lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <42D86AE2.4070402@videotron.ca> Date: Sat Jul 16 03:02:58 2005 From: marcdeslauriers at videotron.ca (Marc Deslauriers) Subject: [FLSA-2005:152917] Updated curl packages fix a security issue --------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated curl packages fix a security issue Advisory ID: FLSA:152917 Issue date: 2005-07-15 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CAN-2005-0490 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: Updated curl packages are now available. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: Multiple buffer overflow bugs were found in the way curl processes base64 encoded replies. If a victim can be tricked into visiting a URL with curl, a malicious web server could execute arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0490 to this issue. All users of curl are advised to upgrade to these updated packages, which contain backported fixes for these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152917 6. RPMs required: Red Hat Linux 7.3: SRPM: http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 8032bf94d434873de3f02100fd8eb36b206cba02 redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm 2d95c39024f58f3a7897e58da3da39dd297c8109 redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm 559d63a957091747972eb963a29642ef7c3835d7 redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm ca02f070ca45c96cfb93157e88b81f96c4646051 redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm 57329416fa302765f25ba963bf9a6d334a225e72 redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm e793df5a65927b98203c0308972389cc80896749 redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm c083d601e3b6f1c54dede72bb635e0215bb6230b fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm 835a427b82413d4ccc83a17dbc0ea0204dfd1e4a fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm cb59fc5fd7f74e1e5d407fe6fdd4d086e7f93bac fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm c8c23e7748058bd6965efb188fc02fc27bc1f1c1 fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm 401b44aeb653730fb6dcc7b83ecb88f9600f64cc fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm d0fbc3ee3137034a02cdc136959f7e119daae817 fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0490 9. Contact: The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More project details at http://www.fedoralegacy.org --------------------------------------------------------------------- -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 189 bytes Desc: OpenPGP digital signature Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050715/38b2ef70/signature-0001.bin
Powered by blists - more mailing lists