To: [email protected]Subject: [ MDKSA-2007:004 ] - Updated geoip packages fix geoipupdate vulnerability
Date: Mon, 08 Jan 2007 18:00:44 -0700
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1H45M4-0006wz-3L@artemis.annvix.ca.>
Sender: QA Team <qateam@artemis.annvix.ca.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:004
http://www.mandriva.com/security/
_______________________________________________________________________
Package : geoip
Date : January 8, 2007
Affected: Corporate 4.0
_______________________________________________________________________
Problem Description:
Dean Gaudet discovered the geoipupdate utility fails to do sanity
checking on the filename returned by "GET
/app/update_getfilename?product_id=%s".
Updated packages are patched to address this issue.
_______________________________________________________________________
References:
http://arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patch
_______________________________________________________________________
Updated Packages:
Corporate 4.0:
fa1f121647c2537c612bd06cb696bf45 corporate/4.0/i586/geoip-1.4.0-2.1.20060mlcs4.i586.rpm
b7121479dd6061d651e1596d6d088742 corporate/4.0/i586/libgeoip1-1.4.0-2.1.20060mlcs4.i586.rpm
4672680cd19c237b0972c31428b5643d corporate/4.0/i586/libgeoip1-devel-1.4.0-2.1.20060mlcs4.i586.rpm
e5df2bdfcdcf1da47ff30756fe6515cb corporate/4.0/i586/libgeoipupdate0-1.4.0-2.1.20060mlcs4.i586.rpm
2ebfd111dd8511dc3cec4ade7ce39f73 corporate/4.0/SRPMS/geoip-1.4.0-2.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
fee7fd2c73be1c3a8b86c83e9b614192 corporate/4.0/x86_64/geoip-1.4.0-2.1.20060mlcs4.x86_64.rpm
0232c0ff1b9463ccddb155de4095fd47 corporate/4.0/x86_64/lib64geoip1-1.4.0-2.1.20060mlcs4.x86_64.rpm
a29ebe06132643a78ae9948fff1eb0bd corporate/4.0/x86_64/lib64geoip1-devel-1.4.0-2.1.20060mlcs4.x86_64.rpm
97ef3b059e9771b7c0783c66f0106f29 corporate/4.0/x86_64/lib64geoipupdate0-1.4.0-2.1.20060mlcs4.x86_64.rpm
2ebfd111dd8511dc3cec4ade7ce39f73 corporate/4.0/SRPMS/geoip-1.4.0-2.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFor7NmqjQ0CJFipgRApAZAKCLDkSuruaD63NgUa0pea3XDipthACgrAzC
CXwcpZmSUfcLoJTYUBffvkA=
=knVQ
-----END PGP SIGNATURE-----
