6646561 2001-06-19 16:40 -0400 /159 rader/ <bugzilla@redhat.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-06-20 02:15 av Brevbäraren
Extern mottagare: redhat-watch-list@redhat.com
Extern kopiemottagare: bugtraq@securityfocus.com
Extern kopiemottagare: linux-security@redhat.com
Extern kopiemottagare: security@redhat.com
Mottagare: Bugtraq (import) <17523>
Ärende: [RHSA-2001:078-05] Format string bug fixed
------------------------------------------------------------
From: bugzilla@redhat.com
To: redhat-watch-list@redhat.com
Cc: bugtraq@securityfocus.com, linux-security@redhat.com,
security@redhat.com
Message-ID: <200106192040.f5JKeRr28198@porkchop.redhat.com>
---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Format string bug fixed
Advisory ID: RHSA-2001:078-05
Issue date: 2001-06-11
Updated on: 2001-06-19
Product: Red Hat Powertools
Keywords: format string local
Cross references:
Obsoletes:
---------------------------------------------------------------------
1. Topic:
A locally exploitable format string bug has been fixed in the code
that handles batch SMTP.
2. Relevant releases/architectures:
Red Hat Powertools 6.2 - alpha, i386, sparc
Red Hat Powertools 7.0 - alpha, i386
Red Hat Powertools 7.1 - i386
3. Problem description:
A format string vulnerability exists in the batch SMTP processing
code, which is triggered by any SMTP response that includes a part of
its SMTP command.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only
those RPMs which are currently installed will be updated. Those RPMs
which are not installed but included in the list will not be updated.
Note that you can also use wildcards (*.rpm) if your current
directory *only* contains the desired RPMs.
Please note that this update is also available via Red Hat Network.
Many people find this an easier way to apply updates. To use Red Hat
Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
44077 - local printf format attack in exim-3.22-10
6. RPMs required:
Red Hat Powertools 6.2:
SRPMS:
ftp://updates.redhat.com/6.2/en/powertools/SRPMS/exim-3.22-6x.src.rpm
alpha:
ftp://updates.redhat.com/6.2/en/powertools/alpha/exim-3.22-6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/powertools/alpha/exim-doc-3.22-6x.alpha.rpm
ftp://updates.redhat.com/6.2/en/powertools/alpha/exim-mon-3.22-6x.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/en/powertools/i386/exim-3.22-6x.i386.rpm
ftp://updates.redhat.com/6.2/en/powertools/i386/exim-doc-3.22-6x.i386.rpm
ftp://updates.redhat.com/6.2/en/powertools/i386/exim-mon-3.22-6x.i386.rpm
sparc:
ftp://updates.redhat.com/6.2/en/powertools/sparc/exim-3.22-6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/powertools/sparc/exim-doc-3.22-6x.sparc.rpm
ftp://updates.redhat.com/6.2/en/powertools/sparc/exim-mon-3.22-6x.sparc.rpm
Red Hat Powertools 7.0:
SRPMS:
ftp://updates.redhat.com/7.0/en/powertools/SRPMS/exim-3.22-13.src.rpm
alpha:
ftp://updates.redhat.com/7.0/en/powertools/alpha/exim-3.22-13.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/exim-doc-3.22-13.alpha.rpm
ftp://updates.redhat.com/7.0/en/powertools/alpha/exim-mon-3.22-13.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/en/powertools/i386/exim-3.22-13.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/exim-doc-3.22-13.i386.rpm
ftp://updates.redhat.com/7.0/en/powertools/i386/exim-mon-3.22-13.i386.rpm
Red Hat Powertools 7.1:
SRPMS:
ftp://updates.redhat.com/7.1/en/powertools/SRPMS/exim-3.22-13.src.rpm
i386:
ftp://updates.redhat.com/7.1/en/powertools/i386/exim-3.22-13.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/exim-doc-3.22-13.i386.rpm
ftp://updates.redhat.com/7.1/en/powertools/i386/exim-mon-3.22-13.i386.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
de6f8066f402528b3486f36466c2f3c6 6.2/en/powertools/SRPMS/exim-3.22-6x.src.rpm
734fec83e0327062ac9839d280ba165b 6.2/en/powertools/alpha/exim-3.22-6x.alpha.rpm
c0822fe30ddcab6db750cdbd791cd517 6.2/en/powertools/alpha/exim-doc-3.22-6x.alpha.rpm
0e3390552720fb9b29a36e6f7e622bdc 6.2/en/powertools/alpha/exim-mon-3.22-6x.alpha.rpm
a3807b48735ec21e41121e1c57021386 6.2/en/powertools/i386/exim-3.22-6x.i386.rpm
42ce37a662a4daf4ab49a08ce06bb76e 6.2/en/powertools/i386/exim-doc-3.22-6x.i386.rpm
da46d4a412579ae49c886b692d0caf25 6.2/en/powertools/i386/exim-mon-3.22-6x.i386.rpm
bae51ada3762f73bd42cf116107f8ab8 6.2/en/powertools/sparc/exim-3.22-6x.sparc.rpm
97707874783a8dbacbe8f042743e49bd 6.2/en/powertools/sparc/exim-doc-3.22-6x.sparc.rpm
ac5826345a04e0ca42dd16d069283fc5 6.2/en/powertools/sparc/exim-mon-3.22-6x.sparc.rpm
6a2a085b75ae664c9f37f2f127807cb9 7.0/en/powertools/SRPMS/exim-3.22-13.src.rpm
79a93a382a242f4eb196fc57729dffa9 7.0/en/powertools/alpha/exim-3.22-13.alpha.rpm
302f4b270f342a3e7a61336cbb8dece2 7.0/en/powertools/alpha/exim-doc-3.22-13.alpha.rpm
4823aeb034ece53668b87a66de2b83e5 7.0/en/powertools/alpha/exim-mon-3.22-13.alpha.rpm
152d34ee7b459b8719ffc117a87a4975 7.0/en/powertools/i386/exim-3.22-13.i386.rpm
c0663a41ca6fd5812d124dc7dd987bc4 7.0/en/powertools/i386/exim-doc-3.22-13.i386.rpm
37de79b3b1e92a0c3d1ac0e302381f45 7.0/en/powertools/i386/exim-mon-3.22-13.i386.rpm
6a2a085b75ae664c9f37f2f127807cb9 7.1/en/powertools/SRPMS/exim-3.22-13.src.rpm
152d34ee7b459b8719ffc117a87a4975 7.1/en/powertools/i386/exim-3.22-13.i386.rpm
c0663a41ca6fd5812d124dc7dd987bc4 7.1/en/powertools/i386/exim-doc-3.22-13.i386.rpm
37de79b3b1e92a0c3d1ac0e302381f45 7.1/en/powertools/i386/exim-mon-3.22-13.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
Copyright(c) 2000, 2001 Red Hat, Inc.
