The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


[CLA-2003:643] Conectiva Security Announcement - slocate


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Thu, 8 May 2003 12:47:55 -0300
From: Conectiva Updates <[email protected]>
To: [email protected], [email protected],
Subject: [CLA-2003:643] Conectiva Security Announcement - slocate

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : slocate
SUMMARY   : Buffer overflow vulnerability
DATE      : 2003-05-08 12:45:00
ID        : CLA-2003:643
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 "slocate"[1] is a program which catalogues existing files and allows
 for a quick lookup later.
 
 It has been reported[2] that slocate contains a buffer overflow
 vulnerability which could be used by a local attacker to obtain the
 privileges of the slocate user.
 
 With these privileges, the attacker could read and alter the slocate
 database, insert false data or find out paths to files which he/she
 would otherwise not know due to filesystem restrictions.
 
 The author released version 2.7 which is not vulnerable to this
 issue.


SOLUTION
 It is recommended that all slocate users upgrade their packages.
 
 
 REFERENCES
 1. http://www.geekreview.org/slocate/
 2. http://marc.theaimsgroup.com/?l=bugtraq&m=104342864418213&w=2
 3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2003-0056


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/slocate-2.7-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/slocate-2.7-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/slocate-2.7-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/slocate-2.7-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/slocate-2.7-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/slocate-2.7-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+unwp42jd0JmAcZARAnWNAJ0ZBU4N/ChhGmu+YAIAkPSzh9hSOQCdGRcv
XWl8t7GbakmA1MNsQuuad6A=
=IxEr
-----END PGP SIGNATURE-----

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру