.rpm
f1cabc830673bcbb4211bb55dc0b83ea  1.0.1/SRPMS/gnupg-1.0.6-2.2mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Linux-Mandrake 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Linux-Mandrake at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Linux-Mandrake has two security-related mailing list services that
anyone can subscribe to:

security-announce@linux-mandrake.com

  Linux-Mandrake's security announcements mailing list.  Only
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Linux-Mandrake's security discussion mailing list.  This list is open
  to anyone to discuss Linux-Mandrake security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7+n2KmqjQ0CJFipgRAn0AAKCvCJGD3eYH2beq9VvzWsrKouOcwgCgsNRG
nFFikl6a64NQ+0X/VZ8zgYc=
=9x10
-----END PGP SIGNATURE-----


Date: Tue, 20 Nov 2001 19:55:17 -0700
From: Linux Mandrake Security Team 
To: Linux Mandrake Security Announcements 
Subject: MDKSA-2001:082-1 - kernel22 update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           kernel22
Date:                   November 20th, 2001
Original Advisory Date: October 26th, 2001
Advisory ID:            MDKSA-2001:082-1

Affected versions:      7.1, 7.2, 8.0, 8.1, Corporate Server 1.0.1,
                        Single Network Firewall 7.2
______________________________________________________________________

Problem Description:

 Rafal Wojtczuk found a vulnerability in the 2.2.19 and 2.4.11 Linux
 kernels with the ptrace code and deeply nested symlinks spending an
 arbitrary amount of time in the kernel code.  The ptrace vulnerability
 could be used by local users to gain root privilege, the symlink
 vulnerability could result in a local DoS.

Update:

 There is an additional vulnerability in the kernel's syncookie code
 which could potentially allow a remote attacker to guess the cookie
 and bypass existing firewall rules.  The discovery was found by Manfred
 Spraul and Andi Kleen.

 NOTE: This update is not meant to be done via MandrakeUpdate!  You
 must download the necessary RPMs and upgrade manually by following
 these steps:

   1.  Type: rpm -ivh kernel-[version].i586.rpm
   2.  Type: mv kernel-[version].i586.rpm /tmp
   3.  Type: rpm -Fvh *.rpm
   4a. You may wish to edit /etc/lilo.conf to ensure a new entry is in
       place.  The new kernel will be the last entry.  Change any options
       you need to change.  You will also want to create a new entry with
       the initrd and image directives pointing to the old kernel's
       vmlinuz and initrd images so you may also boot from the old
       images if required.
   4b. PPC users must execute some additional instructions.  First edit
       /etc/yaboot.conf and add a new entry for the kernel and change
       any options that you need to change.  You must also create a new
       initrd image to enable USB support for keyboards and mice by
       typing: 
         mkinitrd --with=usb-ohci /boot/initrd-2.2.19-20.1mdk 2.2.19-20.1mdk
   5a. If you use lilo, type: /sbin/lilo -v
   5b. If you use GRUB, type: sh /boot/grub/install.sh
   5c. PPC users must type: /sbin/ybin -v

 You may then reboot and use the new kernel and remove the older kernel
 when you are comfortable using the upgraded one.
______________________________________________________________________

References:

  http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=221337
______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
7e650c33ccde99f5b363b61f8d804925  7.1/RPMS/alsa-2.2.19_0.5.10b-6.3mdk.i586.rpm
5a8a686a2c173b5a93739f1d40b25af8  7.1/RPMS/alsa-source-2.2.19_0.5.10b-6.3mdk.i586.rpm
ccb0385a7979cb5417ab24a71810ca5c  7.1/RPMS/kernel-2.2.19-6.3mdk.i586.rpm
48deff36ef6d3a0a9f347444fe67ebae  7.1/RPMS/kernel-doc-2.2.19-6.3mdk.i586.rpm
e38bf6850677df3028dfe9c29d731a5e  7.1/RPMS/kernel-headers-2.2.19-6.3mdk.i586.rpm
25365c277d604eebd765eb6eef9034d6  7.1/RPMS/kernel-linus-2.2.20-1.1mdk.i586.rpm
a079098328d93377cfc77bbfd0fa5b41  7.1/RPMS/kernel-pcmcia-cs-2.2.19-6.3mdk.i586.rpm
12fb5d22fe388f1e3ae98a12946ac2e9  7.1/RPMS/kernel-secure-2.2.19-6.3mdk.i586.rpm
c80182d30b738ce231c14b685653b648  7.1/RPMS/kernel-smp-2.2.19-6.3mdk.i586.rpm
50a01ee4ee671ba81b5a5595e6ff30a5  7.1/RPMS/kernel-source-2.2.19-6.3mdk.i586.rpm
b1b2bbe9bd2efab067f084d05b480f3c  7.1/RPMS/kernel-utils-2.2.19-6.3mdk.i586.rpm
35273dc0d85060d4d43d0dffff3367e5  7.1/RPMS/reiserfs-utils-2.2.19_3.5.29-6.3mdk.i586.rpm
89b0010d325af6c0ddb435bb1a0b186b  7.1/SRPMS/kernel-2.2.19-6.3mdk.src.rpm
a83661eb60ad027e07e56249f40632b0  7.1/SRPMS/kernel-linus-2.2.20-1.1mdk.src.rpm

