Red Hat Security Advisory
| Synopsis: | Updated PostgreSQL packages fix buffer overflow |
| Advisory ID: | RHSA-2003:313-00 |
| Issue date: | 2003-11-13 |
| Updated on: | 2003-11-13 |
| Product: | Red Hat Linux |
| Keywords: | |
| Cross references: | |
| Obsoletes: | RHSA-2003:001 RHSA-2003:010 |
| CVE Names: | CAN-2003-0901 |
1. Topic:
Updated PostgreSQL packages that correct a buffer overflow in
the to_ascii routines are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.2 – i386, ia64
Red Hat Linux 7.3 – i386
Red Hat Linux 8.0 – i386
Red Hat Linux 9 – i386
3. Problem description:
PostgreSQL is an advanced Object-Relational database management
system (DBMS).
Two bugs that can lead to buffer overflows have been found in
the PostgreSQL abstract data type to ASCII conversion routines. A
remote attacker who is able to influence the data passed to the
to_ascii functions may be able to execute arbitrary code in the
context of the PostgreSQL server. These issues affect PostgreSQL
7.2.x, and 7.3.x before 7.3.4. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0901 to these issues.
In addition, a bug that can lead to leaks has been found in the
string to timestamp abstract data type conversion routine. If the
input string to the to_timestamp() routine is shorter than what the
template string is expecting, the routine will run off the end of
the input string, resulting in a leak of previous timestamp
behavior and unstable behavior.
Users of PostgreSQL are advised to upgrade to these erratum
packages, which contain backported patches that correct these
issues.
4. Solution:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
Please note that this update is available via Red Hat Network.
To use Red Hat Network, launch the Red Hat Update Agent with the
following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
Note that no initdb will be necessary from previous PostgreSQL
packages.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):
108079 – CAN-2003-0901 PostgreSQL To_Ascii() Buffer Overflow
Vulnerability
109068 – to_timestamp not stable if date string shorter than
template
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/postgresql-7.1.3-5.72.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-odbc-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-contrib-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-perl-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-devel-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-python-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-docs-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-server-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-jdbc-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-tcl-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-libs-7.1.3-5.72.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/postgresql-tk-7.1.3-5.72.i386.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-odbc-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-contrib-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-perl-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-devel-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-python-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-docs-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-server-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-jdbc-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-tcl-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-libs-7.1.3-5.72.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/postgresql-tk-7.1.3-5.72.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/postgresql-7.2.4-5.73.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-contrib-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-devel-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-docs-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-jdbc-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-libs-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-odbc-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-test-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-perl-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-python-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-server-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-tcl-7.2.4-5.73.