Message-ID: <42D86AE2.4070402@videotron.ca>
Date: Fri, 15 Jul 2005 22:03:14 -0400
From: Marc Deslauriers <marcdeslauriers@...eotron.ca>
To: bugtraq@...urityfocus.com, full-disclosure@...ts.grok.org.uk
Subject: [FLSA-2005:152917] Updated curl packages fix a
	security issue

---------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated curl packages fix a security issue
Advisory ID:       FLSA:152917
Issue date:        2005-07-15
Product:           Red Hat Linux, Fedora Core
Keywords:          Bugfix
CVE Names:         CAN-2005-0490
---------------------------------------------------------------------


---------------------------------------------------------------------
1. Topic:

Updated curl packages are now available.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and
Dict servers, using any of the supported protocols. cURL is designed
to work without user interaction or any kind of interactivity.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386

3. Problem description:

Multiple buffer overflow bugs were found in the way curl processes
base64 encoded replies. If a victim can be tricked into visiting a URL
with curl, a malicious web server could execute arbitrary code on a
victim's machine. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0490 to this issue.

All users of curl are advised to upgrade to these updated packages,
which contain backported fixes for these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152917

6. RPMs required:

Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm
http://download.fedoralegacy.org/fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm

Fedora Core 2:

SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm
http://download.fedoralegacy.org/fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm


7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------

8032bf94d434873de3f02100fd8eb36b206cba02
redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm
2d95c39024f58f3a7897e58da3da39dd297c8109
redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm
559d63a957091747972eb963a29642ef7c3835d7
redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm
ca02f070ca45c96cfb93157e88b81f96c4646051
redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm
57329416fa302765f25ba963bf9a6d334a225e72
redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm
e793df5a65927b98203c0308972389cc80896749
redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm
c083d601e3b6f1c54dede72bb635e0215bb6230b
fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm
835a427b82413d4ccc83a17dbc0ea0204dfd1e4a
fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm
cb59fc5fd7f74e1e5d407fe6fdd4d086e7f93bac
fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm
c8c23e7748058bd6965efb188fc02fc27bc1f1c1
fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm
401b44aeb653730fb6dcc7b83ecb88f9600f64cc
fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm
d0fbc3ee3137034a02cdc136959f7e119daae817
fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0490

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists