dcsimg
Linux Today: Linux News On Internet Time.





More on LinuxToday


TurboLinux Security Announcement: Multiple Security Updates

May 09, 2001, 11:46 (0 Talkback[s])
Date: Tue, 8 May 2001 16:27:46 -0700 (PDT)
From: TurboLinux Security Team <security@www1.turbolinux.com>
Subject: [TL-Security-Announce] TLSA2001012 analog-4.16-2
___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package: analog
        Vulnerable Packages: All Turbolinux versions previous to 4.16-2
        Date: 05/03/2001 5:00 PDT


        Affected Turbolinux platforms:  Turbolinux versions 6.0.5 and earlier
                                      
        Turbolinux Advisory ID#:  TLSA2001012
        Credits:  Vulnerability discovered by Stephen Turner
                  <S.R.E.Turner@statslab.cam.ac.uk>
    

References:  http://www.securityfocus.com/vdb/bottom.html?section=discussion&vid=2377


___________________________________________________________________________________________

A security hole was discovered in the package mentioned above. Please
update the package in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary(From the BugTraq database of securityfocus.com,id#2377)

   As designed, the software makes it possible for a user to remotely
   access network statistics using cgi scripts and HTTP FORM
   methods. When queried, the cgi accesses analog, and outputs
   statistics to a web page. Due to a buffer overflow in analog, and
   improper checking of input by the cgi program, it is possible for a
   user to supply a long ALIAS field to the analog program, which will
   result in a buffer overflow.

2. Impact(Also from the BugTraq database, id#2377)

   A user can remotely execute code and execute commands with privileges
   equal to the httpd process.

3. Solution

   First, uninstall the package analog-form using the command:

   rpm -e analog-form-3.0-1.i386.rpm/, or whatever version of analog-form
   you are currently running
     
   Then, update the analog package from our ftp server by running the
   following command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/analog-4.16-2.i386.rpm

   The source RPM can be downloaded here:

   ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/analog-4.16-2.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- --------------------------------------------------------------------------------------------

  717b0f32867e30c4423b077faf93bc96      analog-4.16-2.i386.rpm
  5900b3a42477b5a8da1ac6275eb2360b      analog-4.16-2.src.rpm
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.0 Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce




Date: Tue, 8 May 2001 16:10:50 -0700 (PDT)
From: TurboLinux Security Team <security@www1.turbolinux.com>
Subject: [TL-Security-Announce] TLSA2001010 cvsweb-1.93-1



___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package: cvsweb
        Vulnerable Packages: All Turbolinux versions previous to 1.91-3
        Date: 05/03/2001 5:00 PDT


        Affected Turbolinux versions: TL Server 6.5, TL Workstation 6.1,
                                      Turbolinux versions 6.0.5 and earlier
                                      
        Turbolinux Advisory ID#:  TLSA2001010
        Credits:  Vulnerability discovered by Joey Hess

___________________________________________________________________________________________

A security hole was discovered in the package mentioned above. Please
update the package in your installation as soon as possible or disable the
service.
___________________________________________________________________________________________

1. Problem Summary

   Current and previous version of cvsweb allow remote users to
   access/write files as the default web user via the cvsweb.cgi script.

2. Impact

   Remote read/write access to arbitrary files owned by the default web
   user is possible via this exploit.


3. Solution
     
   Update the packages from our ftp server by running the following
   command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:


ftp://ftp.turbolinux.com/pub/updates/6.0/security/cvsweb-1.93-1.noarch.rpm


   The source RPM can be downloaded here:

   ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/cvsweb-1.93-1.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- --------------------------------------------------------------------------------------------

701bc3687dd2259fa6090e845d37fe4a        cvsweb-1.93-1.noarch.rpm/
210077135b6aa6df2d693c5be9771910        cvsweb-1.93-1.src.rpm/
  
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.0 Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce


Date: Tue, 8 May 2001 16:06:39 -0700 (PDT)
From: TurboLinux Security Team <security@www1.turbolinux.com>
Subject: [TL-Security-Announce] TLSA2001009 dhcp-2.0pl5-2



___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package:  dhcp
        Vulnerable Packages: All Turbolinux versions previous to and including 2.0-9
        Date: 04/30/2001 5:00 PDT


        Affected Turbolinux platforms: TL 6.1 WorkStation,
                                      All Turbolinux versions
                                      6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001009

        Credits:  Internet Software Consortium
                  http://www.isc.org/products/DHCP/dhcp-v2.html
___________________________________________________________________________________________

A security hole has been discovered in the dhcp packages.  Please update
the packages in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary

   It is possible for a user to gain root access to a system through the
   use of clever shell metacharacter hacks.


