Red Hat Linux Advisories: XChat, GNU Ghostscript, bind, nss_ldap

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated xchat packages fix /dns vulnerability
Advisory ID:       RHSA-2002:097-08
Issue date:        2002-05-20
Updated on:        2002-06-04
Product:           Red Hat Linux
Keywords:          xchat dns vulnerability
Cross references:  
Obsoletes:         RHSA-2002:005
CVE Names:         CAN-2002-0382
---------------------------------------------------------------------

1. Topic:

A security issue in XChat allows a malicious server to execute arbitrary
commands.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc

Red Hat Linux 7.0 - alpha, i386

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

Red Hat Linux 7.3 - i386

3. Problem description:

XChat is a popular cross-platform IRC client. 

Versions of XChat prior to 1.8.9 do not filter the response from an IRC
server when a /dns query is executed. Because XChat resolves hostnames by
passing the configured resolver and hostname to a shell, an IRC server may
return a maliciously formatted response that executes arbitrary commands
with the privileges of the user running XChat.

All users of XChat are advised to update to these errata packages
containing XChat version 1.8.9 which is not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/xchat-1.8.9-1.62.0.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/xchat-1.8.9-1.62.0.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/xchat-1.8.9-1.62.0.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/xchat-1.8.9-1.62.0.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/xchat-1.8.9-1.70.0.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/xchat-1.8.9-1.70.0.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/xchat-1.8.9-1.70.0.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/xchat-1.8.9-1.71.0.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/xchat-1.8.9-1.71.0.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/xchat-1.8.9-1.71.0.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/xchat-1.8.9-1.71.0.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/xchat-1.8.9-1.72.0.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/xchat-1.8.9-1.72.0.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/xchat-1.8.9-1.72.0.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/xchat-1.8.9-1.73.0.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/xchat-1.8.9-1.73.0.i386.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
e9205c8b8d04eb867fb906fa3c4f3277 6.2/en/os/SRPMS/xchat-1.8.9-1.62.0.src.rpm
ed3402d01df1aff10adc5b3e8970667a 6.2/en/os/alpha/xchat-1.8.9-1.62.0.alpha.rpm
5b53b0f3a1bf0617df357e2512d5581d 6.2/en/os/i386/xchat-1.8.9-1.62.0.i386.rpm
d23b18f8f4df101cd2a18ad90b6400e3 6.2/en/os/sparc/xchat-1.8.9-1.62.0.sparc.rpm
4412093762c3c7bc83e0a76ac68aedff 7.0/en/os/SRPMS/xchat-1.8.9-1.70.0.src.rpm
e075d164b1bf297ad39424fef5698e2c 7.0/en/os/alpha/xchat-1.8.9-1.70.0.alpha.rpm
f6fc19d3f5d43ce0742e66334c6c229b 7.0/en/os/i386/xchat-1.8.9-1.70.0.i386.rpm
f461006a5e96a2cc606dc9d22844a194 7.1/en/os/SRPMS/xchat-1.8.9-1.71.0.src.rpm
535d9187ec52088cff5de38e3378cc5d 7.1/en/os/alpha/xchat-1.8.9-1.71.0.alpha.rpm
fa751c42b68ab8170684b479e249aced 7.1/en/os/i386/xchat-1.8.9-1.71.0.i386.rpm
db5b74b28cdedab821f590efca118f2c 7.1/en/os/ia64/xchat-1.8.9-1.71.0.ia64.rpm
9b9ba555093def10cdcf055c899b03af 7.2/en/os/SRPMS/xchat-1.8.9-1.72.0.src.rpm
6fabcf32b982ffb978f91b21c0f52fb8 7.2/en/os/i386/xchat-1.8.9-1.72.0.i386.rpm
eb3b95d31de4e478cd0525a2a8eeb1d6 7.2/en/os/ia64/xchat-1.8.9-1.72.0.ia64.rpm
2c166f6bd30336a83ad99041c9d3510c 7.3/en/os/SRPMS/xchat-1.8.9-1.73.0.src.rpm
bc85e6662044a386ce35b472635444fa 7.3/en/os/i386/xchat-1.8.9-1.73.0.i386.rpm
 

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://online.securityfocus.com/bid/4376/info/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0382



Copyright(c) 2000, 2001, 2002 Red Hat, Inc.



