Message-ID: <20041008090121.GB13517@home.thedom.org>
Date: Fri, 8 Oct 2004 10:01:22 +0100
From: Dominic Hargreaves <dom@...th.li>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.netsys.com
Subject: [FLSA-2004:1257] Updated netpbm packages fix security vulnerabilities

-----------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated netpbm resolves security vulnerabilities
Advisory ID:       FLSA:1257
Issue date:        2004-10-08
Product:           Red Hat Linux
Keywords:          Security
Cross references:  https://bugzilla.fedora.us/show_bug.cgi?id=1257
CVE Names:         CVE-2003-0924
-----------------------------------------------------------------------


-----------------------------------------------------------------------
1. Topic:

Updated netpbm packages that fix security vulnerabilities are now
available.

The netpbm package contains a library of functions that support
programs for handling various graphics file formats, including .pbm
(portable bitmaps), .pgm (portable graymaps), .pnm (portable anymaps),
.ppm (portable pixmaps), and others.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386

3. Problem description:

A number of temporary file bugs have been found in versions of NetPBM.
These could make it possible for a local user to overwrite or create files
as a different user who happens to run one of the the vulnerable utilities.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2003-0924 to this issue.

Users are advised to upgrade to the erratum packages, which contain patches
from Debian that correct these bugs.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.  This assumes that you have yum or
apt-get configured for obtaining Fedora Legacy content. Please visit
http://www.fedoralegacy.org/docs/ for directions on how to configure yum
and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - 1257 - CAN-2003-0924: Temp file vuln in NetPBM

6. RPMs required:

Red Hat Linux 7.3:

SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm


Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm

i386: 
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------------

79c8c3e9e4ef5c60eb0dd243b38775cb24c49e18  7.3/updates/SRPMS/netpbm-9.24-9.73.4.legacy.src.rpm
4a0e11ad855172ce86042d0f85991b6f28f4811b  7.3/updates/i386/netpbm-9.24-9.73.4.legacy.i386.rpm
d69d449139408cf50de7557f38fd9f3a3f86b4c3  7.3/updates/i386/netpbm-devel-9.24-9.73.4.legacy.i386.rpm
173fa566ed92e222581817c4326b3dd501f24313  7.3/updates/i386/netpbm-progs-9.24-9.73.4.legacy.i386.rpm

729fd0be3b7f6ff031436cd8a563edbc57b76ad6  9/updates/SRPMS/netpbm-9.24-10.90.3.legacy.src.rpm
ac5ee4489c0632057ef6d9844ad2c935e5754053  9/updates/i386/netpbm-9.24-10.90.3.legacy.i386.rpm
0d59209ef7e8e4d7630d8f23c372f01adeddeea5  9/updates/i386/netpbm-devel-9.24-10.90.3.legacy.i386.rpm
8076a88d1c299a80db24e7559d0ea6853e6520b9  9/updates/i386/netpbm-progs-9.24-10.90.3.legacy.i386.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://www.kb.cert.org/vuls/id/487102
https://rhn.redhat.com/errata/RHSA-2004-031.html

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

Powered by blists - more mailing lists