2. Solution
     

   Update the package from our ftp server by running the following
   command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/dhcp-2.0pl5-2.i386.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/dhcp-client-2.0pl5-2.i386.rpm

   The source RPM can be downloaded here:

   ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/dhcp-2.0pl5-2.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- ---------------------------------------------------------------------------------------------
                                       
  f8979df299dfbe4f5d6edca681edd8bf      dhcp-2.0pl5-2.i386.rpm/
  48bc3d9afa77a73660aebc8905a8696f      dhcp-client-2.0pl5-2.i386.rpm/
  7cf2a9b3d1a3076ca620e3457ccf1f1f      dhcp-2.0pl5-2.src.rpm/
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ for TL6.0

   Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce


Date: Tue, 8 May 2001 16:20:48 -0700 (PDT)
From: TurboLinux Security Team <security@www1.turbolinux.com>
Subject: [TL-Security-Announce] TLSA2001011 dialog-0.9a-2

___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package: dialog
        Vulnerable Packages: All Turbolinux versions previous to 0.9a-2
        Date: 05/03/2001 5:00 PDT


        Affected Turbolinux platforms:  TL Server 6.5, TL Workstation 6.1
                                        Turbolinux versions 6.0.5 and earlier
                                      
        Turbolinux Advisory ID#:  TLSA2001011
        
        Credits:  Reported by Matt Kraai                       
References:  http://linuxtoday.com/news_story.php3?ltsn=2000-12-25-020-04-SC-DB


___________________________________________________________________________________________

A security hole was discovered in the package mentioned above. Please
update the package in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary

   Dialog creates lock-files insecurely, which makes it vulnerable
   to a symlink attack.


2. Solution

   Update the package from our ftp server by running the following
   command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:


ftp://ftp.turbolinux.com/pub/updates/6.0/security/dialog-0.9a-2.i386.rpm

   The source RPM can be downloaded here:

   ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/dialog-0.9a-2.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- ---------------------------------------------------------------------------------------------

  660babb1fbef04abbfb9dc326a8f4f16      dialog-0.9a-2.i386.rpm/
  5e858ac44ac97f32c7ba3935da2efa44      dialog-0.9a-2.src.rpm/
  
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.0 Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.

  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce


Date: Tue, 8 May 2001 15:33:14 -0700 (PDT)
From: TurboLinux Security Team 
Subject: [TL-Security-Announce] TLSA2001008 squid-2.3.STABLE/4-1

_________________________________________________________________________

                     Turbolinux Security Announcement

        Package: Squid
        Vulnerable Packages: All versions previous to 2.3.STABLE4-1
        Date: 05/04/2001 5:00 PDT

        Affected Turbolinux platforms:  TL 6.1 WorkStation,
                                        All Turbolinux versions
                                        6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001008

   Credits: Vulnerability discovered by Greg KH
_________________________________________________________________________

A security hole has been discovered in the package squid.  Please update
this package in your installation as soon as possible.
_________________________________________________________________________

1. Problem Summary(From the BugTraq database at securityfocus.com,id#2184)

   A /tmp file race condition vulnerability exists.  Squid can be
   set up to send emails notifying the administrator of any updates.
   Whenever the email is created, files are created insecurely
   in the /tmp directory and the pre-existence of these files is
   not queried.  Usually, the file creations occur when the system clock
   is reporting an incorrect time or a development version of squid is
   used.  Therefore, it is possible for a user with malicious motives to
   guess the handle of a future /tmp file, and create a symbolic link to a
   file writable by the UID of the squid process, thus overwriting a file
   owned by the squid user, or appending to and corrupting the file.