_____________________________________________


---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Ghostscript command execution vulnerability
Advisory ID:       RHSA-2002:083-22
Issue date:        2002-05-07
Updated on:        2002-06-03
Product:           Red Hat Linux
Keywords:          ghostscript SAFER PARANOIDSAFER
Cross references:  
Obsoletes:         RHSA-2001:112 RHSA-2001:138
CVE Names:         CAN-2002-0363
---------------------------------------------------------------------

1. Topic:

Updated packages are available for GNU Ghostscript which fix a
vulnerability found during Postscript interpretation.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, noarch, sparc

Red Hat Linux 7.0 - alpha, i386, noarch

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

Red Hat Linux 7.3 - i386

3. Problem description:

Ghostscript is a program for displaying PostScript files or printing them
to non-PostScript printers.

An untrusted PostScript file can cause ghostscript to execute arbitrary
commands due to insufficient checking. Since ghostscript is often used
during the course of printing a document (and is run as user 'lp'), all
users should install these fixed packages.

The problem is fixed in the 6.53 source release of GNU Ghostscript, and the
fix has been backported and applied to the packages referenced by this
advisory.

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has
assigned the name CAN-2002-0363 to this issue.

Please note that this vulnerability is different to the 'local file read'
issue corrected by our previous Ghostscript errata (RHSA-2001:112 and
RHSA-2001:138)

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains
the desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/ghostscript-6.51-16.1.6x.1.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/VFlib2-2.25.1-11.6x.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/xtt-fonts-0.19990222-8.6x.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/ghostscript-6.51-16.1.6x.1.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-2.25.1-11.6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-devel-2.25.1-11.6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/VFlib2-VFjfm-2.25.1-11.6x.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/ghostscript-6.51-16.1.6x.1.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-2.25.1-11.6x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-devel-2.25.1-11.6x.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/VFlib2-VFjfm-2.25.1-11.6x.i386.rpm

noarch:
ftp://updates.redhat.com/6.2/en/os/noarch/xtt-fonts-0.19990222-8.6x.noarch.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/ghostscript-6.51-16.1.6x.1.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-2.25.1-11.6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-devel-2.25.1-11.6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/VFlib2-VFjfm-2.25.1-11.6x.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/VFlib2-2.25.1-12.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/xtt-fonts-0.19990222-9.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-2.25.1-12.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-devel-2.25.1-12.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/VFlib2-VFjfm-2.25.1-12.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-2.25.1-12.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-devel-2.25.1-12.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/VFlib2-VFjfm-2.25.1-12.i386.rpm

