Mandrake Linux Security Update Advisory
| Package name: | tcpdump |
| Advisory ID: | MDKSA-2004:008 |
| Date: | January 26th, 2004 |
| Affected versions: | 9.1, 9.2, Corporate Server 2.1, Multi Network Firewall 8.2 |
Problem Description:
A number of vulnerabilities were discovered in tcpdump versions
prior to 3.8.1 that, if fed a maliciously crafted packet, could be
exploited to crash tcpdump or potentially execute arbitrary code
with the privileges of the user running tcpdump. These
vulnerabilities include:
An infinite loop and memory consumption processing L2TP packets
(CAN-2003-1029).
Infinite loops in processing ISAKMP packets (CAN-2003-0989,
CAN-2004-0057).
A segmentation fault caused by a RADIUS attribute with a large
length value (CAN-2004-0055).
The updated packages are patched to correct these problem.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0989
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1029
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0055
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0057
Updated Packages:
Corporate Server 2.1:
c9c3cb66d49d3c61c09db1df364309aa
corporate/2.1/RPMS/tcpdump-3.7.2-2.1.C21mdk.i586.rpm
a0731e1d0f8bb67e27796486ee0ac6de
corporate/2.1/SRPMS/tcpdump-3.7.2-2.1.C21mdk.src.rpm
Corporate Server 2.1/x86_64:
3eba37e4c75f54916c3c15b126710c43
x86_64/corporate/2.1/RPMS/tcpdump-3.7.2-2.1.C21mdk.x86_64.rpm
a0731e1d0f8bb67e27796486ee0ac6de
x86_64/corporate/2.1/SRPMS/tcpdump-3.7.2-2.1.C21mdk.src.rpm
Mandrake Linux 9.1:
aa337b3beb1371a5ceace20db36c5dfa
9.1/RPMS/tcpdump-3.7.2-2.1.91mdk.i586.rpm
99e8f3cb2c6cc748ca8c8d24ab555029
9.1/SRPMS/tcpdump-3.7.2-2.1.91mdk.src.rpm
Mandrake Linux 9.1/PPC:
df878fa0b993bcc53cb852a4b3a6b0bb
ppc/9.1/RPMS/tcpdump-3.7.2-2.1.91mdk.ppc.rpm
99e8f3cb2c6cc748ca8c8d24ab555029
ppc/9.1/SRPMS/tcpdump-3.7.2-2.1.91mdk.src.rpm
Mandrake Linux 9.2:
595518640b2291ce10e26b943debf84b
9.2/RPMS/tcpdump-3.7.2-2.1.92mdk.i586.rpm
8e3520db919980c762c7acce742f9831
9.2/SRPMS/tcpdump-3.7.2-2.1.92mdk.src.rpm
Mandrake Linux 9.2/AMD64:
efd0e0b8f9796b3ba98d3da63d5b38c2
amd64/9.2/RPMS/tcpdump-3.7.2-2.1.92mdk.amd64.rpm
8e3520db919980c762c7acce742f9831
amd64/9.2/SRPMS/tcpdump-3.7.2-2.1.92mdk.src.rpm
Multi Network Firewall 8.2:
3eaac937cfc3d2390a2eda8dd431fc56
mnf8.2/RPMS/tcpdump-3.7.2-2.1.M82mdk.i586.rpm
a33365b5a8d47668764615ec6713869f
mnf8.2/SRPMS/tcpdump-3.7.2-2.1.M82mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
A list of FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
All packages are signed by MandrakeSoft for security. You can
obtain the GPG public key of the Mandrake Linux Security Team by
executing:
gpg –recv-keys –keyserver www.mandrakesecure.net
0x22458A98
Please be aware that sometimes it takes the mirrors a few hours
to update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services
that anyone can subscribe to. Information on these lists can be
obtained by visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
| Type | Bits/KeyID | Date | User ID |
| pub | 1024D/22458A98 | 2000-07-10 | Linux Mandrake Security Team <security linux-mandrake.com> |
Mandrake Linux Security Update Advisory
| Package name: | mc |
| Advisory ID: | MDKSA-2004:007 |
| Date: | January 26th, 2004 |
| Affected versions: | 9.1, 9.2, Corporate Server 2.1 |
Problem Description:
A buffer overflow was discovered in mc’s virtual filesystem
code. This vulnerability could allow remote attackers to execute
arbitrary code during symlink conversion.
