[CLA-2003:643] Conectiva Security Announcement - slocate
Date: Thu, 8 May 2003 12:47:55 -0300
From: Conectiva Updates <[email protected]>
To: [email protected], [email protected],
Subject: [CLA-2003:643] Conectiva Security Announcement - slocate
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : slocate
SUMMARY : Buffer overflow vulnerability
DATE : 2003-05-08 12:45:00
ID : CLA-2003:643
RELEVANT
RELEASES : 6.0, 7.0, 8
- -------------------------------------------------------------------------
DESCRIPTION
"slocate"[1] is a program which catalogues existing files and allows
for a quick lookup later.
It has been reported[2] that slocate contains a buffer overflow
vulnerability which could be used by a local attacker to obtain the
privileges of the slocate user.
With these privileges, the attacker could read and alter the slocate
database, insert false data or find out paths to files which he/she
would otherwise not know due to filesystem restrictions.
The author released version 2.7 which is not vulnerable to this
issue.
SOLUTION
It is recommended that all slocate users upgrade their packages.
REFERENCES
1. http://www.geekreview.org/slocate/
2. http://marc.theaimsgroup.com/?l=bugtraq&m=104342864418213&w=2
3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2003-0056
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/slocate-2.7-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/slocate-2.7-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/slocate-2.7-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/slocate-2.7-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/slocate-2.7-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/slocate-2.7-1U80_1cl.i386.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE+unwp42jd0JmAcZARAnWNAJ0ZBU4N/ChhGmu+YAIAkPSzh9hSOQCdGRcv
XWl8t7GbakmA1MNsQuuad6A=
=IxEr
-----END PGP SIGNATURE-----