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/postgresql-tk-7.2.4-5.73.i386.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/postgresql-7.2.4-5.80.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-contrib-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-devel-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-docs-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-jdbc-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-test-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-libs-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-odbc-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-perl-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-python-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-server-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-tcl-7.2.4-5.80.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/postgresql-tk-7.2.4-5.80.i386.rpm
Red Hat Linux 9:
SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/postgresql-7.3.4-3.rhl9.src.rpm
ftp://updates.redhat.com/9/en/os/SRPMS/postgresql72-1-4.rhl9.src.rpm
i386:
ftp://updates.redhat.com/9/en/os/i386/postgresql-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-contrib-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-devel-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-docs-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-jdbc-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-libs-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-pl-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-python-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-server-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-tcl-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql-test-7.3.4-3.rhl9.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/postgresql72-libs-1-4.rhl9.i386.rpm
7. Verification:
MD5 sum Package Name
3b9e2ff8e10ee73235eee4f9878b3e2c
7.2/en/os/SRPMS/postgresql-7.1.3-5.72.src.rpm
7c3a5d6ca1f7f2dd8e72f5b6a8f1f08e
7.2/en/os/i386/postgresql-7.1.3-5.72.i386.rpm
199e0b350daddc1c5b0a6863a0d594e4
7.2/en/os/i386/postgresql-contrib-7.1.3-5.72.i386.rpm
f598ffaa61d0658bc7a014f726c27eb4
7.2/en/os/i386/postgresql-devel-7.1.3-5.72.i386.rpm
76b24489acbefa1d68a85334e9dc75aa
7.2/en/os/i386/postgresql-docs-7.1.3-5.72.i386.rpm
a7fbf57b5239a0f0dc1f2090eb9986c4
7.2/en/os/i386/postgresql-jdbc-7.1.3-5.72.i386.rpm
8a0b4bc8cf4a10acaafd77ac07487841
7.2/en/os/i386/postgresql-libs-7.1.3-5.72.i386.rpm
f53828955915f3f85e4bdd9b5ff13100
7.2/en/os/i386/postgresql-odbc-7.1.3-5.72.i386.rpm
2175a2b30a15ba0fd704f456e89bf620
7.2/en/os/i386/postgresql-perl-7.1.3-5.72.i386.rpm
8daab695f8f792ebc9b6e1f7bb9e4b3e
7.2/en/os/i386/postgresql-python-7.1.3-5.72.i386.rpm
d6dcd736623928aa3bc0c86774fd677e
7.2/en/os/i386/postgresql-server-7.1.3-5.72.i386.rpm
0e91e4b7df893387076d854f578899eb
7.2/en/os/i386/postgresql-tcl-7.1.3-5.72.i386.rpm
d221da70f77bcfde3e45db2f5031963f
7.2/en/os/i386/postgresql-tk-7.1.3-5.72.i386.rpm
a08d75e1e6822ad15ad013c85e6120c7
7.2/en/os/ia64/postgresql-7.1.3-5.72.ia64.rpm
7e28d5be8e0bd0d818165bec29ada464
7.2/en/os/ia64/postgresql-contrib-7.1.3-5.72.ia64.rpm
449ecf2e6e4366da0c40ea19cbec9d44
7.2/en/os/ia64/postgresql-devel-7.1.3-5.72.ia64.rpm
870a3375a086024dbb39f9045d4a8e5d
7.2/en/os/ia64/postgresql-docs-7.1.3-5.72.ia64.rpm
dca82ba0c32af1eeba14d6dd2c5900f1
7.2/en/os/ia64/postgresql-jdbc-7.1.3-5.72.ia64.rpm
7011e7f2a8dc5783a85fb4aac8021318
7.2/en/os/ia64/postgresql-libs-7.1.3-5.72.ia64.rpm
c29108c4f8aa08c10f3abbda7da44e2a
7.2/en/os/ia64/postgresql-odbc-7.1.3-5.72.ia64.rpm
a1de988920b4f4168cf3e5f6e1948d33
7.2/en/os/ia64/postgresql-perl-7.1.3-5.72.ia64.rpm
b76c3fdd7fd75022090ab2b3e34f89c5
7.2/en/os/ia64/postgresql-python-7.1.3-5.72.ia64.rpm
708e6aee14651d95c4545dca0ddb019b
7.2/en/os/ia64/postgresql-server-7.1.3-5.72.ia64.rpm
c6534b3683ae56c26f2dd7cddcf18850
7.2/en/os/ia64/postgresql-tcl-7.1.3-5.72.ia64.rpm
955f17c80ebfcca0d47a51b4b673cc49
7.2/en/os/ia64/postgresql-tk-7.1.3-5.72.ia64.rpm
14ea1e277128556a0917ff80f0100c41