noarch:
ftp://updates.redhat.com/7.0/en/os/noarch/xtt-fonts-0.19990222-9.noarch.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/ghostscript-6.51-16.1.7x.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/ghostscript-6.51-16.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/printconf-0.3.61-4.1.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/ghostscript-6.51-16.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/printconf-0.3.61-4.1.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/printconf-gui-0.3.61-4.1.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/ghostscript-6.51-16.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/printconf-0.3.61-4.1.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/printconf-gui-0.3.61-4.1.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/ghostscript-6.52-9.4.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/ghostscript-6.52-9.4.i386.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
39b9b94fb6a17c6d3a02c9e52db84d75 6.2/en/os/SRPMS/VFlib2-2.25.1-11.6x.src.rpm
fd9392c8956670b0032136e7470ebb4b 6.2/en/os/SRPMS/ghostscript-6.51-16.1.6x.1.src.rpm
2be01efc98d82b5f1b5ed8cd58ae38ca 6.2/en/os/SRPMS/xtt-fonts-0.19990222-8.6x.src.rpm
a0f75f1ca786acf5352f150d517d9ac5 6.2/en/os/alpha/VFlib2-2.25.1-11.6x.alpha.rpm
dbfb7d677e1a94bf3070abb662e406b5 6.2/en/os/alpha/VFlib2-VFjfm-2.25.1-11.6x.alpha.rpm
7077d0eb914bf0cb72431c883735821f 6.2/en/os/alpha/VFlib2-devel-2.25.1-11.6x.alpha.rpm
d7734831910f1e8de8fe022cbae8a3d7 6.2/en/os/alpha/ghostscript-6.51-16.1.6x.1.alpha.rpm
2ae611a68c01f9376b825b536068669c 6.2/en/os/i386/VFlib2-2.25.1-11.6x.i386.rpm
21420c0e8e89c78205e00f251e66f844 6.2/en/os/i386/VFlib2-VFjfm-2.25.1-11.6x.i386.rpm
1b757aea2d8051f8922961501f9a8678 6.2/en/os/i386/VFlib2-devel-2.25.1-11.6x.i386.rpm
e54c57c10e28fd145c5e1f97f3f8f5ed 6.2/en/os/i386/ghostscript-6.51-16.1.6x.1.i386.rpm
1455e9fc7056f4593cee248a580d6fae 6.2/en/os/noarch/xtt-fonts-0.19990222-8.6x.noarch.rpm
18baaa094259076a7edd4c4d7d2ec7e9 6.2/en/os/sparc/VFlib2-2.25.1-11.6x.sparc.rpm
c2fe83310287c7f1f0ca743261240c28 6.2/en/os/sparc/VFlib2-VFjfm-2.25.1-11.6x.sparc.rpm
ebbc6503b8f99e1e3dd79ad9766cac04 6.2/en/os/sparc/VFlib2-devel-2.25.1-11.6x.sparc.rpm
fbf618b69fd5404081d761029778c696 6.2/en/os/sparc/ghostscript-6.51-16.1.6x.1.sparc.rpm
d25a61585c232c8f56d5ec49922ad246 7.0/en/os/SRPMS/VFlib2-2.25.1-12.src.rpm
93532d180a459cf853a59945ff81b6ee 7.0/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm
40037639055d00c9b4f1af144beabee4 7.0/en/os/SRPMS/xtt-fonts-0.19990222-9.src.rpm
b1a69584ede57bd1a264e8e892d9e182 7.0/en/os/alpha/VFlib2-2.25.1-12.alpha.rpm
bea84891fe60e6c08005b7a9d9219e11 7.0/en/os/alpha/VFlib2-VFjfm-2.25.1-12.alpha.rpm
75dd6c3d2d5af442fc6f150a4d71671a 7.0/en/os/alpha/VFlib2-devel-2.25.1-12.alpha.rpm
8fe589c020ef43db2b27dfc47fd8b4be 7.0/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
ee7127247a44d2e49f0be52d815db09d 7.0/en/os/i386/VFlib2-2.25.1-12.i386.rpm
979ea17d5ef0db8f9e825381453524fb 7.0/en/os/i386/VFlib2-VFjfm-2.25.1-12.i386.rpm
9a5a772d9b9bd01b3b80e130ece11c48 7.0/en/os/i386/VFlib2-devel-2.25.1-12.i386.rpm
a317acb4dbee54a5239356f1d3612df6 7.0/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm
bf996108e1bfed22384d849a10a03807 7.0/en/os/noarch/xtt-fonts-0.19990222-9.noarch.rpm
93532d180a459cf853a59945ff81b6ee 7.1/en/os/SRPMS/ghostscript-6.51-16.1.7x.src.rpm
8fe589c020ef43db2b27dfc47fd8b4be 7.1/en/os/alpha/ghostscript-6.51-16.1.7x.alpha.rpm
a317acb4dbee54a5239356f1d3612df6 7.1/en/os/i386/ghostscript-6.51-16.1.7x.i386.rpm
75db622c8177dffc116f221d678f7c0d 7.1/en/os/ia64/ghostscript-6.51-16.1.7x.ia64.rpm
ddb0f44bdbd59608cf1a0e07bc4fdf01 7.2/en/os/SRPMS/ghostscript-6.51-16.2.src.rpm
c5232bb663dbde2e04d7b19cbba87246 7.2/en/os/SRPMS/printconf-0.3.61-4.1.src.rpm
04199f3a2f4fa4b6998c6b229c4f4f3a 7.2/en/os/i386/ghostscript-6.51-16.2.i386.rpm
c722ab94c36110b54e600854e7e5f20d 7.2/en/os/i386/printconf-0.3.61-4.1.i386.rpm
3156e37a7252c3603b83310b0b4cd50b 7.2/en/os/i386/printconf-gui-0.3.61-4.1.i386.rpm
448bb8057d7669158c19efeae2f310ec 7.2/en/os/ia64/ghostscript-6.51-16.2.ia64.rpm
aea25c90e71a2f3d927aa0c62a29c687 7.2/en/os/ia64/printconf-0.3.61-4.1.ia64.rpm
53ce3bddd1f78b5de5067478f719b39f 7.2/en/os/ia64/printconf-gui-0.3.61-4.1.ia64.rpm
a447ff805d6d55a9e93498bdb41699a5 7.3/en/os/SRPMS/ghostscript-6.52-9.4.src.rpm
0f85846611c14aad7ca81e2a36f1247e 7.3/en/os/i386/ghostscript-6.52-9.4.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:


http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0363



Copyright(c) 2000, 2001, 2002 Red Hat, Inc.



_____________________________________________

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated bind packages fix denial of service attack
Advisory ID:       RHSA-2002:105-09
Issue date:        2002-06-02
Updated on:        2002-06-04
Product:           Red Hat Linux
Keywords:          bind srv consistancy dos
Cross references:  
Obsoletes:         RHSA-2001:007
CVE Names:         CAN-2002-0400
---------------------------------------------------------------------

1. Topic:

Version 9 of the bind name prior to version 9.2.1 contain a denial of
service vulnerability.

2. Relevant releases/architectures:

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

Red Hat Linux 7.3 - i386

3. Problem description:

BIND (Berkeley Internet Name Domain) is an implementation of the DNS
(Domain Name System) protocols.  Versions of BIND 9 prior to 9.2.1 have a bug
that causes certain requests to the BIND name server (named) to fail an
internal consistency check, causing the name server to stop responding to
requests.  This can be used by a remote attacker to cause a denial of
service (DOS) attack against name servers.

Red Hat Linux 7.1, 7.2 and 7.3 shipped with versions of BIND vulnerable to
this issue.  All users of BIND are advised to upgrade to the errata
packages containing BIND 9.2.1 which is not vulnerable to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/bind-9.2.1-0.70.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/bind-9.2.1-0.70.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/bind-devel-9.2.1-0.70.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/bind-utils-9.2.1-0.70.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/bind-9.2.1-0.70.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/bind-devel-9.2.1-0.70.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/bind-utils-9.2.1-0.70.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/bind-9.2.1-0.70.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/bind-devel-9.2.1-0.70.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/bind-utils-9.2.1-0.70.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/bind-9.2.1-0.7x.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/bind-9.2.1-0.7x.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/bind-devel-9.2.1-0.7x.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/bind-utils-9.2.1-0.7x.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/bind-9.2.1-0.7x.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/bind-devel-9.2.1-0.7x.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/bind-utils-9.2.1-0.7x.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/bind-9.2.1-0.7x.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/bind-9.2.1-0.7x.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/bind-devel-9.2.1-0.7x.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/bind-utils-9.2.1-0.7x.i386.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
b7c3a3e21b75f3cc3b67891988c3a061 7.1/en/os/SRPMS/bind-9.2.1-0.70.src.rpm
99d1b6ba14c3df1c5f31a3d4e2627095 7.1/en/os/alpha/bind-9.2.1-0.70.alpha.rpm
a6c926dd242e6248cd3fd7e830f09f2d 7.1/en/os/alpha/bind-devel-9.2.1-0.70.alpha.rpm
32c028a6a58726fcb66fcd59a2540696 7.1/en/os/alpha/bind-utils-9.2.1-0.70.alpha.rpm
eaf7057b6f168b79f4dc31956e7fdc8e 7.1/en/os/i386/bind-9.2.1-0.70.i386.rpm
