full-disclosure - [ MDKSA-2006:142 ] - Updated heartbeat packages fix vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1GCkbI-0001WS-D7@mercury.mandriva.com>
Date: Mon, 14 Aug 2006 16:08:00 -0600
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDKSA-2006:142 ] - Updated heartbeat packages
	fix vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2006:142
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : heartbeat
 Date    : August 14, 2006
 Affected: 2006.0, Corporate 3.0
 _______________________________________________________________________
 
 Problem Description:
 
 Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan
 Rong Ge.  The first is that heartbeat would set insecure permissions in
 an shmget call for shared memory, allowing a local attacker to cause an
 unspecified denial of service via unknown vectors (CVE-2006-3815).
 
 The second is a remote vulnerability that could allow allow the master
 control process to read invalid memory due to a specially crafted
 heartbeat message and die of a SEGV, all prior to any authentication
 (CVE-2006-3121).
 
 Updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3121
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3815
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2006.0:
 7797a304e73645cb0dd518936b6a0d59  2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.i586.rpm
 9024d2ddeabed550864f4087f5d1203a  2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.i586.rpm
 0cc86c13aa345167fc28732ad8d4c488  2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.i586.rpm
 32ae04a5e100527f28005cc95d58bab3  2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.i586.rpm
 0b0c39c8f6bc55a1742346c2ab74d476  2006.0/RPMS/libheartbeat0-1.2.3-5.2.20060mdk.i586.rpm
 a4306e4730d23f7c44cde38148d2fbf0  2006.0/RPMS/libheartbeat0-devel-1.2.3-5.2.20060mdk.i586.rpm
 d9ed984f7044b1fd895bf48a17646149  2006.0/RPMS/libheartbeat-pils0-1.2.3-5.2.20060mdk.i586.rpm
 893136133c78f81f45c5a46b90bd56f6  2006.0/RPMS/libheartbeat-pils0-devel-1.2.3-5.2.20060mdk.i586.rpm
 fc48ae914852b91d25e204df5013ea88  2006.0/RPMS/libheartbeat-stonith0-1.2.3-5.2.20060mdk.i586.rpm
 27dba06cd918f4e44e7316f37c0728e1  2006.0/RPMS/libheartbeat-stonith0-devel-1.2.3-5.2.20060mdk.i586.rpm
 ec184261c2b75735f245058cc102875b  2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm

 Mandriva Linux 2006.0/X86_64:
 ceefc3ca6b8bfd9e5342c7e57c9d22de  x86_64/2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.x86_64.rpm
 056f0fc351514d5daf25e8b7c0dac268  x86_64/2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.x86_64.rpm
 511ed82622928343faa187cd4be07b23  x86_64/2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.x86_64.rpm
 ccedb1fac9aa393d83b1e261b83ca32e  x86_64/2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.x86_64.rpm
 bbb2d50dabbf3c782282403e185e3ed3  x86_64/2006.0/RPMS/lib64heartbeat0-1.2.3-5.2.20060mdk.x86_64.rpm
 e960d1a0be192e27325e8080ff805d30  x86_64/2006.0/RPMS/lib64heartbeat0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
 3806435d23c0d78c01f095349098ab32  x86_64/2006.0/RPMS/lib64heartbeat-pils0-1.2.3-5.2.20060mdk.x86_64.rpm
 56f6f6748b15477595954cf62fb1be4f  x86_64/2006.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
 1b7ec3e3232f92f4798f1f27e791f5fa  x86_64/2006.0/RPMS/lib64heartbeat-stonith0-1.2.3-5.2.20060mdk.x86_64.rpm
 b4eba13e67ddb63f4e945fd3623b70dc  x86_64/2006.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
 ec184261c2b75735f245058cc102875b  x86_64/2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm

 Corporate 3.0:
 cedaede52beb3d048afe667f26c38fde  corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.i586.rpm
 bc8a44f9c3bbc42ae092da7f738af2c4  corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.i586.rpm
 a0f4b51b272f037c17fba097784d7177  corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.i586.rpm
 cf113ac1f2847706f3a69c7b809f62ea  corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.i586.rpm
 93fd800765604254140a6f067d482c8b  corporate/3.0/RPMS/libheartbeat0-1.2.3-2.3.C30mdk.i586.rpm
 2dbb453665fcb6386734f5b9150b92e8  corporate/3.0/RPMS/libheartbeat0-devel-1.2.3-2.3.C30mdk.i586.rpm
 718bf907afe2cee9677395082905cd77  corporate/3.0/RPMS/libheartbeat-pils0-1.2.3-2.3.C30mdk.i586.rpm
 44b21aad591fe193b9e7236cbbfce967  corporate/3.0/RPMS/libheartbeat-pils0-devel-1.2.3-2.3.C30mdk.i586.rpm
 3a421e29c6c74fe75d3b5a47a32a1003  corporate/3.0/RPMS/libheartbeat-stonith0-1.2.3-2.3.C30mdk.i586.rpm
 44b30593b986755b6805474251c0b843  corporate/3.0/RPMS/libheartbeat-stonith0-devel-1.2.3-2.3.C30mdk.i586.rpm
 362a30fb09bd24d2507a030d82e3d020  corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 b5c12159643089bfc87aeb4e08719467  x86_64/corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.x86_64.rpm
 dec8e2ef290fb9fbcf0515478aab2a96  x86_64/corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.x86_64.rpm
 4816a2dbc933099da9e6d8969fac9395  x86_64/corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.x86_64.rpm
 a5b482fe798f98eeb1cb702898807560  x86_64/corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.x86_64.rpm
 1fb38b260833c55999be24fbf63a3aac  x86_64/corporate/3.0/RPMS/lib64heartbeat0-1.2.3-2.3.C30mdk.x86_64.rpm
 f3ebccf215e1e96cb35c252db87bcd80  x86_64/corporate/3.0/RPMS/lib64heartbeat0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
 8ff7be0054b3a529facc33004f5f6d0f  x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-1.2.3-2.3.C30mdk.x86_64.rpm
 bc7419d6d959e8088c5c2a39c0adcc4d  x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
 04716c3769327dc854ad8425cfe08233  x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-1.2.3-2.3.C30mdk.x86_64.rpm
 16beaa0ad35f93a1e750d0e7f71a7e3c  x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
 362a30fb09bd24d2507a030d82e3d020  x86_64/corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFE4Md0mqjQ0CJFipgRArKMAJ47bA0Ei+FRD9gfIsaTaBnvMCokmACg09Xp
X7+Aj9VhwpZtOTiRJFwClSU=
=5nFb
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/