7.3/en/os/SRPMS/postgresql-7.2.4-5.73.src.rpm
abd2341cc0b8f427f0f84c8ce6f7710e
7.3/en/os/i386/postgresql-7.2.4-5.73.i386.rpm
602a38f5dbd6b3a6f28c24316302d054
7.3/en/os/i386/postgresql-contrib-7.2.4-5.73.i386.rpm
d6bcea09edb4a5f2b4e359aec148fac6
7.3/en/os/i386/postgresql-devel-7.2.4-5.73.i386.rpm
3676c768fd98d65afaa36cf87a425f52
7.3/en/os/i386/postgresql-docs-7.2.4-5.73.i386.rpm
7fd081b51a0f58d4fe0cb0c9ab9f75cf
7.3/en/os/i386/postgresql-jdbc-7.2.4-5.73.i386.rpm
18783f38869468526aa6b08f3a83be20
7.3/en/os/i386/postgresql-libs-7.2.4-5.73.i386.rpm
0a8755748029b7a00cd72fdd983cd393
7.3/en/os/i386/postgresql-odbc-7.2.4-5.73.i386.rpm
838689dc075829db6daa31008bcf023f
7.3/en/os/i386/postgresql-perl-7.2.4-5.73.i386.rpm
f9ba380c5ffb8d60ea3a3a56a058a026
7.3/en/os/i386/postgresql-python-7.2.4-5.73.i386.rpm
f7c597c8a1e570b05cc2e96aaff36976
7.3/en/os/i386/postgresql-server-7.2.4-5.73.i386.rpm
5953fa3fb0b5c9b60995fea6f4d7a0bc
7.3/en/os/i386/postgresql-tcl-7.2.4-5.73.i386.rpm
9ed994f7a7bb893ad7231e9f061d6096
7.3/en/os/i386/postgresql-test-7.2.4-5.73.i386.rpm
eecaf538b82017ef9d9477e705dfe43e
7.3/en/os/i386/postgresql-tk-7.2.4-5.73.i386.rpm
41ddf2310b09192ece222c63db493bed
8.0/en/os/SRPMS/postgresql-7.2.4-5.80.src.rpm
10db84d5b83030a2e067863409c1483b
8.0/en/os/i386/postgresql-7.2.4-5.80.i386.rpm
355456728b812be50b511ac5ae5463cc
8.0/en/os/i386/postgresql-contrib-7.2.4-5.80.i386.rpm
2030c7cbaf2f6d9e7f8e418d85a5ae60
8.0/en/os/i386/postgresql-devel-7.2.4-5.80.i386.rpm
9d6573e6a1a28b3b49bcda3623bef83c
8.0/en/os/i386/postgresql-docs-7.2.4-5.80.i386.rpm
aba014dc312cb5f7456d9b95127d9c2d
8.0/en/os/i386/postgresql-jdbc-7.2.4-5.80.i386.rpm
ef7265999840169355faa8e1154d589c
8.0/en/os/i386/postgresql-libs-7.2.4-5.80.i386.rpm
10f6deacdcf4a8a0c0c033b339dd303f
8.0/en/os/i386/postgresql-odbc-7.2.4-5.80.i386.rpm
10266423863102563567bbc0a938d513
8.0/en/os/i386/postgresql-perl-7.2.4-5.80.i386.rpm
6918680b05f07654ca75996555df4d1d
8.0/en/os/i386/postgresql-python-7.2.4-5.80.i386.rpm
f0fbf27d2057e2eb89fb50dd8ec2f98f
8.0/en/os/i386/postgresql-server-7.2.4-5.80.i386.rpm
1a55f8dd7106b2986cad8a0a1160d6af
8.0/en/os/i386/postgresql-tcl-7.2.4-5.80.i386.rpm
cd10624a6f4a4d23e9d4d689972bb139
8.0/en/os/i386/postgresql-test-7.2.4-5.80.i386.rpm
acfcdc841d428c6546f5394906a8f488
8.0/en/os/i386/postgresql-tk-7.2.4-5.80.i386.rpm
ea813d6b53f8d59a68409c6ef567be2f
9/en/os/SRPMS/postgresql-7.3.4-3.rhl9.src.rpm
9fce9c3b0b03ff17d7c4e07adcd5e586
9/en/os/SRPMS/postgresql72-1-4.rhl9.src.rpm
a04d50e0d624f303757838666c330694
9/en/os/i386/postgresql-7.3.4-3.rhl9.i386.rpm
5ea368b9969bc8398304e30565ff9eea
9/en/os/i386/postgresql-contrib-7.3.4-3.rhl9.i386.rpm
714c16b8231b455751313a39adf62551
9/en/os/i386/postgresql-devel-7.3.4-3.rhl9.i386.rpm
4abc44081cc8a7b3990ac56381d05695
9/en/os/i386/postgresql-docs-7.3.4-3.rhl9.i386.rpm
8f74c8789290e339f978dfdd2ca31e98
9/en/os/i386/postgresql-jdbc-7.3.4-3.rhl9.i386.rpm
f466ae466664eb36444660405d6d0356
9/en/os/i386/postgresql-libs-7.3.4-3.rhl9.i386.rpm
a1408c200bbe537636cb220c675f9e00
9/en/os/i386/postgresql-pl-7.3.4-3.rhl9.i386.rpm
f835b6362b70f5feda9badb3658f32d2
9/en/os/i386/postgresql-python-7.3.4-3.rhl9.i386.rpm
8295e804046d6817c59eccdfa69bb44b
9/en/os/i386/postgresql-server-7.3.4-3.rhl9.i386.rpm
8cf2d9dc83d75423dade021d6f791722
9/en/os/i386/postgresql-tcl-7.3.4-3.rhl9.i386.rpm
514ebe0beda8da4446fda4cb4b221bbe
9/en/os/i386/postgresql-test-7.3.4-3.rhl9.i386.rpm
bbfb1a97b62ecb8f8f653c3b1bff5d65
9/en/os/i386/postgresql72-libs-1-4.rhl9.i386.rpm
These packages are GPG signed by Red Hat for security. Our key
is available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm –checksig -v <filename>
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:
md5sum <filename>
8. References:
http://www.securityfocus.com/bid/8741
http://archives.postgresql.org/pgsql-bugs/2003-09/msg00014.php
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0901
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
Red Hat Security Advisory
| Synopsis: | Updated zebra packages fix security vulnerabilities |
| Advisory ID: | RHSA-2003:307-01 |
| Issue date: | 2003-11-13 |
| Updated on: | 2003-11-13 |
| Product: | Red Hat Linux |
| Keywords: | DoS |
