SOT Linux Security Advisory
| Subject: | Updated glibc package for SOT Linux 2003 |
| Advisory ID: | SLSA-2003:52 |
| Date: | Sunday, November 16, 2003 |
| Product: | OT Linux 2003 |
1. Problem description
The glibc packages contain GNU libc, which provides standard
system libraries.
The getgrouplist function in GNU libc allows may attackers to
cause a denial of service (segmentation fault) and execute
arbitrary code when a user is a member of a large number of groups,
which can cause a buffer overflow. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0689 to this issue.
SOT Linux 2003 users are advised to update glibc package.
2. Updated packages
SOT Linux 2003 Desktop:
i386:
ftp://ftp.sot.com/updates/2003/Desktop/i386/glibc-2.2.5-19.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Desktop/SRPMS/glibc-2.2.5-19.src.rpm
SOT Linux 2003 Server:
i386:
ftp://ftp.sot.com/updates/2003/Server/i386/glibc-2.2.5-19.i386.rpm
SRPMS:
ftp://ftp.sot.com/updates/2003/Server/SRPMS/glibc-2.2.5-19.src.rpm
3. Upgrading package
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
Use up2date to automatically upgrade the fixed packages.
If you want to upgrade manually, download the updated package
from the SOT Linux FTP site (use the links above) or from one of
our mirrors. The list of mirrors can be obtained at www.sot.com/en/linux
Update the package with the following command: rpm -Uvh
<filename>
4. Verification
All packages are PGP signed by SOT for security.
You can verify each package with the following command: rpm
–checksig <filename>
If you wish to verify the integrity of the downloaded package,
run “md5sum <filename>” and compare the output with data
given below.
Package Name MD5 sum
/Desktop/i386/glibc-2.2.5-19.i386.rpm
2ef4cb97101ff5114489dd305883b325
/Desktop/SRPMS/glibc-2.2.5-19.src.rpm
2dbac2a86337381559152d0af669ef1d
/Server/i386/glibc-2.2.5-19.i386.rpm
2ef4cb97101ff5114489dd305883b325
/Server/SRPMS/glibc-2.2.5-19.src.rpm
2dbac2a86337381559152d0af669ef1d
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0689
Copyright(c) 2001-2003 SOT