Linux-Mandrake 7.2:
cd9ff8472b32e9ce0830c73a0aecd2de  7.2/RPMS/alsa-2.2.19_0.5.10b-6.3mdk.i586.rpm
3e8c073ca85907bbb3afb2e1f3163210  7.2/RPMS/alsa-source-2.2.19_0.5.10b-6.3mdk.i586.rpm
8937ec19b78e6060dfb5d70fd52119fb  7.2/RPMS/kernel-2.2.19-6.3mdk.i586.rpm
721c0ff12e0912d5ee4a1db51f333e4c  7.2/RPMS/kernel-doc-2.2.19-6.3mdk.i586.rpm
7d545e7921db6879ffa2e69eb5ad03d8  7.2/RPMS/kernel-headers-2.2.19-6.3mdk.i586.rpm
918f656a5929a8ed596fad2c75e0e862  7.2/RPMS/kernel-linus-2.2.20-1.1mdk.i586.rpm
154ed43baabafcc43dccb4acb4603a01  7.2/RPMS/kernel-pcmcia-cs-2.2.19-6.3mdk.i586.rpm
4f897474c98abbb4527bc87f8a5a4a1c  7.2/RPMS/kernel-secure-2.2.19-6.3mdk.i586.rpm
d26791b7ed55fa4d15df3cd875925f00  7.2/RPMS/kernel-smp-2.2.19-6.3mdk.i586.rpm
ed55c53e22493c20e87db3dd609c5ba9  7.2/RPMS/kernel-source-2.2.19-6.3mdk.i586.rpm
387126682af922f1b8a67f8396bbe9d6  7.2/RPMS/kernel-utils-2.2.19-6.3mdk.i586.rpm
05d52ad1e52279797f27d7446732e0ea  7.2/RPMS/reiserfs-utils-2.2.19_3.5.29-6.3mdk.i586.rpm
89b0010d325af6c0ddb435bb1a0b186b  7.2/SRPMS/kernel-2.2.19-6.3mdk.src.rpm
a83661eb60ad027e07e56249f40632b0  7.2/SRPMS/kernel-linus-2.2.20-1.1mdk.src.rpm

Mandrake Linux 8.0:
0ed0a37ff3ce8c62628cd77db324bcde  8.0/RPMS/kernel-linus2.2-2.2.20-1.1mdk.i586.rpm
cc147d2b191a07b1666a2efc81ecdbe4  8.0/RPMS/kernel22-2.2.19-20.1mdk.i586.rpm
dbf5f98a59160ca4cf61ff7b4b57ca3e  8.0/RPMS/kernel22-secure-2.2.19-20.1mdk.i586.rpm
fb209416d7b6ebfcd1efa26f8b3ab369  8.0/RPMS/kernel22-smp-2.2.19-20.1mdk.i586.rpm
e243eabd5f5ebb514332052da5272032  8.0/RPMS/kernel22-source-2.2.19-20.1mdk.i586.rpm
cef69adaebdd65d433189d6a0193ba99  8.0/SRPMS/kernel-linus2.2-2.2.20-1.1mdk.src.rpm
526e2b6f1548d1539d3479582b6c8b87  8.0/SRPMS/kernel22-2.2.19-20.1mdk.src.rpm

Mandrake Linux 8.0 (PPC):
767dbbc36d5a6b7311923d9391166016  ppc/8.0/RPMS/kernel22-2.2.19-20.1mdk.ppc.rpm
d5bdf324f86c19198d257f373942ad8c  ppc/8.0/RPMS/kernel22-secure-2.2.19-20.1mdk.ppc.rpm
e9630cabe3d16c4a8e6fbcf6d073c89b  ppc/8.0/RPMS/kernel22-smp-2.2.19-20.1mdk.ppc.rpm
ae3b4e8322e4200e97c5a06217fa4d29  ppc/8.0/RPMS/kernel22-source-2.2.19-20.1mdk.ppc.rpm
526e2b6f1548d1539d3479582b6c8b87  ppc/8.0/SRPMS/kernel22-2.2.19-20.1mdk.src.rpm

Mandrake Linux 8.1:
7caa63f9a302fd15d24e4be65544885a  8.1/RPMS/kernel-linus2.2-2.2.20-1.1mdk.i586.rpm
0599738b69f92d83eb34a0f441823f25  8.1/RPMS/kernel22-2.2.19-20.1mdk.i586.rpm
243a809d39cc229ea2befc1dd70d3205  8.1/RPMS/kernel22-secure-2.2.19-20.1mdk.i586.rpm
fd112bdbb8a1441c97986e59ab0f5f19  8.1/RPMS/kernel22-smp-2.2.19-20.1mdk.i586.rpm
ab755bcde2b50f83ed0fe402808c104c  8.1/RPMS/kernel22-source-2.2.19-20.1mdk.i586.rpm
cef69adaebdd65d433189d6a0193ba99  8.1/SRPMS/kernel-linus2.2-2.2.20-1.1mdk.src.rpm
526e2b6f1548d1539d3479582b6c8b87  8.1/SRPMS/kernel22-2.2.19-20.1mdk.src.rpm