| Cross references: | |
| Obsoletes: | |
| CVE Names: | CAN-2003-0795 CAN-2003-0858 |
1. Topic:
Updated zebra packages that close a locally-exploitable and a
remotely-exploitable denial of service vulnerability are now
available.
2. Relevant releases/architectures:
Red Hat Linux 7.2 – i386, ia64
Red Hat Linux 7.3 – i386
Red Hat Linux 8.0 – i386
Red Hat Linux 9 – i386
3. Problem description:
Zebra an open source implementation of TCP/IP routing
software.
Jonny Robertson reported that Zebra can be remotely crashed if a
Zebra password has been enabled and a remote attacker can connect
to the Zebra telnet management port. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0795 to this issue.
Herbert Xu reported that Zebra can accept spoofed messages sent
on the kernel netlink interface by other users on the local
machine. This could lead to a local denial of service attack. The
Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0858 to this issue.
Users of Zebra should upgrade to these erratum packages, which
contain a patch preventing Zebra from crashing when it receives a
telnet option delimiter without any option data, and a patch that
checks that netlink messages actually came from the kernel.
4. Solution:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.
Please note that this update is also available via Red Hat
Network. Many people find this an easier way to apply updates. To
use Red Hat Network, launch the Red Hat Update Agent with the
following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
If up2date fails to connect to Red Hat Network due to SSL
Certificate Errors, you need to install a version of the up2date
client with an updated certificate. The latest version of up2date
is available from the Red Hat FTP site and may also be downloaded
directly from the RHN website:
https://rhn.redhat.com/help/latest-up2date.pxt
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):
107140 – CAN-2003-0795 Remote DoS in zebra
6. RPMs required:
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/zebra-0.91a-8.7.2.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/zebra-0.91a-8.7.2.i386.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/zebra-0.91a-8.7.2.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/zebra-0.92a-5.7.3.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/zebra-0.92a-5.7.3.i386.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/zebra-0.93a-5.8.0.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/zebra-0.93a-5.8.0.i386.rpm
Red Hat Linux 9:
SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/zebra-0.93b-4.9.src.rpm
i386:
ftp://updates.redhat.com/9/en/os/i386/zebra-0.93b-4.9.i386.rpm
7. Verification:
MD5 sum Package Name
1c42972cd3666c8d5c36fe2d4636bbbe
7.2/en/os/SRPMS/zebra-0.91a-8.7.2.src.rpm
f3c2cd447407735bfa0a6ee3ea107f9c
7.2/en/os/i386/zebra-0.91a-8.7.2.i386.rpm
2caa6379b78578f62c0267ae703dc552
7.2/en/os/ia64/zebra-0.91a-8.7.2.ia64.rpm
de79d8ae225cad78b897338307c74f70
7.3/en/os/SRPMS/zebra-0.92a-5.7.3.src.rpm
09d89f6a6d9ccb46bba080c6d7bc8b93
7.3/en/os/i386/zebra-0.92a-5.7.3.i386.rpm
4b4a738f98718f4e49c1ad16dfc8c515
8.0/en/os/SRPMS/zebra-0.93a-5.8.0.src.rpm
1665646ebda30a90ff04a06697b7df5f
8.0/en/os/i386/zebra-0.93a-5.8.0.i386.rpm
1d1e42921d7e83d7208a4c92aa9523e1
9/en/os/SRPMS/zebra-0.93b-4.9.src.rpm
73fad11a6b94e96ab66325c5bdac16cd
9/en/os/i386/zebra-0.93b-4.9.i386.rpm
These packages are GPG signed by Red Hat for security. Our key
is available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm –checksig -v <filename>
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0795
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0858
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
Red Hat Security Advisory
| Synopsis: | Updated glibc packages provide security and bug fixes |
| Advisory ID: | RHSA-2003:325-01 |
| Issue date: | 2003-11-12 |
| Updated on: | 2003-11-13 |
| Product: | Red Hat Linux |
| Keywords: | netlink getgrouplist |
| Cross references: | |
| Obsoletes: | RHSA-2003:212 |
| CVE Names: | CAN-2003-0689 CAN-2003-0859 |
1. Topic:
Updated glibc packages that resolve vulnerabilities and address
several bugs are now available.