2. Solution

  Update the package from our ftp server by running the following command:

  rpm -Uvh ftp_path_to_filename

  Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/squid-2.3.STABLE4-1.i386.rpm

  The source RPM can be downloaded here:


ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/squid-2.3.STABLE4-1.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- --------------------------------------------------------------------------
d9844e9082390dc146893c836e3ea2a2        squid-2.3.STABLE4-1.i386.rpm/
2412fc6befc100bd757de8fc91ecfc6c        squid-2.3.STABLE4-1.src.rpm/
_________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

_________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ for TL6.0
   Workstation and Server security updates
 

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
_________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.

  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce


Date: Tue, 8 May 2001 16:35:11 -0700 (PDT)
From: TurboLinux Security Team 
Subject: [TL-Security-Announce] TLSA2001013 vixie-cron-3.0.1-46

___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package:  vixie-cron
        Vulnerable Packages: All Turbolinux versions previous to 3.0.1-46
        Date: 05/02/2001 5:00 PDT


        Affected Turbolinux platforms: TL Server 6.5,
                                      TL 6.1 WorkStation,
                                      All Turbolinux versions
                                      6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001013

        Credits: Vulnerability first discovered by flatline
     References:  http://marc.theaimsgroup.com/?l=bugtraq&m=98200814418344&w=2

___________________________________________________________________________________________

A security hole has been discovered in the package vixie-cron.  Please
update the packages in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary

   There is a buffer overflow vulnerability associated with the crontab 
   function.  When crontab determines the name of the user calling the
   crontab function, it stores this name in a 20 byte buffer using the
   strcpy() function, which does no bounds checking.  The command
   "useradd" accepts more than 20 characters.  Therefore, a username
   greater than 20 characters will crash a system when passed to the 
   crontab function.

2. Impact

   It is possible for a local user to gain elevated privileges.

3. Solution
     
   Update the packages from our ftp server by running the following command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:


ftp://ftp.turbolinux.com/pub/updates/6.0/security/vixie-cron-3.0.1-46.i386.rpm 

   The source RPM can be downloaded here:


ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/vixie-cron-3.0.1-46.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- ---------------------------------------------------------------------------------------------
                                       
  c79c05f0044f88812908b17730a308ee      vixie-cron-3.0.1-46.i386.rpm/
  cdfd064650b8839a3d7f3eb18a494165      vixie-cron-3.0.1-46.src.rpm/
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.0 Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce


Date: Tue, 8 May 2001 16:42:10 -0700 (PDT)
From: TurboLinux Security Team 
Subject: [TL-Security-Announce] TLSA2001014 xntp3-5.93-10


___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package: xntp3
        Vulnerable Packages: All Turbolinux versions previous to 5.93-10
        Date: 05/02/2001 5:00 PDT


        Affected Turbolinux platforms: TL Server 6.5,
                                       TL 6.1 WorkStation,
                                       All Turbolinux versions
                                       6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001014

        Credits:  Vulnerability discovered by Przemyslaw Frasunek      
        References: http://www.securityfocus.com/vdb/bottom.html?vid=2540

___________________________________________________________________________________________

A security hole has been discovered in the xntp3 packages.  Please update
the packages in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary

   A remote buffer overflow vulnerability exists in the network time
   protocol daemon.  It is remotely exploitable and a user with malicious
   intent can crash the daemon or execute arbitrary code on the affected
   host.

2. Impact

   Remote exploitation can result in an attacker gaining remote root
   access or a denial of ntp service on the affected system.

3. Solution
     
   Update the packages from our ftp server by running the following command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/xntp3-5.93-10.i386.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/xntp3-server-5.93-10.i386.rpm 

   The source RPM can be downloaded here:

   ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/xntp3-5.93-10.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
- ---------------------------------------------------------------------------------------------
                                       
  1acc3320414d9cf0c95359ee441f670c      xntp3-5.93-10.i386.rpm/
  dfb4610caddfe8970e7c9f37c4fc9ec7      xntp3-server-5.93-10.i386.rpm/
  b68734be1f493230aa773f19a0bfb0b5      xntp3-5.93-10.src.rpm/
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.0 Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce