full-disclosure - [FLSA-2005:152870] Updated a2ps package fixes security issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <43A4F03F.9040402@videotron.ca>
Date: Sun Dec 18 05:14:01 2005
From: marcdeslauriers at videotron.ca (Marc Deslauriers)
Subject: [FLSA-2005:152870] Updated a2ps package fixes
	security issue

---------------------------------------------------------------------
               Fedora Legacy Update Advisory

Synopsis:          Updated a2ps package fixes security issue
Advisory ID:       FLSA:152870
Issue date:        2005-12-17
Product:           Red Hat Linux, Fedora Core
Keywords:          Bugfix
CVE Names:         CVE-2004-1170
---------------------------------------------------------------------

---------------------------------------------------------------------
1. Topic:

An updated a2ps package that fixes a security bug is now available.

The a2ps filter converts text and other types of files to PostScript
format.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386

3. Problem description:

A problem was discovered in the way a2ps handles filenames that include
shell metacharacters. An attacker could use this flaw to execute
arbitrary commands by providing a filename that includes metacharacters
as an argument. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CVE-2004-1170 to this issue.

All users of a2ps should upgrade to this updated package, which includes
a patch to correct this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which
are not installed but included in the list will not be updated.  Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.

Please note that this update is also available via yum and apt.  Many
people find this an easier way to apply updates.  To use yum issue:

yum update

or to use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.  This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152870

6. RPMs required:

Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/a2ps-4.13b-19.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/a2ps-4.13b-19.2.legacy.i386.rpm

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/a2ps-4.13b-28.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/a2ps-4.13b-28.2.legacy.i386.rpm

Fedora Core 1:

SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/a2ps-4.13b-30.2.legacy.src.rpm

i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/a2ps-4.13b-30.2.legacy.i386.rpm

7. Verification:

SHA1 sum                                 Package Name
---------------------------------------------------------------------

b0ebb139fd78a887831f8528458d969c42841283
redhat/7.3/updates/i386/a2ps-4.13b-19.2.legacy.i386.rpm
fb55530b7f25e02080fcd8c5126f9f5f042a5d43
redhat/7.3/updates/SRPMS/a2ps-4.13b-19.2.legacy.src.rpm
828dc69302ec1530ada589842da023e3eb796ab5
redhat/9/updates/i386/a2ps-4.13b-28.2.legacy.i386.rpm
8b3ef7ab2dca9d436fb34b2d11935921842c2779
redhat/9/updates/SRPMS/a2ps-4.13b-28.2.legacy.src.rpm
87a14c8ceafcc6e633430ed3715a9d63c3c9e837
fedora/1/updates/i386/a2ps-4.13b-30.2.legacy.i386.rpm
9426b2180ef3750090b05616daa776f88bbfb3fa
fedora/1/updates/SRPMS/a2ps-4.13b-30.2.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security.  Our key is
available from http://www.fedoralegacy.org/about/security.php

You can verify each package with the following command:

    rpm --checksig -v <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

    sha1sum <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1170

9. Contact:

The Fedora Legacy security contact is <secnotice@...oralegacy.org>. More
project details at http://www.fedoralegacy.org

---------------------------------------------------------------------
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051218/62c8abd3/signature-0001.bin