210292b24525009ee5c7cdf2b8c4b7a8 7.1/en/os/i386/bind-devel-9.2.1-0.70.i386.rpm
d3229a5c3ab3b30a64e923d15edbe3bf 7.1/en/os/i386/bind-utils-9.2.1-0.70.i386.rpm
b05d4ff48a2cd89babf50e8097489245 7.1/en/os/ia64/bind-9.2.1-0.70.ia64.rpm
e41811e4bfc33aad40e609a8c71cace3 7.1/en/os/ia64/bind-devel-9.2.1-0.70.ia64.rpm
8737f157ddb70f1e272d34c6448bf0bf 7.1/en/os/ia64/bind-utils-9.2.1-0.70.ia64.rpm
2443a2f29ddf9af62eb48038bde0b9ee 7.2/en/os/SRPMS/bind-9.2.1-0.7x.src.rpm
16f6b21979fcbd90a5b044f5208ef20b 7.2/en/os/i386/bind-9.2.1-0.7x.i386.rpm
e6c63bf2190d50a3b014586304b97465 7.2/en/os/i386/bind-devel-9.2.1-0.7x.i386.rpm
6ca180c3e8ce4477cddd734843374e18 7.2/en/os/i386/bind-utils-9.2.1-0.7x.i386.rpm
50fba0e5fa8a33cc4db9020f76140824 7.2/en/os/ia64/bind-9.2.1-0.7x.ia64.rpm
983dd7df3f5ce85e50fcc92ec6055b05 7.2/en/os/ia64/bind-devel-9.2.1-0.7x.ia64.rpm
927cd81e750a524dace2d4f085b10976 7.2/en/os/ia64/bind-utils-9.2.1-0.7x.ia64.rpm
2443a2f29ddf9af62eb48038bde0b9ee 7.3/en/os/SRPMS/bind-9.2.1-0.7x.src.rpm
16f6b21979fcbd90a5b044f5208ef20b 7.3/en/os/i386/bind-9.2.1-0.7x.i386.rpm
e6c63bf2190d50a3b014586304b97465 7.3/en/os/i386/bind-devel-9.2.1-0.7x.i386.rpm
6ca180c3e8ce4477cddd734843374e18 7.3/en/os/i386/bind-utils-9.2.1-0.7x.i386.rpm
 

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:


http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0400



Copyright(c) 2000, 2001, 2002 Red Hat, Inc.



_____________________________________________

---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          Updated nss_ldap packages fix pam_ldap vulnerability
Advisory ID:       RHSA-2002:084-22
Issue date:        2002-05-07
Updated on:        2002-06-04
Product:           Red Hat Linux
Keywords:          pam_ldap format string syslog security
Cross references:  
Obsoletes:         RHSA-2000:024
CVE Names:         CAN-2002-0374
---------------------------------------------------------------------

1. Topic:

Updated nss_ldap packages are now available for Red Hat Linux 6.2, 7,
7.1, 7.2, and 7.3. These packages fix a string format vulnerability in the
pam_ldap module.

[Update Jun 4, 2002]
Replacement packages have been added for Red Hat Linux 6.2. The previous
packages could not be installed with the version of RPM that shipped with
Red Hat Linux 6.2

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc

Red Hat Linux 7.0 - alpha, i386

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

Red Hat Linux 7.3 - i386

3. Problem description:

The pam_ldap module provides authentication for user access to a system by
consulting a directory using LDAP. Versions of pam_ldap prior to version
144 include a format string bug in the logging function. The packages
included in this erratum update pam_ldap to version 144, fixing this bug.

The Common Vulnerabilities and Exposures project (cve.mitre.org/) has
assigned the name CAN-2002-0374 to this issue.

Due to differences in the default behavior of the pam_ldap module when
performing account management, the version of authconfig included in Red
Rat Linux 7.2 generates incorrect /etc/pam.d/system-auth files for 
the version of pam_ldap included in this erratum.  Thus, an updated 
version of authconfig for Red Hat Linux 7.2 is included in this erratum 
(versions of authconfig included with Red Hat Linux 7, 7.1, and 7.3 are not
affected).

Our thanks go to the pam_ldap team at padl.com for bringing this to our
attention.