Corporate Server 1.0.1:
c3e90e324254308ddc15435294694bcb  1.0.1/RPMS/alsa-2.2.19_0.5.10b-6.3mdk.i586.rpm
14fc90f92fea89b129a31cafc865e591  1.0.1/RPMS/alsa-source-2.2.19_0.5.10b-6.3mdk.i586.rpm
1a1bf98dff0c15f81bbed1bf503ca255  1.0.1/RPMS/kernel-2.2.19-6.3mdk.i586.rpm
2f0f99f5e693ebeb6b45693936047dcc  1.0.1/RPMS/kernel-doc-2.2.19-6.3mdk.i586.rpm
10b734be7730eb087139be097001f7ab  1.0.1/RPMS/kernel-headers-2.2.19-6.3mdk.i586.rpm
32000acc7fbe0ddfd1860bf05056e684  1.0.1/RPMS/kernel-pcmcia-cs-2.2.19-6.3mdk.i586.rpm
eaf9d2846ebac965272f609cc04c5dca  1.0.1/RPMS/kernel-secure-2.2.19-6.3mdk.i586.rpm
b6f35e83c343e560187c2fa1f027d448  1.0.1/RPMS/kernel-smp-2.2.19-6.3mdk.i586.rpm
82e924bb97ce8fd2bfcd07e2c925e536  1.0.1/RPMS/kernel-source-2.2.19-6.3mdk.i586.rpm
328a6a050b68bed30ebac3ef003abba3  1.0.1/RPMS/kernel-utils-2.2.19-6.3mdk.i586.rpm
459aa83b8c9920846544847a62bbd91f  1.0.1/RPMS/reiserfs-utils-2.2.19_3.5.29-6.3mdk.i586.rpm
89b0010d325af6c0ddb435bb1a0b186b  1.0.1/SRPMS/kernel-2.2.19-6.3mdk.src.rpm
a83661eb60ad027e07e56249f40632b0  1.0.1/SRPMS/kernel-linus-2.2.20-1.1mdk.src.rpm

Single Network Firewall 7.2:
8937ec19b78e6060dfb5d70fd52119fb  snf7.2/RPMS/kernel-2.2.19-6.3mdk.i586.rpm
721c0ff12e0912d5ee4a1db51f333e4c  snf7.2/RPMS/kernel-doc-2.2.19-6.3mdk.i586.rpm
7d545e7921db6879ffa2e69eb5ad03d8  snf7.2/RPMS/kernel-headers-2.2.19-6.3mdk.i586.rpm
918f656a5929a8ed596fad2c75e0e862  snf7.2/RPMS/kernel-linus-2.2.20-1.1mdk.i586.rpm
154ed43baabafcc43dccb4acb4603a01  snf7.2/RPMS/kernel-pcmcia-cs-2.2.19-6.3mdk.i586.rpm
4f897474c98abbb4527bc87f8a5a4a1c  snf7.2/RPMS/kernel-secure-2.2.19-6.3mdk.i586.rpm
d26791b7ed55fa4d15df3cd875925f00  snf7.2/RPMS/kernel-smp-2.2.19-6.3mdk.i586.rpm
ed55c53e22493c20e87db3dd609c5ba9  snf7.2/RPMS/kernel-source-2.2.19-6.3mdk.i586.rpm
387126682af922f1b8a67f8396bbe9d6  snf7.2/RPMS/kernel-utils-2.2.19-6.3mdk.i586.rpm
05d52ad1e52279797f27d7446732e0ea  snf7.2/RPMS/reiserfs-utils-2.2.19_3.5.29-6.3mdk.i586.rpm
89b0010d325af6c0ddb435bb1a0b186b  snf7.2/SRPMS/kernel-2.2.19-6.3mdk.src.rpm
a83661eb60ad027e07e56249f40632b0  snf7.2/SRPMS/kernel-linus-2.2.20-1.1mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Mandrake Linux has two security-related mailing list services that 
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only 
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team 
  


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7+xdImqjQ0CJFipgRAtbsAJ42ggW0Dr1G82soRvuKJMSVksjgvQCgqKqg
u/rwIFZD4+J0K5Z+91E4xkM=
=OP/K
-----END PGP SIGNATURE-----



Date: Tue, 20 Nov 2001 08:59:28 -0700
From: Linux Mandrake Security Team 
To: Linux Mandrake Security Announcements 
Subject: MDKSA-2001:086 - tetex update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           tetex

Date:                   November 20th, 2001
Advisory ID:            MDKSA-2001:086

Affected versions:      7.1, 7.2, 8.0, 8.1, Corporate Server 1.0.1
______________________________________________________________________

Problem Description:

 A problem was discovered in the temporary file handling capabilities
 of some teTeX filters by zen-parse.  These filters are used as print
 filters automatically when printing .dvi files using lpr.  This can
 lead to elevated privileges.  This update relies on the updated mktemp
 packages for 7.x in MDKA-2001:021, which gives mktemp the ability to
 create temporary directories.  8.x users already have a mktemp that
 works in this fashion.
______________________________________________________________________