The updated packages have been patched to correct the
problem.
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-1023
Updated Packages:
Corporate Server 2.1:
38317ed34ca1a0ce54018c85d808106a
corporate/2.1/RPMS/mc-4.5.55-10.1.C21mdk.i586.rpm
1dd6c6ffab24a3ce7b57242c6912a44e
corporate/2.1/RPMS/mcserv-4.5.55-10.1.C21mdk.i586.rpm
46277f91fbcdce43d6c142d912e87297
corporate/2.1/SRPMS/mc-4.5.55-10.1.C21mdk.src.rpm
Corporate Server 2.1/x86_64:
751dbc6182f482731db02998137d49d0
x86_64/corporate/2.1/RPMS/mc-4.5.55-10.1.C21mdk.x86_64.rpm
cd3f95e756d6f5144d107f277429834d
x86_64/corporate/2.1/RPMS/mcserv-4.5.55-10.1.C21mdk.x86_64.rpm
46277f91fbcdce43d6c142d912e87297
x86_64/corporate/2.1/SRPMS/mc-4.5.55-10.1.C21mdk.src.rpm
Mandrake Linux 9.1:
62e5337a90f9bd712f9bb125d0140fb3
9.1/RPMS/mc-4.6.0-4.1.91mdk.i586.rpm
fd218112b274a0dd6bb920baa84b31a8
9.1/SRPMS/mc-4.6.0-4.1.91mdk.src.rpm
Mandrake Linux 9.1/PPC:
3c217e26bef6c2d9c9c98cf13ddcf51c
ppc/9.1/RPMS/mc-4.6.0-4.1.91mdk.ppc.rpm
fd218112b274a0dd6bb920baa84b31a8
ppc/9.1/SRPMS/mc-4.6.0-4.1.91mdk.src.rpm
Mandrake Linux 9.2:
47f0fb32e7ffb1a85a6f0f2680bc6221
9.2/RPMS/mc-4.6.0-4.1.92mdk.i586.rpm
edd4a1feb126d7cf7e2b74ccbc0997bf
9.2/SRPMS/mc-4.6.0-4.1.92mdk.src.rpm
Mandrake Linux 9.2/AMD64:
bcabfcfdaaf3f3659cf9115ac6c02f9a
amd64/9.2/RPMS/mc-4.6.0-4.1.92mdk.amd64.rpm
edd4a1feb126d7cf7e2b74ccbc0997bf
amd64/9.2/SRPMS/mc-4.6.0-4.1.92mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
A list of FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
All packages are signed by MandrakeSoft for security. You can
obtain the GPG public key of the Mandrake Linux Security Team by
executing:
gpg –recv-keys –keyserver www.mandrakesecure.net
0x22458A98
Please be aware that sometimes it takes the mirrors a few hours
to update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services
that anyone can subscribe to. Information on these lists can be
obtained by visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
| Type | Bits/KeyID | Date | User ID |
| pub | 1024D/22458A98 | 2000-07-10 | Linux Mandrake Security Team <security linux-mandrake.com> |
Mandrake Linux Security Update Advisory
| Package name: | gaim |
| Advisory ID: | MDKSA-2004:006 |
| Date: | January 26th, 2004 |
| Affected versions: | 9.1, 9.2 |
Problem Description:
A number of vulnerabilities were discovered in the gaim instant
messenger program by Steffan Esser, versions 0.75 and earlier.
Thanks to Jacques A. Vidrine for providing initial patches.
Multiple buffer overflows exist in gaim 0.75 and earlier: When
parsing cookies in a Yahoo web connection; YMSG protocol overflows
parsing the Yahoo login webpage; a YMSG packet overflow; flaws in
the URL parser; and flaws in the HTTP Proxy connect
(CAN-2004-006).
A buffer overflow in gaim 0.74 and earlier in the Extract Info
Field Function used for MSN and YMSG protocol handlers
(CAN-2004-007).
An integer overflow in gaim 0.74 and earlier, when allocating
memory for a directIM packet results in a heap overflow
(CAN-2004-0008).
