83557 2002-11-06 20:56 /87 rader/ <secure@conectiva.com.br> Importerad: 2002-11-06 20:56 av Brevbäraren Extern mottagare: conectiva-updates@papaleguas.conectiva.com.br Extern mottagare: lwn@lwn.net Extern mottagare: bugtraq@securityfocus.com Extern mottagare: security-alerts@linuxsecurity.com Mottagare: Bugtraq (import) <2241> Ärende: [CLA-2002:540] Conectiva Linux Security Announcement - heartbeat ------------------------------------------------------------ -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - -------------------------------------------------------------------------- PACKAGE : heartbeat SUMMARY : Remote format string vulnerability DATE : 2002-10-30 12:51:00 ID : CLA-2002:540 RELEVANT RELEASES : 8 - ------------------------------------------------------------------------- DESCRIPTION Heartbeat[1] is a basic high availability system component for linux. Nathan Wallwork reported several format string vulnerabilities[2] in heartbeat that could possibly be used by a remote attacker to execute arbitrary code with root privileges. SOLUTION It is recommended that all heartbeat users upgrade their packages. IMPORTANT: if the service is already running, it is necessary to manually restart it after the upgrade. To do so, please execute the following as root: service heartbeat restart REFERENCES 1. http://linux-ha.org/ 2. http://linux-ha.org/security/sec01.txt DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/8/SRPMS/heartbeat-0.4.9.1-2U80_1cl.src.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/heartbeat-0.4.9.1-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/heartbeat-ldirectord-0.4.9.1-2U80_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/RPMS/heartbeat-stonith-0.4.9.1-2U80_1cl.i386.rpm ADDITIONAL INSTRUCTIONS Users of Conectiva Linux version 6.0 or higher may use apt to perform upgrades of RPM packages: - add the following line to /etc/apt/sources.list if it is not there yet (you may also use linuxconf to do this): rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates (replace 6.0 with the correct version number if you are not running CL6.0) - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en - ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en - ------------------------------------------------------------------------- subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE9v/Ib42jd0JmAcZARAn1IAKDbjYfMEjc7GYOo16i5MGNjqV7ldwCeLYMy frTQCTCq2a3kGEXTJxEzII8= =eQvU -----END PGP SIGNATURE----- (83557) / <secure@conectiva.com.br>/------(Ombruten)