References:

  http://www.securityfocus.com/archive/1/192647
  https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=43342
______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
03ef1ee1b633f7b15a96e0aaeb7add41  7.1/RPMS/tetex-1.0.7-6.1mdk.i586.rpm
d8adc388002098ee54c25a85e48a1861  7.1/RPMS/tetex-afm-1.0.7-6.1mdk.i586.rpm
bf8af031068beb610175b69c2f56bf83  7.1/RPMS/tetex-doc-1.0.7-6.1mdk.i586.rpm
f1a8dfd94a0da14dc9446d7a1d58f227  7.1/RPMS/tetex-dvilj-1.0.7-6.1mdk.i586.rpm
25ed14dcdd9b3ba3862387d22eab47ca  7.1/RPMS/tetex-dvips-1.0.7-6.1mdk.i586.rpm
0a2951e2aee8ed37a2b206efa37e0a90  7.1/RPMS/tetex-latex-1.0.7-6.1mdk.i586.rpm
c5c7882c0d386ca5176464b52b583afa  7.1/RPMS/tetex-xdvi-1.0.7-6.1mdk.i586.rpm
f25809018552ee50468b8695562703f5  7.1/SRPMS/tetex-1.0.7-6.1mdk.src.rpm

Linux-Mandrake 7.2:
51007b87bf1dba689b08a7a2d481409d  7.2/RPMS/tetex-1.0.7-11.1mdk.i586.rpm
df7ecae9c6f7080ed3e869e5f5723dfb  7.2/RPMS/tetex-afm-1.0.7-11.1mdk.i586.rpm
046adf359223e78bfb174128019f8c2b  7.2/RPMS/tetex-doc-1.0.7-11.1mdk.i586.rpm
8924196a007e4358fbb4295ad0ffdd08  7.2/RPMS/tetex-dvilj-1.0.7-11.1mdk.i586.rpm
95713800fbf8d5cecaeeb4f0112ab0bb  7.2/RPMS/tetex-dvips-1.0.7-11.1mdk.i586.rpm
3ae21fe8d70ef236944be4a3f065c053  7.2/RPMS/tetex-latex-1.0.7-11.1mdk.i586.rpm
313f849bb6578966e78463799d37b019  7.2/RPMS/tetex-xdvi-1.0.7-11.1mdk.i586.rpm
f7f1a22b452d0acdbbc9424f73686ab5  7.2/SRPMS/tetex-1.0.7-11.1mdk.src.rpm

Mandrake Linux 8.0:
a5e5697f6b6c521e3132a0ccaa3bcdaa  8.0/RPMS/tetex-1.0.7-21.1mdk.i586.rpm
37132ac11983dfccb2ee7c1d9ff0203d  8.0/RPMS/tetex-afm-1.0.7-21.1mdk.i586.rpm
658a56ca65ddddfc0d4a288eec16a5d5  8.0/RPMS/tetex-doc-1.0.7-21.1mdk.i586.rpm
6213815683453df4029c4190c3ca4285  8.0/RPMS/tetex-dvilj-1.0.7-21.1mdk.i586.rpm
b79a68dbfba6c2bbc9455e93c3aa9b08  8.0/RPMS/tetex-dvipdfm-1.0.7-21.1mdk.i586.rpm
7c78663dff6b7d6110d52360ffe51bdf  8.0/RPMS/tetex-dvips-1.0.7-21.1mdk.i586.rpm
63e5cce1fed58e0870f067ef7d345f83  8.0/RPMS/tetex-latex-1.0.7-21.1mdk.i586.rpm
73d00015e30e78cdaf4fed01863696f2  8.0/RPMS/tetex-xdvi-1.0.7-21.1mdk.i586.rpm
c9d8502ab2e9ee1cbce62074dafc9ea9  8.0/SRPMS/tetex-1.0.7-21.1mdk.src.rpm

Mandrake Linux 8.0 (PPC):
4c4431b6b402049f1616519b7f17f4e3  ppc/8.0/RPMS/tetex-1.0.7-21.1mdk.ppc.rpm
044a5b357a7a5e6c5e6b75f917427333  ppc/8.0/RPMS/tetex-afm-1.0.7-21.1mdk.ppc.rpm
ae24f1aae2d0cc8fe306256916fd7c45  ppc/8.0/RPMS/tetex-doc-1.0.7-21.1mdk.ppc.rpm
26c8812140346ca3524974b44487fd26  ppc/8.0/RPMS/tetex-dvilj-1.0.7-21.1mdk.ppc.rpm
127a7b1c4a8cce9e54315508ad6f4db7  ppc/8.0/RPMS/tetex-dvipdfm-1.0.7-21.1mdk.ppc.rpm
a3eba4dac3b4f0944b26a4a3b625d95e  ppc/8.0/RPMS/tetex-dvips-1.0.7-21.1mdk.ppc.rpm
0316f1614af04b923ffd20b95cb98f3e  ppc/8.0/RPMS/tetex-latex-1.0.7-21.1mdk.ppc.rpm
9c02e6a5ed8ed4d3f5cf9ce7637703f4  ppc/8.0/RPMS/tetex-xdvi-1.0.7-21.1mdk.ppc.rpm
c9d8502ab2e9ee1cbce62074dafc9ea9  ppc/8.0/SRPMS/tetex-1.0.7-21.1mdk.src.rpm

