Security bugs are reported here via bugzilla

[Eric Sandall <eric AT sandall.us>]

Do we need to look up these patches for our systems?

-sandalle

----- Forwarded message from Eric Sandall <ispsysop AT yahoo.com> -----
    Date: Wed, 5 Nov 2003 08:37:53 -0800 (PST)
    From: Eric Sandall <ispsysop AT yahoo.com>
Reply-To: Eric Sandall <ispsysop AT yahoo.com>
 Subject: Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix ls
vulnerabilities
      To: eric AT sandall.us


--- Red Hat Network Alert <dev-null AT rhn.redhat.com> wrote:
> Date: Tue, 4 Nov 2003 16:49:31 -0500
> Subject: RHN Errata Alert: Updated fileutils/coreutils package fix ls
> vulnerabilities
> From: Red Hat Network Alert <dev-null AT rhn.redhat.com>
> To: ispsysop <ispsysop AT yahoo.com>
> 
> Red Hat Network has determined that the following advisory is
> applicable to
> one or more of the systems you have registered:
> 
> Complete information about this errata can be found at the following
> location:
>     
> https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1865
> 
> Security Advisory - RHSA-2003:309-08
>
------------------------------------------------------------------------------
> Summary:
> Updated fileutils/coreutils package fix ls vulnerabilities
> 
> Updated fileutils and coreutils packages that close a potential
> denial of
> service vulnerability are now available.
> 
> Description:
> The fileutils package contains several basic system utilities. One of
> these utilities is the "ls" program, which is used to list
> information
> about files and directories. In Red Hat Linux 9, the ls program is
> part of
> the coreutils package.
> 
> Georgi Guninski discovered a memory starvation denial of service
> vulnerability in the ls program.  It is possible to make ls allocate
> a
> huge amount of memory by specifying certain command line arguments. 
> This
> vulnerability is remotely exploitable through services like wu-ftpd,
> which
> pass user arguments to ls.  The Common Vulnerabilities and Exposures
> project (cve.mitre.org) has assigned the name CAN-2003-0854 to this
> issue.
> 
> A non-exploitable integer overflow in ls has also been discovered. 
> It is
> possible to make ls crash by specifying certain command line
> arguments. 
> This vulnerability is remotely exploitable through services like
> wu-ftpd,
> which pass user arguments to ls.  The Common Vulnerabilities and
> Exposures
> project (cve.mitre.org) has assigned the name CAN-2003-0853 to this
> issue.
> 
> This erratum contains new fileutils packages for Red Hat Linux
> versions
> 7.1, 7.2, 7.3, and 8.0.  It also contains new coreutils packages for
> Red
> Hat Linux 9.  These packages contain backported patches correcting
> these
> vulnerabilities.
> 
> The Red Hat Linux 7.2 and 7.3 packages also add support for the
> O_DIRECT flag, which controls the use of synchronous I/O on file
> systems
> such as OCFS.
>
------------------------------------------------------------------------------
> 
> -------------
> Taking Action
> -------------
> You may address the issues outlined in this advisory in two ways:
> 
>      - select your server name by clicking on its name from the list
>        available at the following location, and then schedule an
>        errata update for it:
>            https://rhn.redhat.com/network/systemlist/system_list.pxt
> 
>      - run the Update Agent on each affected server.
> 
> 
> ---------------------------------
> Changing Notification Preferences
> ---------------------------------
> To enable/disable your Errata Alert preferences globally please log
> in to RHN
> and navigate from "Your RHN" / "Your Account" to the "Preferences"
> tab.
> 
>         URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt
> 
> You can also enable/disable notification on a per system basis by
> selecting an
> individual system from the "Systems List". From the individual system
> view
> click the "Details" tab.
> 
> 
> ----------------
> Affected Systems
> ----------------
> According to our records, this errata may apply to one or more of the
> 
> systems that you've profiled with Red Hat Network.  To see precisely
> which 
> systems are affected, please go to:
>    
> https://rhn.redhat.com/network/errata/systems_affected.pxt?eid=1865
> 
> 
> 
> The Red Hat Network Team
> 
> This message is being sent by Red Hat Network Alert to:
>     RHN user login:        ispsysop
>     Email address on file: <ispsysop AT yahoo.com>
> 
> If you lost your RHN password, you can use the information above to
> retrieve it by email from the following address:
>     https://rhn.redhat.com/forgot_password.pxt
> 
> To cancel these notices, go to:
>     https://rhn.redhat.com/oo.pxt?uid=1027788&oid=1588450
>     
> 
> 
> 


=====
Eric Sandall                  * Computer Systems Administrator         
Institute
for Shock Physics   * Department of Physics                  Washington State
University   * P.O. Box 642816      
Pullman, WA 99164-2816        * phone: (509) 335-5931
e-mail: ispsysop AT yahoo.com
"Adventure. Excitement. A sysop craves not these things." -Anonymous

"MS Windows is for those who want to use computers for work, Linux is for 
those
who want to work on their computers" -Eric S.

__________________________________
Do you Yahoo!?
Protect your identity with Yahoo! Mail AddressGuard
http://antispam.yahoo.com/whatsnewfree

----- End forwarded message -----


-- 
PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61

-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ o?
K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
------END GEEK CODE BLOCK------

Eric Sandall                     |  Source Mage GNU/Linux Developer
eric AT sandall.us                  |  http://www.sourcemage.org/
http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.