2. Relevant releases/architectures:
Red Hat Linux 7.1 – i386, i686
Red Hat Linux 7.2 – i386, i686, ia64
Red Hat Linux 7.3 – i386, i686
Red Hat Linux 8.0 – i386, i686
Red Hat Linux 9 – i386, i686
3. Problem description:
The glibc packages contain GNU libc, which provides standard
system libraries.
A bug in the getgrouplist function can cause a buffer overflow
if the size of the group list is too small to hold all the user’s
groups. This overflow can cause segmentation faults in user
applications, which may have security implications, depending on
the application in question. This vulnerability exists only when an
administrator has placed a user in a number of groups larger than
that expected by an application. Therefore, there is no risk in
instances where users are members of few groups. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0689 to this issue.
Herbert Xu reported that various applications can accept spoofed
messages sent on the kernel netlink interface by other users on the
local machine. This could lead to a local denial of service attack.
In Red Hat Linux 9 and later, the glibc function getifaddrs uses
netlink and could therefore be vulnerable to this issue. The Common
Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0859 to this issue.
In addition to the security issues, a number of other bugs were
fixed.
Users are advised to upgrade to these erratum packages, which
contain a patch that checks that netlink messages actually came
from the kernel, a backported security patch for the getgroups list
vulnerability, and patches for the various bug fixes.
[Update 2003-11-13]: The packages for Red Hat Linux 9 have been
updated for compatibility with kernels not provided by Red Hat.
4. Solution:
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run the
following command at a shell prompt:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. On
the i686 architecture, *.i686.rpm packages should be installed
where available rather than *.i386.rpm.
If you are unsure which architecture you are on, run the
following command at a shell prompt:
rpm -q –qf ‘%{arch}n’ glibc
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.
Please note that this update is also available via Red Hat
Network. Many people find this an easier way to apply updates. To
use Red Hat Network, launch the Red Hat Update Agent with the
following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
If up2date fails to connect to Red Hat Network due to SSL
Certificate Errors, you need to install a version of the up2date
client with an updated certificate. The latest version of up2date
is available from the Red Hat FTP site and may also be downloaded
directly from the RHN website:
https://rhn.redhat.com/help/latest-up2date.pxt
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):
54697 – nscd locks immediately if started with -t 1 and nss_ldap
is used
83973 – Wrong sort order for uk_UA locale
85994 – SIGSEGV in malloc: __morecore clobbered by perror conflict
with _IO_check_libio
86032 – trailing spaces in /etc/ld.so.conf entries are not
ignored
88409 – strxfrm() overruns buffer by indexing with uninitialized
value
88456 – glibc-2.3.2-27.9.i686.rpm does not rpm -Fvh properly.
88978 – locale ja_JP.EUC-JP has two undefined bytes [buffer
overrun]
89448 – getaddrinfo segv – unitialized structure?
90002 – binary compatibility for ‘_res’ broken in glibc 2.3.x
90036 – race/deadlock in fork() with signal handler.
90077 – fopen@GLIBC_2_0 corrupts memory arena by buffer overrun
90301 – Programs fail at exit if compiled with gcc and
cxa_atexit
90987 – sprintf() is limited to 2^26 bytes.
91567 – setegid sets saved gid
97814 – “Incorrectly built binary which accesses errno…” message
in elf/rtld.c needs some way to be silenced.