Mandrake Linux 8.1:
2d7aaee76ce94274b105c89ae9104d9e  8.1/RPMS/tetex-1.0.7-31.1mdk.i586.rpm
ea793c3d29c61bd5cafbf90a7ab93ac7  8.1/RPMS/tetex-afm-1.0.7-31.1mdk.i586.rpm
fcc2d001813252656f5b2c5a140c3937  8.1/RPMS/tetex-doc-1.0.7-31.1mdk.i586.rpm
53881ceff47afb6723b22f5dee508cec  8.1/RPMS/tetex-dvilj-1.0.7-31.1mdk.i586.rpm
ce6fd105fdc6dcee614747b02fad8e52  8.1/RPMS/tetex-dvipdfm-1.0.7-31.1mdk.i586.rpm
2bd08b27ad7961e5405532f58ca840b0  8.1/RPMS/tetex-dvips-1.0.7-31.1mdk.i586.rpm
a454c5cf0e0031a85e6ecfd9e6e32c5e  8.1/RPMS/tetex-latex-1.0.7-31.1mdk.i586.rpm
55841068d15f1509a3bbefa9ecf89865  8.1/RPMS/tetex-xdvi-1.0.7-31.1mdk.i586.rpm
295d0cd04109922869668dcd21f203b5  8.1/SRPMS/tetex-1.0.7-31.1mdk.src.rpm

Corporate Server 1.0.1:
03ef1ee1b633f7b15a96e0aaeb7add41  1.0.1/RPMS/tetex-1.0.7-6.1mdk.i586.rpm
d8adc388002098ee54c25a85e48a1861  1.0.1/RPMS/tetex-afm-1.0.7-6.1mdk.i586.rpm
bf8af031068beb610175b69c2f56bf83  1.0.1/RPMS/tetex-doc-1.0.7-6.1mdk.i586.rpm
f1a8dfd94a0da14dc9446d7a1d58f227  1.0.1/RPMS/tetex-dvilj-1.0.7-6.1mdk.i586.rpm
25ed14dcdd9b3ba3862387d22eab47ca  1.0.1/RPMS/tetex-dvips-1.0.7-6.1mdk.i586.rpm
0a2951e2aee8ed37a2b206efa37e0a90  1.0.1/RPMS/tetex-latex-1.0.7-6.1mdk.i586.rpm
c5c7882c0d386ca5176464b52b583afa  1.0.1/RPMS/tetex-xdvi-1.0.7-6.1mdk.i586.rpm
f25809018552ee50468b8695562703f5  1.0.1/SRPMS/tetex-1.0.7-6.1mdk.src.rpm

______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Mandrake Linux has two security-related mailing list services that
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7+gMvmqjQ0CJFipgRAsXBAKDUvFQmjx38nWwMWmdBAW4NXXwDOQCfUBWY
a7l0N39ZBqeefx9zUf5dEvE=
=tK23
-----END PGP SIGNATURE-----



Date: Tue, 20 Nov 2001 19:55:59 -0700
From: Linux Mandrake Security Team 
To: Linux Mandrake Security Announcements 
Subject: MDKSA-2001:079-1 - kernel 2.4 update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           kernel
Date:                   November 20th, 2001
Original Advisory Date: October 8th, 2001
Advisory ID:            MDKSA-2001:079-1

Affected versions:      8.0, 8.1
______________________________________________________________________

Problem Description:

 Alexander Viro discovered a vulnerability in the devfs implementation
 that is shipped with Mandrake Linux 8.1.  We are aware of the problem
 and are currently working on a solution.  As a workaround, until an
 update becomes available, please boot with the devfs=nomount option.

Update:

 Rafal Wojtczuk found a vulnerability in the 2.2.19 and 2.4.11 Linux
 kernels with the ptrace code and deeply nested symlinks spending an
 arbitrary amount of time in the kernel code.  The ptrace vulnerability
 could be used by local users to gain root privilege, the symlink
 vulnerability could result in a local DoS.

 There is an additional vulnerability in the kernel's syncookie code
 which could potentially allow a remote attacker to guess the cookie
 and bypass existing firewall rules.  The discovery was found by Manfred
 Spraul and Andi Kleen.