(6646561) / <bugzilla@redhat.com>/--------(Ombruten)
6649983 2001-06-20 14:14 +0100 /86 rader/ Mayers, Philip J <p.mayers@ic.ac.uk>
Sänt av: joel@lysator.liu.se
Importerad: 2001-06-20 17:14 av Brevbäraren
Extern mottagare: 'bugzilla@redhat.com' <bugzilla@redhat.com>
Extern mottagare: redhat-watch-list@redhat.com
Extern kopiemottagare: bugtraq@securityfocus.com
Extern kopiemottagare: linux-security@redhat.com
Extern kopiemottagare: security@redhat.com
Mottagare: Bugtraq (import) <17527>
Ärende: RE: [RHSA-2001:078-05] Format string bug fixed
------------------------------------------------------------
From: "Mayers, Philip J" <p.mayers@ic.ac.uk>
To: "'bugzilla@redhat.com'" <bugzilla@redhat.com>,
redhat-watch-list@redhat.com
Cc: bugtraq@securityfocus.com, linux-security@redhat.com,
security@redhat.com
Message-ID: <A0F836836670D41183A800508BAF190B35E761@icex1.cc.ic.ac.uk>
That's great - but did you even *bother* to check if the update works
on RedHat 7.0?
[root@unix-software i386]# cat /etc/redhat-release
Red Hat Linux release 7.0 (Guinness)
[root@unix-software i386]# rpm -qp --requires exim-3.22-13.i386.rpm
<snip>
libcrypto.so.1
<snip>
libssl.so.1
<snip>
[root@unix-software i386]# rpm -qa --provides | egrep
'libssl|libcrypto' libcrypto.so.0 libssl.so.0 libssl.so
[root@unix-software i386]# rpm -q openssl --provides
libcrypto.so.0
libssl.so.0
openssl = 0.9.5a-14
[root@unix-software i386]# rpm -Uvh exim-3.22-13.i386.rpm
error: failed dependencies:
libcrypto.so.1 is needed by exim-3.22-13
libssl.so.1 is needed by exim-3.22-13
*Wonderful* - you've shipped an update that no-one can apply, unless
they update their OpenSSL package (an update you don't
provide). Doubtless you built the RPM on RedHat 7.1, which has
OpenSSL 0.9.6 and libcrypto.so.1
I like RedHat, but this is the third time you've done something like
this in recent months:
1) Splitting glibc into glibc-common and glibc, which meant that the
glibc update could not automatically be applied 2) Breaking the init
script for the OpenSSH 2.5.2 release, which meant that if anyone
applied the update whilst logged in over SSH, the SSH daemon
restarted - this was because you switched to using the newer
initscripts, which had a function in them that the older ones didn't.
3) Now this, an (old, not even version 3.30) Exim update that won't
apply!
Don't even get me started on the RPM4 update to 6.2, or the LDAP and
crypto libraries (which weren't a core part of the system when you
shipped it, but you made essential later on) - annoyingly enough,
after making such sweeping changes you didn't ship OpenSSH (although
you already had OpenSSL) for 6.2.
You might take a lead from Debian's book, and exercise a little bit
of discipline when making your packages, rather than letting a random
intern ship updates to systems that people are using *in
production*. Can I make a suggestion - when developing patches for an
operating system, try doing it on the right version of the damn OS,
rather than against RawHide, or whatever it is you do...
Could you please re-issue this update, compiled on the right system
this time?
Regards,
Phil
+----------------------------------+
| Phil Mayers, Network Support |
| Centre for Computing Services |
| Imperial College |
+----------------------------------+
-----Original Message-----
From: bugzilla@redhat.com [mailto:bugzilla@redhat.com]
Sent: 19 June 2001 21:40
To: redhat-watch-list@redhat.com
Cc: bugtraq@securityfocus.com; linux-security@redhat.com;
security@redhat.com
Subject: [RHSA-2001:078-05] Format string bug fixed
<snip broken update report>
(6649983) /Mayers, Philip J <p.mayers@ic.ac.uk>/(Ombruten)