-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 +------------------------------------------------------------------------+ | EnGarde Secure Linux Security Advisory October 16, 2002 | | http://www.engardelinux.org/ ESA-20021016-025 | | | | Package: syslog-ng | | Summary: buffer overflow in macro handling code. | +------------------------------------------------------------------------+ EnGarde Secure Linux is a secure distribution of Linux that features improved access control, host and network intrusion detection, Web based secure remote management, complete e-commerce using AllCommerce, and integrated open source security tools. OVERVIEW - -------- There is a buffer overflow vulnerability in the syslog-ng's macro handling code. For more information on this vulnerability, please refer to the following advisory: http://www.balabit.hu/static/zsa/ZSA-2002-014-en.txt PLEASE NOTE: Due to a packaging error in our 1.0.1 and 1.1 packages, the following log files will be truncated upon installing this update: /var/log/messages /var/log/mail.log /var/log/boot.log /var/log/login.log /var/log/auth.log It is therefore highly recommended to save a backup copy of these logs before you upgrade: # mkdir /var/log/.bak # cp -af /var/log/{messages,mail.log,boot.log,login.log,auth.log} \ /var/log/.bak # <install the update as outlined below> # mv -f /var/log/.bak/{messages,mail.log,boot.log,login.log,auth.log} \ /var/log # rmdir /var/log/.bak Only users of EnGarde Secure Community Edition and EnGarde Secure Professional 1.1 need to apply this workaround. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-1200 to this issue. SOLUTION - -------- Users of the EnGarde Professional edition can use the Guardian Digital Secure Network to update their systems automatically. EnGarde Community users should upgrade to the most recent version as outlined in this advisory. Updates may be obtained from: ftp://ftp.engardelinux.org/pub/engarde/stable/updates/ http://ftp.engardelinux.org/pub/engarde/stable/updates/ Before upgrading the package, the machine must either: a) be booted into a "standard" kernel; or b) have LIDS disabled. To disable LIDS, execute the command: # /sbin/lidsadm -S -- -LIDS_GLOBAL To install the updated package, execute the command: # rpm -Uvh files You must now update the LIDS configuration by executing the command: # /usr/sbin/config_lids.pl To re-enable LIDS (if it was disabled), execute the command: # /sbin/lidsadm -S -- +LIDS_GLOBAL To verify the signatures of the updated packages, execute the command: # rpm -Kv files UPDATED PACKAGES - ---------------- These updated packages are for EnGarde Secure Linux Community Edition. Source Packages: SRPMS/syslog-ng-1.4.10-1.0.25.src.rpm MD5 Sum: 9867255a2d25858872d1c9de05028a8e Binary Packages: i386/syslog-ng-1.4.10-1.0.25.i386.rpm MD5 Sum: ae0c785a072f4545f6c0abfee9760090 i686/syslog-ng-1.4.10-1.0.25.i686.rpm MD5 Sum: 4ec459e0b58e99ba043a29c977d18293 REFERENCES - ---------- Guardian Digital's public key: http://ftp.engardelinux.org/pub/engarde/ENGARDE-GPG-KEY syslog-ng's Official Web Site: http://www.balabit.hu/en/downloads/syslog-ng/ Security Contact: securityat_private EnGarde Advisories: http://www.engardelinux.org/advisories.html - -------------------------------------------------------------------------- $Id: ESA-20021016-025-syslog-ng,v 1.4 2002/10/17 12:27:32 rwm Exp $ - -------------------------------------------------------------------------- Author: Ryan W. Maple <ryanat_private> Copyright 2002, Guardian Digital, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9rrCiHD5cqd57fu0RAkh3AJ4+MjF2o21h5pJJKllGh9KjUAfljwCfbAji zkjPqWYw9+iG+JPWLdlCZN8= =vTV9 -----END PGP SIGNATURE----- ------------------------------------------------------------------------ To unsubscribe email engarde-security-requestat_private with "unsubscribe" in the subject of the message. Copyright(c) 2001 Guardian Digital, Inc. EnGardeLinux.org ------------------------------------------------------------------------ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
This archive was generated by hypermail 2b30 : Thu Oct 17 2002 - 06:12:25 PDT