 NOTE: This update is not meant to be done via MandrakeUpdate!  You
 must download the necessary RPMs and upgrade manually by following
 these steps:

   1.  Type: rpm -ivh kernel-[version].i586.rpm
   2.  Type: mv kernel-[version].i586.rpm /tmp
   3.  Type: rpm -Fvh *.rpm
   4a. You may wish to edit /etc/lilo.conf to ensure a new entry is in
       place.  The new kernel will be the last entry.  Change any options
       you need to change.  You will also want to create a new entry with
       the initrd and image directives pointing to the old kernel's
       vmlinuz and initrd images so you may also boot from the old
       images if required.
   4b. PPC users must execute some additional instructions.  First edit
       /etc/yaboot.conf and add a new entry for the kernel and change
       any options that you need to change.  You must also create a new
       initrd image to enable USB support for keyboards and mice by
       typing: 
         mkinitrd --with=usb-ohci /boot/initrd-2.4.8-31.3mdk 2.4.8-31.3mdk
   5a. If you use lilo, type: /sbin/lilo -v
   5b. If you use GRUB, type: sh /boot/grub/install.sh
   5c. PPC users must type: /sbin/ybin -v

 You may then reboot and use the new kernel and remove the older kernel
 when you are comfortable using the upgraded one.
______________________________________________________________________

References:

  http://www.securityfocus.com/cgi-bin/archive.pl?id=1&mid=221337
______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Mandrake Linux 8.0:
c06d61d09887f1e5ac96688b417d5530  8.0/RPMS/kernel-2.4.8-31.2mdk.i586.rpm
b68609db486f9ad32478a8e8ae3002bb  8.0/RPMS/kernel-doc-2.4.8-31.2mdk.i586.rpm
5d16f8f9d6af21f7454663715ec586c7  8.0/RPMS/kernel-enterprise-2.4.8-31.2mdk.i586.rpm
845e68323ad61919b8702b3352114537  8.0/RPMS/kernel-headers-2.4.8-31.2mdk.i586.rpm
cc08db1a3df3f1ac9f4093246c06e5be  8.0/RPMS/kernel-pcmcia-cs-2.4.8-31.2mdk.i586.rpm
202531142a98174a62249d0d31131d17  8.0/RPMS/kernel-smp-2.4.8-31.2mdk.i586.rpm
8d7bd827e13b1d76f75569e92b8ecd1c  8.0/RPMS/kernel-source-2.4.8-31.2mdk.i586.rpm
5d26269acdd4a9c495c641472a4e3997  8.0/RPMS/iptables-1.2.4-1.2mdk.i586.rpm
cc5f29b474658d4a62c36921ac481994  8.0/RPMS/iptables-ipv6-1.2.4-1.2mdk.i586.rpm
b94a340b5dbd786a064408a0cce86378  8.0/SRPMS/kernel-2.4.8-31.2mdk.src.rpm
0594f5c83b5211a3b7e53e33573cd624  8.0/SRPMS/iptables-1.2.4-1.2mdk.src.rpm

Mandrake Linux 8.0 (PPC):
0aa32aede5b608d28b6d9fbaa4c63cc6  ppc/8.0/RPMS/kernel-2.4.8-31.3mdk.ppc.rpm
f149d44938b761469cc2e7cb3941ba35  ppc/8.0/RPMS/kernel-doc-2.4.8-31.3mdk.ppc.rpm
1e6a534996f0607691017558d29e4d25  ppc/8.0/RPMS/kernel-headers-2.4.8-31.3mdk.ppc.rpm
de3d61cd0fc4607b4d0d06218c038abd  ppc/8.0/RPMS/kernel-pcmcia-cs-2.4.8-31.3mdk.ppc.rpm
497d1605e64307f3a59a59950cf859d4  ppc/8.0/RPMS/kernel-smp-2.4.8-31.3mdk.ppc.rpm
b89aeb776055a44482e30f0b517b0a3a  ppc/8.0/RPMS/kernel-source-2.4.8-31.3mdk.ppc.rpm
5f56bcb641218c4400b557856c9803a5  ppc/8.0/RPMS/iptables-1.2.4-1.2mdk.ppc.rpm
bdec7f857adc7714ba94f3a8c33892e4  ppc/8.0/RPMS/iptables-ipv6-1.2.4-1.2mdk.ppc.rpm
239f261222d20e7ba02a22dbc688083b  ppc/8.0/RPMS/mol-kmods-0.9.60-1.1mdk.ppc.rpm
955de0bd16773e32dc05d0a924d9af8d  ppc/8.0/SRPMS/kernel-2.4.8-31.3mdk.src.rpm
0594f5c83b5211a3b7e53e33573cd624  ppc/8.0/SRPMS/iptables-1.2.4-1.2mdk.src.rpm
c347a001bc50800b063b0bcc4042baf9  ppc/8.0/SRPMS/mol-kmods-0.9.60-1.1mdk.src.rpm

