[CLA-2003:655] Conectiva Security Announcement - BitchX
Date: Mon, 26 May 2003 14:36:26 -0300
From: Conectiva Updates <[email protected]>
To: [email protected], [email protected],
Subject: [CLA-2003:655] Conectiva Security Announcement - BitchX
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT
- --------------------------------------------------------------------------
PACKAGE : BitchX
SUMMARY : Remote vulnerabilities
DATE : 2003-05-26 14:29:00
ID : CLA-2003:655
RELEVANT
RELEASES : 6.0, 7.0, 8, 9
- -------------------------------------------------------------------------
DESCRIPTION
BitchX is a text-mode IRC client.
This update fixes two remote vulnerabilities in Bitchx:
1. Buffer overflows
In a message sent to the bugtraq mailing list, Timo Sirainen pointed
out[1] several possible buffer overflow vulnerabilities in BitchX and
other IRC clients. These vulnerabilities can be exploited by a remote
attacker who is able to control the server to which the client is
connected.
2. Denial of Service on channel mode change
A Denial of Service (DoS) vulnerability has been found[2] in BitchX.
This vulnerability allows a remote attacker to crash BitchX by
changing certains channel modes.
Please note that BitchX is being upgraded to version 1.0c18 in all
supported Conectiva Linux products, thus several new features and
other bug fixes are being added as well.
SOLUTION
All BitchX users should upgrade.
REFERENCES:
1.http://www.securityfocus.com/archive/1/315057
2.http://www.securityfocus.com/archive/1/321093
3.http://distro2.conectiva.com.br/bugzilla/show_bug.cgi?id=8197
UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/BitchX-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/wserv-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/BitchX-1.0c18-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-doc-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-help-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/wserv-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/BitchX-1.0c18-1U70_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-doc-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-help-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/wserv-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/BitchX-1.0c18-17U80_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-doc-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-help-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/wserv-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/BitchX-1.0c18-29203U90_1cl.src.rpm
ADDITIONAL INSTRUCTIONS
The apt tool can be used to perform RPM packages upgrades:
- run: apt-get update
- after that, execute: apt-get upgrade
Detailed instructions reagarding the use of apt and upgrade examples
can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en
- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en
- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en
- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com
- -------------------------------------------------------------------------
subscribe: [email protected]
unsubscribe: [email protected]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE+0lCZ42jd0JmAcZARAghkAKDDZGejR9McoSlFT1TcYyi3aFyBzgCeLPJ/
dDmhLIwxZVeVELmT3iAPrpM=
=UuyW
-----END PGP SIGNATURE-----
