Gentoo Linux Advisories: evolution, kernel

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200303-18
- - ---------------------------------------------------------------------

          PACKAGE : evolution
          SUMMARY : multiple vulnerabilities
             DATE : 2003-03-21 16:02 UTC
          EXPLOIT : remote
VERSIONS AFFECTED : <1.2.3
    FIXED VERSION : >=1.2.3
              CVE : CAN-2003-0128 CAN-2003-0129 CAN-2003-0130

- - ---------------------------------------------------------------------

- From advisory:

"Three vulnerabilities were found that could lead to various forms of 
exploitation ranging from denying to users the ability to read email, 
provoke system unstability, bypassing security context checks for 
email content and possibly execution of arbitrary commands on 
vulnerable systems."

Read the full advisory at:
http://www.coresecurity.com/common/showdoc.php?idx=309&idxseccion=10 

SOLUTION

It is recommended that all Gentoo Linux users who are running
net-mail/evolution upgrade to evolution-1.2.3 as follows:

emerge sync
emerge evolution
emerge clean

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------

- - ---------------------------------------------------------------------
GENTOO LINUX SECURITY ANNOUNCEMENT 200303-17
- - ---------------------------------------------------------------------

          PACKAGE : kernel
          SUMMARY : ptrace flaw
             DATE : 2003-03-21 08:59 UTC
          EXPLOIT : local
VERSIONS AFFECTED : All except 2.5
    FIXED VERSION : Kernels with patch applied
              CVE : CAN-2003-0127

- - ---------------------------------------------------------------------

- From advisory:

"The Linux 2.2 and Linux 2.4 kernels have a flaw in ptrace. This hole 
allows local users to obtain full privileges. Remote exploitation of 
this hole is not possible. Linux 2.5 is not believed to be vulnerable."

Read the full advisory at:
http://marc.theaimsgroup.com/?l=linux-kernel&m=104791735604202&w=2

SOLUTION

It is recommended that all Gentoo Linux users upgrade their kernels.

If you are running any of gentoo-sources, gs-sources, pfeifer-sources
sparc-sources or xfs-sources updates are available. Sync your tree and 
run emerge <package> to install the latest version of the package. Then
compile and install your new kernel and reboot.

If you are using an other kernel package which hasn't been updated or 
download your own sources you can download a patch from 
http://cvs.gentoo.org/~aliz/linux-2.4.20-ptrace.patch
and manually patch your kernel.

- - ---------------------------------------------------------------------
aliz@gentoo.org - GnuPG key is available at http://cvs.gentoo.org/~aliz
- - ---------------------------------------------------------------------