Mandrake Linux 8.1:
ac948f0f05c237828b9be37f294192f9  8.1/RPMS/kernel-2.4.8-34.1mdk.i586.rpm
456abd9dd5678c2e01ec35ebf2401a39  8.1/RPMS/kernel-doc-2.4.8-34.1mdk.i586.rpm
2e96d98445e0b89d64295a79839ef27c  8.1/RPMS/kernel-enterprise-2.4.8-34.1mdk.i586.rpm
0aa5966f6d53af5e1473e6bf1b891403  8.1/RPMS/kernel-headers-2.4.8-34.1mdk.i586.rpm
429325fb8bc48392ea182d6f2e0f2849  8.1/RPMS/kernel-pcmcia-cs-2.4.8-34.1mdk.i586.rpm
f0cfd6472b15f22b1820b948a3c78537  8.1/RPMS/kernel-smp-2.4.8-34.1mdk.i586.rpm
9564cb8602d480dc035b7e5919af7fe6  8.1/RPMS/kernel-source-2.4.8-34.1mdk.i586.rpm
6196af50631c01ad75224ad224509b2d  8.1/RPMS/iptables-1.2.4-1.1mdk.i586.rpm
e374e4488342312a8deaa28e2d8796ac  8.1/RPMS/iptables-ipv6-1.2.4-1.1mdk.i586.rpm
12f133a9760bce2c7fb06939c2afd180  8.1/SRPMS/kernel-2.4.8-34.1mdk.src.rpm
24bdff60d2a6fadc8abe2a47619590d8  8.1/SRPMS/iptables-1.2.4-1.1mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Mandrake Linux has two security-related mailing list services that 
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only 
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team 
  


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7+xc4mqjQ0CJFipgRAmUWAKCUfvPulcT6lWyinP9BEZ8oxyRV0gCeJWkT
+1YNY6ZXapVsYQT3/a//41w=
=mfSv
-----END PGP SIGNATURE-----


Date: Tue, 20 Nov 2001 08:55:49 -0700
From: Linux Mandrake Security Team 
To: Linux Mandrake Security Announcements 
Subject: MDKSA-2001:085 - procmail update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________

                Mandrake Linux Security Update Advisory
______________________________________________________________________

Package name:           procmail
Date:                   November 20th, 2001
Advisory ID:            MDKSA-2001:085

Affected versions:      7.1, 7.2, 8.0, 8.1, Corporate Server 1.0.1,
                        Single Network Firewall 7.2
______________________________________________________________________

Problem Description:

 In older versions of procmail, it is possible to crash procmail by
 sending it certain signals.  If procmail is installed setuid, this
 could be exploited to gain unauthorized privilege.  This problem is
 fixed in unstable version 3.20 and stable version 3.15.2.
______________________________________________________________________

References:

______________________________________________________________________

Please verify the update prior to upgrading to ensure the integrity of
the downloaded package.  You can do this with the command:
  rpm --checksig package.rpm
You can get the GPG public key of the Mandrake Linux Security Team at
  http://www.linux-mandrake.com/en/security/RPM-GPG-KEYS
If you use MandrakeUpdate, the verification of md5 checksum and GPG
signature is performed automatically for you.

Linux-Mandrake 7.1:
6a6303d135b4f58247b8c211a7fd4928  7.1/RPMS/procmail-3.15.2-1.4mdk.i586.rpm
650b9e7fab6c3413f88268263c270dbb  7.1/SRPMS/procmail-3.15.2-1.4mdk.src.rpm

Linux-Mandrake 7.2:
10d1564c725041ccddcd4d0322ce8593  7.2/RPMS/procmail-3.15.2-1.3mdk.i586.rpm
96453054a5e61284ab46c00b7926231d  7.2/SRPMS/procmail-3.15.2-1.3mdk.src.rpm

Mandrake Linux 8.0:
645fd209f3c4f1a3ee3fe9ca74c39356  8.0/RPMS/procmail-3.15.2-1.2mdk.i586.rpm
4b7efc4406d9dbf99b24914a5015e007  8.0/SRPMS/procmail-3.15.2-1.2mdk.src.rpm

Mandrake Linux 8.0 (PPC):
87394a37012994bfcbadacb99eb8bd00  ppc/8.0/RPMS/procmail-3.15.2-1.2mdk.ppc.rpm
4b7efc4406d9dbf99b24914a5015e007  ppc/8.0/SRPMS/procmail-3.15.2-1.2mdk.src.rpm

Mandrake Linux 8.1:
fec9a3bc584959dcdbafb4e73fca9336  8.1/RPMS/procmail-3.22-1.1mdk.i586.rpm
05412df2c9c9cc142cdfbb92165a7fea  8.1/SRPMS/procmail-3.22-1.1mdk.src.rpm

Corporate Server 1.0.1:
6a6303d135b4f58247b8c211a7fd4928  1.0.1/RPMS/procmail-3.15.2-1.4mdk.i586.rpm
650b9e7fab6c3413f88268263c270dbb  1.0.1/SRPMS/procmail-3.15.2-1.4mdk.src.rpm

Single Network Firewall 7.2:
10d1564c725041ccddcd4d0322ce8593  snf7.2/RPMS/procmail-3.15.2-1.3mdk.i586.rpm
96453054a5e61284ab46c00b7926231d  snf7.2/SRPMS/procmail-3.15.2-1.3mdk.src.rpm
______________________________________________________________________

Bug IDs fixed (see https://qa.mandrakesoft.com for more information):

______________________________________________________________________

To upgrade automatically, use MandrakeUpdate.

If you want to upgrade manually, download the updated package from one
of our FTP server mirrors and upgrade with "rpm -Fvh *.rpm".

You can download the updates directly from one of the mirror sites
listed at:

  http://www.linux-mandrake.com/en/ftp.php3.

Updated packages are available in the "updates/[ver]/RPMS/" directory.
For example, if you are looking for an updated RPM package for
Mandrake Linux 8.0, look for it in "updates/8.0/RPMS/".  Updated source
RPMs are available as well, but you generally do not need to download
them.

