OpenPKG CVS Repository
http://cvs.openpkg.org/
____________________________________________________________________________
Server: cvs.openpkg.org Name: Ralf S. Engelschall
Root: /e/openpkg/cvs Email: [EMAIL PROTECTED]
Module: openpkg-web Date: 18-Mar-2003 16:44:46
Branch: HEAD Handle: 2003031815444500
Modified files:
openpkg-web/security OpenPKG-SA-2003.021-samba.txt page.pl
Log:
final polishing and signing to the Samba SA
Summary:
Revision Changes Path
1.2 +21 -11 openpkg-web/security/OpenPKG-SA-2003.021-samba.txt
1.6 +1 -1 openpkg-web/security/page.pl
____________________________________________________________________________
patch -p0 <<'@@ .'
Index: openpkg-web/security/OpenPKG-SA-2003.021-samba.txt
============================================================================
$ cvs diff -u -r1.1 -r1.2 OpenPKG-SA-2003.021-samba.txt
--- openpkg-web/security/OpenPKG-SA-2003.021-samba.txt 17 Mar 2003 19:32:25
-0000 1.1
+++ openpkg-web/security/OpenPKG-SA-2003.021-samba.txt 18 Mar 2003 15:44:45
-0000 1.2
@@ -1,3 +1,6 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
@@ -15,23 +18,23 @@
OpenPKG 1.2 <= samba-2.2.7a-1.2.0 >= samba-2.2.7a-1.2.1
OpenPKG 1.1 <= samba-2.2.5-1.1.1 >= samba-2.2.5-1.1.2
-Affected Releases: Dependent Packages: none
+Dependent Packages: none
Description:
Sebastian Krahmer, SuSE Security Team, [0] has alerted the Samba Team
- to two serious vulnerabilities in all versions of Samba up to and
- including Samba [1] 2.2.7a. We have backported the security relevant
+ to two serious vulnerabilities in all versions of Samba [1] up to and
+ including version 2.2.7a. We have backported the security relevant
pieces of the 2.2.8 vendor changes into releases used by OpenPKG.
If exploited correctly, it could lead to an anonymous user gaining
- root access on a Samba serving system. All versions of Samba up to and
- including Samba 2.2.7a are vulnerable. The Common Vulnerabilities and
- Exposures (CVE) project assigned the id CAN-2003-0085 [2] to the
+ root access on a Samba serving system. All versions of Samba up to
+ and including Samba 2.2.7a are vulnerable. The Common Vulnerabilities
+ and Exposures (CVE) project assigned the id CAN-2003-0085 [2] to the
problem.
- In addition he pointed out a chown race condition which could allow
- overwriting of critical system files if exploited. The Common
- Vulnerabilities and Exposures (CVE) project assigned the id
+ In addition he pointed out a chown(2) race condition which could
+ allow overwriting of critical system files if exploited. The
+ Common Vulnerabilities and Exposures (CVE) project assigned the id
CAN-2003-0086 [3] to the problem.
Please check whether you are affected by running "<prefix>/bin/rpm -q
@@ -42,8 +45,8 @@
Solution:
Select the updated source RPM appropriate for your OpenPKG release
[6][7], fetch it from the OpenPKG FTP service [8][9] or a mirror
- location, verify its integrity [10], build a corresponding binary RPM
- from it [4] and update your OpenPKG installation by applying the
+ location, verify its integrity [10], build a corresponding binary
+ RPM from it [4] and update your OpenPKG installation by applying the
binary RPM [5]. For the current release OpenPKG 1.2, perform the
following operations to permanently fix the security problem (for
other releases adjust accordingly).
@@ -82,3 +85,10 @@
the command "gpg --verify --keyserver keyserver.pgp.com".
________________________________________________________________________
+-----BEGIN PGP SIGNATURE-----
+Comment: OpenPKG <[EMAIL PROTECTED]>
+
+iD8DBQE+dz6GgHWT4GPEy58RAsiNAKC+2Z6xASbe/P3fsqe6MZsCQHlSOQCg4Ds7
+AQDR5amxuodObmeEmincdpM=
+=hgQX
+-----END PGP SIGNATURE-----
@@ .
patch -p0 <<'@@ .'
Index: openpkg-web/security/page.pl
============================================================================
$ cvs diff -u -r1.5 -r1.6 page.pl
--- openpkg-web/security/page.pl 18 Mar 2003 15:26:15 -0000 1.5
+++ openpkg-web/security/page.pl 18 Mar 2003 15:44:45 -0000 1.6
@@ -12,7 +12,7 @@
foreach my $sa (reverse sort @SA) {
my ($base, $name) = ($sa =~ m|^(OpenPKG-SA-(.+))\.txt$|);
next if ($name =~ m|^0000|);
- next if ($name =~ m|^2003\.02[1-9]|);
+ next if ($name =~ m|^2003\.02[2-9]|);
$sidebar .= "<a href=\"$base.html\">$name</a><br>";
}
@@ .
______________________________________________________________________
The OpenPKG Project www.openpkg.org
CVS Repository Commit List [EMAIL PROTECTED]