97828 – Sudo returns segmentation fault
98966 – ldconfig automatically prepends /usr/lib and /lib to search
order
101261 – getnameinfo fails to to reverse lookup on IPv6
addresses
101691 – CAN-2003-0689 Buffer overrun in getgrouplist function in
initgroups.c
102709 – NPTL pthread_cond_broadcast hangs.
103727 – LD_PROFILE=libc.so.6 and sprof give seg fault
105348 – Closing socket breaks the cancellation type of current
thread
107846 – locale utility is broken on big-endian 64-bit
platforms
108634 – Signal handler installation races with signal,
glibc-2.3.2
109904 – problems after [RHSA-2003:325-01] glibc upgrades
109918 – executable code in .data in ld.so renders system unusable
for PaX users
6. RPMs required:
Red Hat Linux 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
Red Hat Linux 7.2:
SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
i386:
ftp://updates.redhat.com/7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
i686:
ftp://updates.redhat.com/7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
Red Hat Linux 7.3:
SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
i386:
ftp://updates.redhat.com/7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
i686:
ftp://updates.redhat.com/7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
ftp://updates.redhat.com/7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
Red Hat Linux 8.0:
SRPMS:
ftp://updates.redhat.com/8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
i386:
ftp://updates.redhat.com/8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
i686:
ftp://updates.redhat.com/8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
ftp://updates.redhat.com/8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
Red Hat Linux 9:
SRPMS:
ftp://updates.redhat.com/9/en/os/SRPMS/glibc-2.3.2-27.9.7.src.rpm
i386:
ftp://updates.redhat.com/9/en/os/i386/glibc-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-common-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-debug-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-devel-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-profile-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/glibc-utils-2.3.2-27.9.7.i386.rpm
ftp://updates.redhat.com/9/en/os/i386/nscd-2.3.2-27.9.7.i386.rpm
i686:
ftp://updates.redhat.com/9/en/os/i686/glibc-2.3.2-27.9.7.i686.rpm
ftp://updates.redhat.com/9/en/os/i686/nptl-devel-2.3.2-27.9.7.i686.rpm
7. Verification:
MD5 sum Package Name
08a9d7fdb2cc277c80f5a0e1529d7774
7.1/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45
7.1/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717
7.1/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4
7.1/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d
7.1/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f
7.1/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f
7.1/en/os/i686/glibc-2.2.4-33.i686.rpm
08a9d7fdb2cc277c80f5a0e1529d7774
7.2/en/os/SRPMS/glibc-2.2.4-33.src.rpm
83d041d5a108d6a27d5bb7e465c62d45
7.2/en/os/i386/glibc-2.2.4-33.i386.rpm
a99df9fce0cf177d42f611ca178a6717
7.2/en/os/i386/glibc-common-2.2.4-33.i386.rpm
9848447715453548af83418087deccd4
7.2/en/os/i386/glibc-devel-2.2.4-33.i386.rpm
d68a6aec30cf1e7d8fb7fc1c0b95e00d
7.2/en/os/i386/glibc-profile-2.2.4-33.i386.rpm
bee8aa9dd31b75b099c9fc6c5bd3295f
7.2/en/os/i386/nscd-2.2.4-33.i386.rpm