Please be aware that sometimes it takes the mirrors a few hours to
update.

You can view other security advisories for Mandrake Linux at:

  http://www.linux-mandrake.com/en/security/

If you want to report vulnerabilities, please contact

  security@linux-mandrake.com
______________________________________________________________________

Mandrake Linux has two security-related mailing list services that
anyone can subscribe to:

security-announce@linux-mandrake.com

  Mandrake Linux's security announcements mailing list.  Only
  announcements are sent to this list and it is read-only.

security-discuss@linux-mandrake.com

  Mandrake Linux's security discussion mailing list.  This list is open
  to anyone to discuss Mandrake Linux security specifically and Linux
  security in general.

To subscribe to either list, send a message to
  sympa@linux-mandrake.com
with "subscribe [listname]" in the body of the message.

To remove yourself from either list, send a message to
  sympa@linux-mandrake.com
with "unsubscribe [listname]" in the body of the message.

To get more information on either list, send a message to
  sympa@linux-mandrake.com
with "info [listname]" in the body of the message.

Optionally, you can use the web interface to subscribe to or unsubscribe
from either list:

  http://www.linux-mandrake.com/en/flists.php3#security
______________________________________________________________________

Type Bits/KeyID     Date       User ID
pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  


- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: GnuPG v1.0.5 (GNU/Linux)
Comment: For info see http://www.gnupg.org

mQGiBDlp594RBAC2tDozI3ZgQsE7XwxurJCJrX0L5vx7SDByR5GHDdWekGhdiday
L4nfUax+SeR9SCoCgTgPW1xB8vtQc8/sinJlMjp9197a2iKM0FOcPlkpa3HcOdt7
WKJqQhlMrHvRcsivzcgqjH44GBBJIT6sygUF8k0lU6YnMHj5MPc/NGWt8wCg9vKo
P0l5QVAFSsHtqcU9W8cc7wMEAJzQsAlnvPXDBfBLEH6u7ptWFdp0GvbSuG2wRaPl
hynHvRiE01ZvwbJZXsPsKm1z7uVoW+NknKLunWKB5axrNXDHxCYJBzY3jTeFjsqx
PFZkIEAQphLTkeXXelAjQ5u9tEshPswEtMvJvUgNiAfbzHfPYmq8D6x5xOw1IySg
2e/LBACxr2UJYCCB2BZ3p508mAB0RpuLGukq+7UWiOizy+kSskIBg2O7sQkVY/Cs
iyGEo4XvXqZFMY39RBdfm2GY+WB/5NFiTOYJRKjfprP6K1YbtsmctsX8dG+foKsD
LLFs7OuVfaydLQYp1iiN6D+LJDSMPM8/LCWzZsgr9EKJ8NXiyrQ6TGludXggTWFu
ZHJha2UgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAbGludXgtbWFuZHJha2UuY29t
PohWBBMRAgAWBQI5aefeBAsKBAMDFQMCAxYCAQIXgAAKCRCaqNDQIkWKmK6LAKCy
/NInDsaMSI+WHwrquwC5PZrcnQCeI+v3gUDsNfQfiKBvQSANu1hdulqIRgQQEQIA
BgUCOtNVGQAKCRBZ5w3um0pAJJWQAKDUoL5He+mKbfrMaTuyU5lmRyJ0fwCgoFAP
WdvQlu/kFjphF740XeOwtOqIRgQQEQIABgUCOu8A6QAKCRBynDnb9lq3CnpjAJ4w
Pk0SEE9U4r40IxWpwLU+wrWVugCdFfSPllPpZRCiaC7HwbFcfExRmPa5AQ0EOWnn
7xAEAOQlTVY4TiNo5V/iP0J1xnqjqlqZsU7yEBKo/gZz6/+hx75RURe1ebiJ9F77
9FQbpJ9Epz1KLSXvq974rnVb813zuGdmgFyk+ryA/rTR2RQ8h+EoNkwmATzRxBXV
Jb57fFQjxOu4eNjZAtfII/YXb0uyXXrdr5dlJ/3eXrcO4p0XAAMFBACCxo6Z269s
+A4v8C6Ui12aarOQcCDlV8cVG9LkyatU3FNTlnasqwo6EkaP572448weJWwN6SCX
Vl+xOYLiK0hL/6Jb/O9Agw75yUVdk+RMM2I4fNEi+y4hmfMh2siBv8yEkEvZjTcl
3TpkTfzYky85tu433wmKaLFOv0WjBFSikohGBBgRAgAGBQI5aefvAAoJEJqo0NAi
RYqYid0AoJgeWzXrEdIClBOSW5Q6FzqJJyaqAKC0Y9YI3UFlE4zSIGjcFlLJEJGX
lA==
=0ahQ
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE7+cdQmqjQ0CJFipgRAlu6AJ9F12RuhmbNmnc8z++jqeJlybekogCgvIRv
dGrQqRf4O/JZ5ekBjZaJAgo=
=6ZyU
-----END PGP SIGNATURE-----