A previous revision of this erratum included packages which could not be
installed with the version of RPM included with Red Hat Linux 6.2.  While
they can be installed with versions of RPM which have been released as
errata for Red Hat Linux 6.2, this revision includes packages which remove
this restriction.  Packages for Red Hat Linux 7, 7.1, 7.2, and 7.3 have not
been modified.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory only contains
the desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/nss_ldap-189-1.6.2.1.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/nss_ldap-189-1.6.2.1.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/nss_ldap-189-1.6.2.1.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/nss_ldap-189-1.6.2.1.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/nss_ldap-189-1.7.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/nss_ldap-189-1.7.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/nss_ldap-189-1.7.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/nss_ldap-189-1.7.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/nss_ldap-189-1.7.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/nss_ldap-189-1.7.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/nss_ldap-189-1.7.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/nss_ldap-189-2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/authconfig-4.1.19.2-1.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/nss_ldap-189-2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/authconfig-4.1.19.2-1.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/nss_ldap-189-2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/authconfig-4.1.19.2-1.ia64.rpm

Red Hat Linux 7.3:

SRPMS:
ftp://updates.redhat.com/7.3/en/os/SRPMS/nss_ldap-189-2.src.rpm

i386:
ftp://updates.redhat.com/7.3/en/os/i386/nss_ldap-189-2.i386.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
1d947c9c45f55aca6736b3f2999469a5 6.2/en/os/SRPMS/nss_ldap-189-1.6.2.1.src.rpm
4d57f85b69e5c9ec91f2578163172282 6.2/en/os/alpha/nss_ldap-189-1.6.2.1.alpha.rpm
e1b67000a19c392dfa1e8c2db5f269ae 6.2/en/os/i386/nss_ldap-189-1.6.2.1.i386.rpm
c9d5b7348ab2281447eda442363ab89e 6.2/en/os/sparc/nss_ldap-189-1.6.2.1.sparc.rpm
1eb57f3965d1c68d7891c8a858573ae1 7.0/en/os/SRPMS/nss_ldap-189-1.7.src.rpm
6f3838a447d9766b782886695df52149 7.0/en/os/alpha/nss_ldap-189-1.7.alpha.rpm
8484f482a1a6816a0c5e1dade2d7fd33 7.0/en/os/i386/nss_ldap-189-1.7.i386.rpm
1eb57f3965d1c68d7891c8a858573ae1 7.1/en/os/SRPMS/nss_ldap-189-1.7.src.rpm
6f3838a447d9766b782886695df52149 7.1/en/os/alpha/nss_ldap-189-1.7.alpha.rpm
8484f482a1a6816a0c5e1dade2d7fd33 7.1/en/os/i386/nss_ldap-189-1.7.i386.rpm
5805176343cfd2b7e033ce8cf8d0706d 7.1/en/os/ia64/nss_ldap-189-1.7.ia64.rpm
7216e533cd6cab1ff4fb46171a585b43 7.2/en/os/SRPMS/authconfig-4.1.19.2-1.src.rpm
d977011dc7bbc3eea5b3e01ce7d364d9 7.2/en/os/SRPMS/nss_ldap-189-2.src.rpm
7282baea30503699772dd3e2aa866a11 7.2/en/os/i386/authconfig-4.1.19.2-1.i386.rpm
d2b2402e6c59f886556872d6b2bc2f16 7.2/en/os/i386/nss_ldap-189-2.i386.rpm
0c451e5cb1cb7e5a5d7152aa91ee3834 7.2/en/os/ia64/authconfig-4.1.19.2-1.ia64.rpm
7d07126091032adfdae1d2192b9ca264 7.2/en/os/ia64/nss_ldap-189-2.ia64.rpm
d977011dc7bbc3eea5b3e01ce7d364d9 7.3/en/os/SRPMS/nss_ldap-189-2.src.rpm
d2b2402e6c59f886556872d6b2bc2f16 7.3/en/os/i386/nss_ldap-189-2.i386.rpm
 

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://www.padl.com/OSS/pam_ldap.html
http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0053.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0374



Copyright(c) 2000, 2001, 2002 Red Hat, Inc.