5585734c0358b3ba1f952dedbd9c443f
7.2/en/os/i686/glibc-2.2.4-33.i686.rpm
d0ded4d10fc72bfa3da24de5a7a078a0
7.2/en/os/ia64/glibc-2.2.4-33.ia64.rpm
44a7683cdfd8f763ccb1405784815fe4
7.2/en/os/ia64/glibc-common-2.2.4-33.ia64.rpm
5bd01df1cfc06fed52b3dd2928cef950
7.2/en/os/ia64/glibc-devel-2.2.4-33.ia64.rpm
27738cfcb12b46ee61e02950b39ed44e
7.2/en/os/ia64/glibc-profile-2.2.4-33.ia64.rpm
a0aad5ab63319615dac47dde5b5d9e16
7.2/en/os/ia64/nscd-2.2.4-33.ia64.rpm
8a161087ca8a0262fd1cdec70a0486a6
7.3/en/os/SRPMS/glibc-2.2.5-44.src.rpm
eb0107c7a3187b0c782314bf3cf38771
7.3/en/os/i386/glibc-2.2.5-44.i386.rpm
a22c95134d40d601ba1ee4dd69cb8372
7.3/en/os/i386/glibc-common-2.2.5-44.i386.rpm
46ed43e8ce6108be6dc628dc14093df5
7.3/en/os/i386/glibc-debug-2.2.5-44.i386.rpm
7945db62704b881f661b6972420564c1
7.3/en/os/i386/glibc-debug-static-2.2.5-44.i386.rpm
128c022a95b405e9628711f65e9bdf0b
7.3/en/os/i386/glibc-devel-2.2.5-44.i386.rpm
241a34a7487d9ff11bea274a11812f73
7.3/en/os/i386/glibc-profile-2.2.5-44.i386.rpm
1ba6bb800c87ed6eb497862da2e5d428
7.3/en/os/i386/glibc-utils-2.2.5-44.i386.rpm
3a465a1bbb95463cc837f1a3e7a20dbd
7.3/en/os/i386/nscd-2.2.5-44.i386.rpm
6c915957618eb229d17f1db2f0684f0f
7.3/en/os/i686/glibc-2.2.5-44.i686.rpm
82fe179cf917a3b012bdb1b2c50d6e7d
7.3/en/os/i686/glibc-debug-2.2.5-44.i686.rpm
d6c96dff6893d449a57439ec3b362ded
8.0/en/os/SRPMS/glibc-2.3.2-4.80.8.src.rpm
8058c50430bca5ee527c3521b8cd5019
8.0/en/os/i386/glibc-2.3.2-4.80.8.i386.rpm
62019c1ecff44880be70871a9b52c4bc
8.0/en/os/i386/glibc-common-2.3.2-4.80.8.i386.rpm
854a98301d8b8000c752a25d70b6634b
8.0/en/os/i386/glibc-debug-2.3.2-4.80.8.i386.rpm
44eb3be20de572a08370182cb5ee82d9
8.0/en/os/i386/glibc-debug-static-2.3.2-4.80.8.i386.rpm
4b091e271eac8c15ff68112b8b74b597
8.0/en/os/i386/glibc-devel-2.3.2-4.80.8.i386.rpm
1bf2647c6eadf4ca934f9a8e6ab5c8d4
8.0/en/os/i386/glibc-profile-2.3.2-4.80.8.i386.rpm
abfc2b5f8ee84966f136a6d703fb104d
8.0/en/os/i386/glibc-utils-2.3.2-4.80.8.i386.rpm
0c890751f548c460207e2514ca61b3ca
8.0/en/os/i386/nscd-2.3.2-4.80.8.i386.rpm
44d62332cb2494a62ad95473237b5ad4
8.0/en/os/i686/glibc-2.3.2-4.80.8.i686.rpm
1a74ed2bd5bc54a33f21543a59805235
8.0/en/os/i686/glibc-debug-2.3.2-4.80.8.i686.rpm
b0835a2d24994b0ec50b73f10e91c839
9/en/os/SRPMS/glibc-2.3.2-27.9.7.src.rpm
8e9e1bd574b10b6a55ee627973a46c7d
9/en/os/i386/glibc-2.3.2-27.9.7.i386.rpm
9a369a25585261ac590e4e02cde90d49
9/en/os/i386/glibc-common-2.3.2-27.9.7.i386.rpm
54c566f6dbf63e8efd8d48fcd845f48d
9/en/os/i386/glibc-debug-2.3.2-27.9.7.i386.rpm
83e103623d0b9e05937edc775094ad68
9/en/os/i386/glibc-devel-2.3.2-27.9.7.i386.rpm
7e6d0c5f8586a2605ed38d8ceb768973
9/en/os/i386/glibc-profile-2.3.2-27.9.7.i386.rpm
14f1b45918fc14abd744776c6cc8c9ce
9/en/os/i386/glibc-utils-2.3.2-27.9.7.i386.rpm
920d4bfedfb843818a38dcdfc491c6ef
9/en/os/i386/nscd-2.3.2-27.9.7.i386.rpm
b1311b31b1e2f349aaef5bba91be3caa
9/en/os/i686/glibc-2.3.2-27.9.7.i686.rpm
2d7819fa0bd582e4746e9b8ddbbceecf
9/en/os/i686/nptl-devel-2.3.2-27.9.7.i686.rpm
These packages are GPG signed by Red Hat for security. Our key
is available from https://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm –checksig -v <filename>
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0859
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More
contact details at https://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.