Skip to Content.
Sympa Menu

sm-security - [SM-Security] Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix ls vulnerabilities

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix ls vulnerabilities
  • Date: Wed, 5 Nov 2003 16:38:58 +0000

Do we need to look up these patches for our systems?

-sandalle

----- Forwarded message from Eric Sandall <ispsysop AT yahoo.com> -----
Date: Wed, 5 Nov 2003 08:37:53 -0800 (PST)
From: Eric Sandall <ispsysop AT yahoo.com>
Reply-To: Eric Sandall <ispsysop AT yahoo.com>
Subject: Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix ls
vulnerabilities
To: eric AT sandall.us


--- Red Hat Network Alert <dev-null AT rhn.redhat.com> wrote:
> Date: Tue, 4 Nov 2003 16:49:31 -0500
> Subject: RHN Errata Alert: Updated fileutils/coreutils package fix ls
> vulnerabilities
> From: Red Hat Network Alert <dev-null AT rhn.redhat.com>
> To: ispsysop <ispsysop AT yahoo.com>
>
> Red Hat Network has determined that the following advisory is
> applicable to
> one or more of the systems you have registered:
>
> Complete information about this errata can be found at the following
> location:
>
> https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1865
>
> Security Advisory - RHSA-2003:309-08
>
------------------------------------------------------------------------------
> Summary:
> Updated fileutils/coreutils package fix ls vulnerabilities
>
> Updated fileutils and coreutils packages that close a potential
> denial of
> service vulnerability are now available.
>
> Description:
> The fileutils package contains several basic system utilities. One of
> these utilities is the "ls" program, which is used to list
> information
> about files and directories. In Red Hat Linux 9, the ls program is
> part of
> the coreutils package.
>
> Georgi Guninski discovered a memory starvation denial of service
> vulnerability in the ls program. It is possible to make ls allocate
> a
> huge amount of memory by specifying certain command line arguments.
> This
> vulnerability is remotely exploitable through services like wu-ftpd,
> which
> pass user arguments to ls. The Common Vulnerabilities and Exposures
> project (cve.mitre.org) has assigned the name CAN-2003-0854 to this
> issue.
>
> A non-exploitable integer overflow in ls has also been discovered.
> It is
> possible to make ls crash by specifying certain command line
> arguments.
> This vulnerability is remotely exploitable through services like
> wu-ftpd,
> which pass user arguments to ls. The Common Vulnerabilities and
> Exposures
> project (cve.mitre.org) has assigned the name CAN-2003-0853 to this
> issue.
>
> This erratum contains new fileutils packages for Red Hat Linux
> versions
> 7.1, 7.2, 7.3, and 8.0. It also contains new coreutils packages for
> Red
> Hat Linux 9. These packages contain backported patches correcting
> these
> vulnerabilities.
>
> The Red Hat Linux 7.2 and 7.3 packages also add support for the
> O_DIRECT flag, which controls the use of synchronous I/O on file
> systems
> such as OCFS.
>
------------------------------------------------------------------------------
>
> -------------
> Taking Action
> -------------
> You may address the issues outlined in this advisory in two ways:
>
> - select your server name by clicking on its name from the list
> available at the following location, and then schedule an
> errata update for it:
> https://rhn.redhat.com/network/systemlist/system_list.pxt
>
> - run the Update Agent on each affected server.
>
>
> ---------------------------------
> Changing Notification Preferences
> ---------------------------------
> To enable/disable your Errata Alert preferences globally please log
> in to RHN
> and navigate from "Your RHN" / "Your Account" to the "Preferences"
> tab.
>
> URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt
>
> You can also enable/disable notification on a per system basis by
> selecting an
> individual system from the "Systems List". From the individual system
> view
> click the "Details" tab.
>
>
> ----------------
> Affected Systems
> ----------------
> According to our records, this errata may apply to one or more of the
>
> systems that you've profiled with Red Hat Network. To see precisely
> which
> systems are affected, please go to:
>
> https://rhn.redhat.com/network/errata/systems_affected.pxt?eid=1865
>
>
>
> The Red Hat Network Team
>
> This message is being sent by Red Hat Network Alert to:
> RHN user login: ispsysop
> Email address on file: <ispsysop AT yahoo.com>
>
> If you lost your RHN password, you can use the information above to
> retrieve it by email from the following address:
> https://rhn.redhat.com/forgot_password.pxt
>
> To cancel these notices, go to:
> https://rhn.redhat.com/oo.pxt?uid=1027788&oid=1588450
>
>
>
>


=====
Eric Sandall * Computer Systems Administrator
Institute
for Shock Physics * Department of Physics Washington State
University * P.O. Box 642816
Pullman, WA 99164-2816 * phone: (509) 335-5931
e-mail: ispsysop AT yahoo.com
"Adventure. Excitement. A sysop craves not these things." -Anonymous

"MS Windows is for those who want to use computers for work, Linux is for
those
who want to work on their computers" -Eric S.

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

----- End forwarded message -----


--
PGP Key Fingerprint: FCFF 26A1 BE21 08F4 BB91 FAED 1D7B 7D74 A8EF DD61
http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ o?
K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
------END GEEK CODE BLOCK------

Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us | http://www.sourcemage.org/
http://eric.sandall.us/ | SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/ #196285 | http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.




Archive powered by MHonArc 2.6.24.

Top of Page