-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : BitchX SUMMARY : Remote vulnerabilities DATE : 2003-05-26 14:29:00 ID : CLA-2003:655 RELEVANT RELEASES : 6.0, 7.0, 8, 9 - ------------------------------------------------------------------------- DESCRIPTION BitchX is a text-mode IRC client. This update fixes two remote vulnerabilities in Bitchx: 1. Buffer overflows In a message sent to the bugtraq mailing list, Timo Sirainen pointed out[1] several possible buffer overflow vulnerabilities in BitchX and other IRC clients. These vulnerabilities can be exploited by a remote attacker who is able to control the server to which the client is connected. 2. Denial of Service on channel mode change A Denial of Service (DoS) vulnerability has been found[2] in BitchX. This vulnerability allows a remote attacker to crash BitchX by changing certains channel modes. Please note that BitchX is being upgraded to version 1.0c18 in all supported Conectiva Linux products, thus several new features and other bug fixes are being added as well. SOLUTION All BitchX users should upgrade. REFERENCES: 1.http://www.securityfocus.com/archive/1/315057 2.http://www.securityfocus.com/archive/1/321093 3.http://distro2.conectiva.com.br/bugzilla/show_bug.cgi?id=8197 UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/6.0/RPMS/BitchX-1.0c18-1U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/wserv-1.0c18-1U60_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/BitchX-1.0c18-1U60_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-1.0c18-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-doc-1.0c18-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-help-1.0c18-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/RPMS/wserv-1.0c18-1U70_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/BitchX-1.0c18-1U70_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-1.0c18-17U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-doc-1.0c18-17U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-help-1.0c18-17U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/wserv-1.0c18-17U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/BitchX-1.0c18-17U80_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-1.0c18-29203U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-doc-1.0c18-29203U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-help-1.0c18-29203U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/wserv-1.0c18-29203U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/BitchX-1.0c18-29203U90_1cl.src.rpm ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades: - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- Copyright (c) 2003 Conectiva Inc. http://www.conectiva.com - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribeat_private unsubscribe: conectiva-updates-unsubscribeat_private -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE+0lCZ42jd0JmAcZARAghkAKDDZGejR9McoSlFT1TcYyi3aFyBzgCeLPJ/ dDmhLIwxZVeVELmT3iAPrpM= =UuyW -----END PGP SIGNATURE-----
This archive was generated by hypermail 2b30 : Tue May 27 2003 - 12:57:03 PDT