OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /e/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-web Date: 08-Jan-2004 16:39:13
Branch: HEAD Handle: 2004010815391300
Modified files:
openpkg-web/security OpenPKG-SA-2004.001-inn.txt
Log:
release OpenPKG Security Advisory 2004.001 (inn)
Summary:
Revision Changes Path
1.2 +26 -17 openpkg-web/security/OpenPKG-SA-2004.001-inn.txt
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-web/security/OpenPKG-SA-2004.001-inn.txt
============================================================================
$ cvs diff -u -r1.1 -r1.2 OpenPKG-SA-2004.001-inn.txt
--- openpkg-web/security/OpenPKG-SA-2004.001-inn.txt 8 Jan 2004 08:03:58 -0000
1.1
+++ openpkg-web/security/OpenPKG-SA-2004.001-inn.txt 8 Jan 2004 15:39:13 -0000
1.2
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
@@ -7,7 +10,7 @@
________________________________________________________________________
Package: inn
-Vulnerability: remotely exploitable access to inn user
+Vulnerability: remote code execution
OpenPKG Specific: no
Affected Releases: Affected Packages: Corrected Packages:
@@ -16,11 +19,12 @@
OpenPKG 1.2 none N.A.
Description:
- According to a posting from Russ Allbery on the inn announce mailing
- list, Dan Riley discovered a buffer overflow in a portion of the
- control message handling code introduced in INN 2.4.0. It is fairly
- likely that this overflow could be remotely exploited to gain access
- to the user innd runs as. INN 2.3.x and earlier are not affected.
+ According to INN [0] announcement postings from Russ Allbery [1][2],
+ Dan Riley discovered a buffer overflow in a portion of the control
+ message handling code, first introduced in INN 2.4.0. It is fairly
+ likely that this overflow is remotely exploitable to gain access and
+ execute code under the user innd(8) runs as. INN 2.3.x and earlier
+ versions are not affected.
Please check whether you are affected by running "<prefix>/bin/rpm
-q inn". If you have the "inn" package installed and its version
@@ -29,12 +33,12 @@
Solution:
Select the updated source RPM appropriate for your OpenPKG release
- [5][5], fetch it from the OpenPKG FTP service [7][6] or a mirror
- location, verify its integrity [7], build a corresponding binary RPM
- from it [3] and update your OpenPKG installation by applying the binary
- RPM [4]. For the current release OpenPKG 1.3, perform the following
- operations to permanently fix the security problem (for other releases
- adjust accordingly).
+ [5], fetch it from the OpenPKG FTP service [6] or a mirror location,
+ verify its integrity [7], build a corresponding binary RPM from it [3]
+ and update your OpenPKG installation by applying the binary RPM [4].
+ For the current release OpenPKG 1.3, perform the following operations
+ to permanently fix the security problem (for other releases adjust
+ accordingly).
$ ftp ftp.openpkg.org
ftp> bin
@@ -45,14 +49,12 @@
$ <prefix>/bin/rpm --rebuild inn-2.4.0-1.3.1.src.rpm
$ su -
# <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/inn-2.4.0-1.3.1.*.rpm
-
- Additionally, we recommend that you rebuild and reinstall
- all dependent packages (see above), if any, too. [3][4]
________________________________________________________________________
References:
- [1] http://www.isc.org/products/INN/
- [2] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-...
+ [0] http://www.isc.org/products/INN/
+ [1] http://lists.litech.org/pipermail/inn-workers/2004q1/002762.html
+ [2] http://lists.litech.org/pipermail/inn-workers/2004q1/002763.html
[3] http://www.openpkg.org/tutorial.html#regular-source
[4] http://www.openpkg.org/tutorial.html#regular-binary
[5] ftp://ftp.openpkg.org/release/1.3/UPD/inn-2.4.0-1.3.1.src.rpm
@@ -67,3 +69,10 @@
for details on how to verify the integrity of this advisory.
________________________________________________________________________
+-----BEGIN PGP SIGNATURE-----
+Comment: OpenPKG <[EMAIL PROTECTED]>
+
+iD8DBQE//XjOgHWT4GPEy58RAh2tAJ915Qugh7sdKr0LcBY8VtGlcCiWRACg7qQK
+xtoMatcN5fTBUhVveS092Z4=
+=KLDc
+-----END PGP SIGNATURE-----
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [EMAIL PROTECTED]
