-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : file SUMMARY : Buffer overflow vulnerability DATE : 2003-04-04 18:58:00 ID : CLA-2003:617 RELEVANT RELEASES : 6.0, 7.0, 8 - ------------------------------------------------------------------------- DESCRIPTION The file command is used to identify a particular file according to the type of data contained in it. iDefense has found a buffer overflow vulnerability[1] in the file command. This vulnerability can be triggered by the use of specially crafted files. Since file is a very common utility used by many subsystems (like the printing subsystem), attackers can exploit this vulnerability to remotely or locally compromise system security. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2003-0102 to this issue[2]. SOLUTION All users should upgrade. REFERENCES: 1.http://www.idefense.com/advisory/03.04.03.txt 2.http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0102 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/6.0/RPMS/file-3.41-1U60_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/file-3.41-1U60_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/file-3.41-1U70_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/file-3.41-1U70_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/file-3.41-1U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/file-3.41-1U80_1cl.src.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright 2003 (c) Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribeat_private unsubscribe: conectiva-updates-unsubscribeat_private -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+jgAK42jd0JmAcZARAmHrAKDzCmnX/fFKh1DRFfzhcbm6c+14lQCg3pWz AViR2KqKICEw7rQ1/nqab+k= =toXr -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Fri Apr 04 2003 - 14:02:22 PST