Re: [RHEA-2002:024-23] Updated rpm packages available

From: helmut g. katzgraber (dummkopfat_private)
Date: Tue Mar 26 2002 - 14:27:55 PST

Next message: zeno: "Re: Cross-site scripting."

Previous message: Steve Gustin: "CGIscript.net - csSearch.cgi - Remote Code Execution (up to 17,000 sites vulnerable)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

hi all,

below is the header of redhats latest errata update. since i have
7.2 installed, i tried to upgrade the files listed below which
are the ones one has to install to fix the problems listed in the
errata. i have not tested this for any other combination of 
redhat release / architecture.

gnorpm-0.96-12.7x.i386.rpm
kdeadmin-2.2.2-3.i386.rpm
popt-1.6.4-7x.i386.rpm
python-popt-0.8.7-7.x.2.i386.rpm
rpm-4.0.4-7x.i386.rpm
rpm-build-4.0.4-7x.i386.rpm
rpm-devel-4.0.4-7x.i386.rpm
rpm-perl-4.0.4-7x.i386.rpm
rpm-python-4.0.4-7x.i386.rpm
rpm2html-1.7-3.7x.i386.rpm
rpmfind-1.7-4.7x.i386.rpm

here's the problem:

[nacaq /home/dummkopf] rpm -Fvh *.rpm
error: failed dependencies:
        poptmodule.so is needed by up2date-2.7.46-7.x.2

oops. there seems to be a dependency problem. let's check:

[nacaq /home/dummkopf] locate poptmodule.so
/usr/lib/python1.5/site-packages/poptmodule.so

therefore check which package owns this file:

[nacaq /home/dummkopf] rpm -qf /usr/lib/python1.5/site-packages/poptmodule.so
rpm-python-4.0.3-1.03

check what the upgraded rpm rpm-python contains:

[nacaq /home/dummkopf] rpm -qlp rpm-python-4.0.4-7x.i386.rpm | more
/usr/lib/python1.5/site-packages/rpmmodule.so

looks like redhat renamed something here and did not upgrade the 
dependencies. i guess they will have to reissue this advisory 
with a fix or a clear installation instruction for the 
handicapped, like me...

cheers, h.

[in the meantime i send a note to redhat, along with the 
original post of this message to bugtraq, but there has not been 
any reaction. while this is not a urgent security issue per se, 
being not able to upgrade rpms could be a potential security 
issue in the future.]

cc: bugtraq

_______________________________________________________________
Dr. Helmut G. Katzgraber           dummkopfat_private
Department of Physics              http://nacaq.ucdavis.edu/
University of California, Davis    Phone:     (+1) 530-752-9855
One Shields Ave, Davis, CA 95616   Fax:       (+1) 530-752-4717


bugzillaat_private (2002-03-20 12:38 -0500) wrote:

# ---------------------------------------------------------------------
#                    Red Hat, Inc. Red Hat Enhancement Advisory
# 
# Synopsis:          Updated rpm packages available
# Advisory ID:       RHEA-2002:024-23
# Issue date:        2002-02-08
# Updated on:        2002-03-20
# Product:           Red Hat Linux
# Keywords:          
# Cross references:  
# Obsoletes:         
# ---------------------------------------------------------------------

Next message: zeno: "Re: Cross-site scripting."
Previous message: Steve Gustin: "CGIscript.net - csSearch.cgi - Remote Code Execution (up to 17,000 sites vulnerable)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Mar 26 2002 - 14:51:26 PST