SHARE
Facebook X Pinterest WhatsApp

Conectiva Linux Advisories: dhcp, file, samba

Written By
Web Webster
Web Webster
Apr 7, 2003 
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------
PACKAGE   : dhcp
SUMMARY   : Denial of service vulnerability
DATE      : 2003-04-04 18:34:00
ID        : CLA-2003:616
RELEVANT
RELEASES  : 8
- -------------------------------------------------------------------------
DESCRIPTION
 The package "dhcp" provides a Dynamic Host Configuration Protocol[1]
 server developed by ISC (ISC DHCPD).
 
 Florian Lohoff discovered[2] a vulnerability[3,4] in the way dhcrelay
 (part of the dhcp package) forwards malicious BOOTP packets it
 receives to the dhcp servers it contacts. An attacker could exploit
 this vulnerability to generate a "storm" of BOOTP packets, causing a
 denial of service condition or a misbehavior by the part of the dhcp
 server.
 
 The Common Vulnerabilities and Exposures project (cve.mitre.org/) is
 tracking[5] this issue with the name CAN-2003-0039.
 
 The packages provided with this announcement fix these
 vulnerabilities with a patch, keeping the original version. Please
 note that Conectiva Linux versions prior to 8 do not ship dhcp 3.0
 and therefore are not vulnerable to this problem.

SOLUTION
 All dhcp users should upgrade immediately. After upgrading the
 packages, please restart the dhcpd service if it is already running.
 This can be done with the command below (as the root user):
 
 # service dhcpd restart 
 
 
 REFERENCES:
 1.http://www.ietf.org/rfc/rfc2131.txt
 2.http://online.securityfocus.com/archive/1/307451
 3.http://online.securityfocus.com/bid/6628
 4.http://www.kb.cert.org/vuls/id/149953
 5.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0039

UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/RPMS/dhcp-3.0-3U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/dhcp-doc-3.0-3U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/dhcp-3.0-3U80_3cl.src.rpm

ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:
 - run:                 apt-get update
 - after that, execute: apt-get upgrade
 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright 2003 (c) Conectiva Inc.
http://www.conectiva.com
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------
PACKAGE   : file
SUMMARY   : Buffer overflow vulnerability
DATE      : 2003-04-04 18:58:00
ID        : CLA-2003:617
RELEVANT
RELEASES  : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
 The file command is used to identify a particular file according to
 the type of data contained in it.
 
 iDefense has found a buffer overflow vulnerability[1] in the file
 command. This vulnerability can be triggered by the use of specially
 crafted files.
 
 Since file is a very common utility used by many subsystems (like the
 printing subsystem), attackers can exploit this vulnerability to
 remotely or locally compromise system security.
 
 The Common Vulnerabilities and Exposures project (cve.mitre.org/) has
 assigned the name CAN-2003-0102 to this issue[2].

SOLUTION
 All users should upgrade.
 
 
 REFERENCES:
 1.http://www.idefense.com/advisory/03.04.03.txt
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0102

UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/file-3.41-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/file-3.41-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/file-3.41-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/file-3.41-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/file-3.41-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/file-3.41-1U80_1cl.src.rpm

ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:
 - run:                 apt-get update
 - after that, execute: apt-get upgrade
 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright 2003 (c) Conectiva Inc.
http://www.conectiva.com
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------
PACKAGE   : samba
SUMMARY   : Remote vulnerability and local race condition
DATE      : 2003-04-04 16:00:00
ID        : CLA-2003:615
RELEVANT
RELEASES  : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
 Samba provides SMB/CIFS services (such as file and printer sharing)
 used by clients compatible with Microsoft Windows(TM).
 
 The SuSE Security Team performed a security audit in parts of the
 Samba project code and found various problems in both the client and
 server implementations. Among these problems is a buffer overflow[1]
 vulnerability in the packet fragment re-assembly code. A remote
 attacker who is able to connect to the samba server may gain root
 privileges on it by exploiting this vulnerability.
 
 The vulnerability also affects the client library code, thus it is
 possible to exploit applications which use samba library functions by
 using a malicious samba server to send traffic to them.
 
 Additionally, a race condition[2] was discovered which could allow a
 local attacker to overwrite critical system files.
 
 In Conectiva Linux versions 7.0 and 8 samba is being upgraded to the
 latest stable version: 2.2.8. This version fixes the above
 vulnerabilities and includes several other fixes and additional
 features[3]. In Conectiva Linux 6.0, a patch with fixes the above
 vulnerabilities was applied to the package originally distributed,
 keeping samba in its original version (2.0.9).

SOLUTION
 All samba users should upgrade their packages immediately. This
 update will automatically restart the samba service if it is already
 running.
 
 
 REFERENCES:
 1.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0085
 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0086
 3.http://www.samba.org/samba/whatsnew/samba-2.2.8.html

UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-2.0.9-2U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-clients-2.0.9-2U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-doc-2.0.9-2U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/samba-swat-2.0.9-2U60_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/samba-2.0.9-2U60_3cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-clients-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-codepagesource-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-common-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-doc-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/samba-swat-2.2.8-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/samba-2.2.8-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-clients-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-codepagesource-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-common-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-doc-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/samba-swat-2.2.8-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/samba-2.2.8-1U80_1cl.src.rpm

ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:
 - run:                 apt-get update
 - after that, execute: apt-get upgrade
 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright 2003 (c) Conectiva Inc.
http://www.conectiva.com
Web Webster

Web Webster

Web Webster has more than 20 years of writing and editorial experience in the tech sector. He’s written and edited news, demand generation, user-focused, and thought leadership content for business software solutions, consumer tech, and Linux Today, he edits and writes for a portfolio of tech industry news and analysis websites including webopedia.com, and DatabaseJournal.com.

Linux Today Logo

LinuxToday is a trusted, contributor-driven news resource supporting all types of Linux users. Our thriving international community engages with us through social media and frequent content contributions aimed at solving problems ranging from personal computing to enterprise-level IT operations. LinuxToday serves as a home for a community that struggles to find comparable information elsewhere on the web.

facebook
linkedin
x

Company

Contact us

Categories

News IT Management Infrastructure Developer Security High Performance Storage Blog

Property of TechnologyAdvice. © 2026 TechnologyAdvice. All Rights Reserved

Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

Terms of Service Privacy Policy California - Do Not Sell My Information