CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : mailman
SUMMARY : Several mailman fixes
DATE : 2004-05-25 17:26:00
ID : CLA-2004:842
RELEVANT RELEASES : 8, 9
DESCRIPTION
Mailman[1] is a mailing list manager.
This update fixes the following vulnerabilities for Conectiva
Linux 9:
- Cross site scripting vulnerability in the admin CGI script
(CAN-2003-0965)[2] - Cross site scripting vulnerability in the create CGI script
(CAN-2003-0992)[3] - Remote password retrieval vulnerability (CAN-2004-0412)[4] As
mentioned in the 2.1.5 release announcement[5], previous mailman
versions are vulnerable to a password retrieval attack which would
give the attacker the password an user choose when he/she
subscribed to a mailing list.
For Conectiva Linux 8, the following vulnerability has been
fixed:
- CAN-2003-0991[6]: denial of service vulnerability caused by
specific mail messages which would crash mailman.
SOLUTION
It is recommended that all mailman users upgrade their
packages.
REFERENCES
1.http://www.list.org/
2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0965
3.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0992
4.http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2004-0412
5.http://mail.python.org/pipermail/mailman-announce/2004-May/000072.html
6.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0991
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/8/SRPMS/mailman-2.0.14-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/mailman-2.0.14-1U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/mailman-2.1.4-27744U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/mailman-2.1.4-27744U90_2cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
CONECTIVA LINUX SECURITY ANNOUNCEMENT
PACKAGE : libneon
SUMMARY : Fix for a buffer overflow vulnerability
DATE : 2004-05-25 16:34:00
ID : CLA-2004:841
RELEVANT RELEASES : 9
DESCRIPTION
“libneon”[1] is a library used by some WebDAV clients.
Stefan Esser from e-matters security published[2] an advisory
about a vulnerability[3] in the libneon library which could be
abused by remote WebDAV servers to execute arbitrary code on the
client accessing these servers.
SOLUTION
It is recommended that all libneon users upgrade their
packages.
REFERENCES
- http://www.webdav.org/neon/
- http://security.e-matters.de/advisories/062004.html
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0398
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/9/SRPMS/libneon-0.23.5-21884U90_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libneon-devel-0.23.5-21884U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libneon-devel-static-0.23.5-21884U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libneon-doc-0.23.5-21884U90_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/libneon23-0.23.5-21884U90_2cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions regarding the use of apt and upgrade
examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
All packages are signed with Conectiva’s GPG key. The key and
instructions on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can
be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
Copyright (c) 2004 Conectiva Inc.
http://www.conectiva.com