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0006
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0007
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0008
Updated Packages:
Mandrake Linux 9.1:
0556c9ec718b1c801812d2dfa03e3c1f
9.1/RPMS/gaim-0.75-1.1.91mdk.i586.rpm
0bafaeff1aa44729acce297d983751b5
9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.i586.rpm
9230e03e6b063ea8dee4c12c7533e934
9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.i586.rpm
f8365a246c5f519e3b04acf5c356fbde
9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.i586.rpm
9165b41b33f51a1132eb2437e6fbc06a
9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm
Mandrake Linux 9.1/PPC:
f94e8bffa283f929dd24622f37785e87
ppc/9.1/RPMS/gaim-0.75-1.1.91mdk.ppc.rpm
a1e2f92c9d3e90efe682832acd2b7913
ppc/9.1/RPMS/gaim-encrypt-0.75-1.1.91mdk.ppc.rpm
bc3f3ff23f63c7886e67cafb8c5d09e8
ppc/9.1/RPMS/libgaim-remote0-0.75-1.1.91mdk.ppc.rpm
be2ef1b00eda2d96b67c4f59e8257a79
ppc/9.1/RPMS/libgaim-remote0-devel-0.75-1.1.91mdk.ppc.rpm
9165b41b33f51a1132eb2437e6fbc06a
ppc/9.1/SRPMS/gaim-0.75-1.1.91mdk.src.rpm
Mandrake Linux 9.2:
0898eae6994c34bc5338befc5c3e054e
9.2/RPMS/gaim-0.75-1.1.92mdk.i586.rpm
fc6d3ffb544effe5d22c476e8a3ed6de
9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.i586.rpm
2dcf56db1cfee1408e60ae873c78231d
9.2/RPMS/gaim-festival-0.75-1.1.92mdk.i586.rpm
c9320a7b72ff220c7222185138b87aab
9.2/RPMS/gaim-perl-0.75-1.1.92mdk.i586.rpm
3e736129d087a844ce7580ae67bbca73
9.2/RPMS/libgaim-remote0-0.75-1.1.92mdk.i586.rpm
8630b36c277296aca4340cd99c158fc4
9.2/RPMS/libgaim-remote0-devel-0.75-1.1.92mdk.i586.rpm
204f4ba2d9bd6c9037377f4e8903c621
9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm
Mandrake Linux 9.2/AMD64:
0ad839bfc084c7a8b13d1498239c81d4
amd64/9.2/RPMS/gaim-0.75-1.1.92mdk.amd64.rpm
52babbdbd27f99041cf29ef67e9eecc9
amd64/9.2/RPMS/gaim-encrypt-0.75-1.1.92mdk.amd64.rpm
e32a9b3b1c72a59a24a0cea2e4b1c05e
amd64/9.2/RPMS/gaim-festival-0.75-1.1.92mdk.amd64.rpm
ed2aef050fabfb8a401be136f551b6c0
amd64/9.2/RPMS/gaim-perl-0.75-1.1.92mdk.amd64.rpm
aed398efb4623d541c90627e20c17abf
amd64/9.2/RPMS/lib64gaim-remote0-0.75-1.1.92mdk.amd64.rpm
9eccc2dbba74055a9235a54c00904e88
amd64/9.2/RPMS/lib64gaim-remote0-devel-0.75-1.1.92mdk.amd64.rpm
204f4ba2d9bd6c9037377f4e8903c621
amd64/9.2/SRPMS/gaim-0.75-1.1.92mdk.src.rpm
To upgrade automatically use MandrakeUpdate or urpmi. The
verification of md5 checksums and GPG signatures is performed
automatically for you.
A list of FTP mirrors can be obtained from:
http://www.mandrakesecure.net/en/ftp.php
All packages are signed by MandrakeSoft for security. You can
obtain the GPG public key of the Mandrake Linux Security Team by
executing:
gpg –recv-keys –keyserver www.mandrakesecure.net
0x22458A98
Please be aware that sometimes it takes the mirrors a few hours
to update.
You can view other update advisories for Mandrake Linux at:
http://www.mandrakesecure.net/en/advisories/
MandrakeSoft has several security-related mailing list services
that anyone can subscribe to. Information on these lists can be
obtained by visiting:
http://www.mandrakesecure.net/en/mlist.php
If you want to report vulnerabilities, please contact
security_linux-mandrake.com
| Type | Bits/KeyID | Date | User ID |
| pub | 1024D/22458A98 | 2000-07-10 | Linux Mandrake Security Team <security linux-mandrake.com> |