October 2005
Fedora - Three Update Advisories
ID: 00957
Ref: 895/05
Date: 28 October 2005:15:21:36
Version: 1
Title: Fedora - Three Update Advisories
Abstract: 1. Fedora Core 4 Update: pam-0.79-9.6 [FEDORA-2005-1031] , 2. Fedora Core 4 Update: gdb-6.3.0.0-1.84 [FEDORA-2005-1033] , 3. Fedora Core 3 Update: gdb-6.1post-1.20040607.43.0.1 [FEDORA-2005-1032]
Vendors affected: Fedora
Operating systems affected: Fedora
Applications affected: Fedora
Title
=====
Fedora - Three Update Advisories:
1. Fedora Core 4 Update: pam-0.79-9.6 [FEDORA-2005-1031]
2. Fedora Core 4 Update: gdb-6.3.0.0-1.84 [FEDORA-2005-1033]
3. Fedora Core 3 Update: gdb-6.1post-1.20040607.43.0.1 [FEDORA-2005-1032]
Detail
======
Update advisory summaries:
1. This update fixes a security bug in unix_chkpwd allowing
brute force attacks against passwords in /etc/shadow by a
regular user when SELinux is enabled.
2. This is an fc4 update for gdb that includes security issues:
CAN-2005-1704 Integer Overflow in gdb
CAN-2005-1705 gdb arbitrary command execution
3. This is an fc3 update for gdb regarding security issues:
CAN-2005-1704 Integer Overflow in gdb
CAN-2005-1705 gdb arbitrary command execution
Update advisory content follows:
1.
- ---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-1031
2005-10-27
- ---------------------------------------------------------------------
Product : Fedora Core 4
Name : pam
Version : 0.79
Release : 9.6
Summary : A security tool which provides authentication for applications.
Description :
PAM (Pluggable Authentication Modules) is a system security tool that
allows system administrators to set authentication policy without
having to recompile programs that handle authentication.
- ---------------------------------------------------------------------
Update Information:
This update fixes a security bug in unix_chkpwd allowing
brute force attacks against passwords in /etc/shadow by a
regular user when SELinux is enabled.
- ---------------------------------------------------------------------
* Wed Oct 26 2005 Tomas Mraz 0.79-9.6
- - fixed CAN-2005-2977 unix_chkpwd should skip user verification only if
run as root (#168181)
- - link pam_loginuid to libaudit
- - remove spurious glib2 dependency
- - support no tty in pam_access (#170467)
- - support new kernel limits and unlimited limit value in pam_limits (#171546)
- ---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
fb348c5be5d8f694cdbd927681150989 SRPMS/pam-0.79-9.6.src.rpm
4a06122544169a7549639fa52be91bcd ppc/pam-0.79-9.6.ppc.rpm
edf3fc81ac4dfddf44f25dd37142b23c ppc/pam-devel-0.79-9.6.ppc.rpm
873dca1bc06450ede87a40b9d0241398 ppc/debug/pam-debuginfo-0.79-9.6.ppc.rpm
054d2fe06507a3c45c7ef8bcf8a595ac ppc/pam-0.79-9.6.ppc64.rpm
c7a3db12973f5182739d6adae0b25555 ppc/pam-devel-0.79-9.6.ppc64.rpm
6774937168a148b9e63e54711c26c790 x86_64/pam-0.79-9.6.x86_64.rpm
649b875ec7894c2fd855abb9a6547ef0 x86_64/pam-devel-0.79-9.6.x86_64.rpm
a70f55b7f8ce114052362e167984fdb0 x86_64/debug/pam-debuginfo-0.79-9.6.x86_64.rpm
6674a4ea75709a1e5c7f905e617db12b x86_64/pam-0.79-9.6.i386.rpm
f535f175a757f0d7b1dc66b1538fcd1c x86_64/pam-devel-0.79-9.6.i386.rpm
6674a4ea75709a1e5c7f905e617db12b i386/pam-0.79-9.6.i386.rpm
f535f175a757f0d7b1dc66b1538fcd1c i386/pam-devel-0.79-9.6.i386.rpm
d4ec56ab2def5974a103495169442c4c i386/debug/pam-debuginfo-0.79-9.6.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
- ---------------------------------------------------------------------
2.
- ---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-1033
2005-10-27
- ---------------------------------------------------------------------
Product : Fedora Core 4
Name : gdb
Version : 6.3.0.0
Release : 1.84
Summary : A GNU source-level debugger for C, C++, Java and other languages.
Description :
GDB, the GNU debugger, allows you to debug programs written in C, C++,
Java, and other languages, by executing them in a controlled fashion
and printing their data.
- ---------------------------------------------------------------------
Update Information:
This is an fc4 update for gdb that includes security issues:
CAN-2005-1704 Integer Overflow in gdb
This problem is that gdb's internal copy of bfd
does not protect against heap-based overflow.
CAN-2005-1705 gdb arbitrary command execution
This problem allows unprotected .gdbinit files
to execute arbitrary commands during gdb startup.
Fixes for both problems are found in:
gdb-6.3.0.0-1.84
This release also contains some additional fixes
from the last update.
- ---------------------------------------------------------------------
* Tue Oct 18 2005 Jeff Johnston 6.3.0.0-1.84
- - Bump up release number.
* Tue Oct 18 2005 Jeff Johnston 6.3.0.0-1.82
- - Modify attach patch to add missing fclose.
- - Bugzilla 166712
* Tue Oct 11 2005 Jeff Johnston 6.3.0.0-1.81
- - Bump up release number.
* Tue Oct 11 2005 Jeff Johnston 6.3.0.0-1.78
- - Support gdb attaching to a stopped process.
* Thu Sep 29 2005 Jeff Johnston 6.3.0.0-1.77
- - Bump up release number.
* Thu Sep 29 2005 Jeff Johnston 6.3.0.0-1.74
- - Fix up DSO read logic when process is attached.
* Mon Sep 26 2005 Jeff Johnston 6.3.0.0-1.73
- - Bump up release number.
* Mon Sep 26 2005 Jeff Johnston 6.3.0.0-1.70
- - Fix frame pointer calculation for ia64 sigtramp frame.
* Thu Sep 22 2005 Jeff Johnston 6.3.0.0-1.69
- - Bump up release number.
* Thu Sep 22 2005 Jeff Johnston 6.3.0.0-1.66
- - Remove extraneous xfree.
* Wed Sep 7 2005 Jeff Johnston 6.3.0.0-1.65
- - Bump up release number.
* Wed Sep 7 2005 Jeff Johnston 6.3.0.0-1.62
- - Readd readnever option
* Wed Jul 27 2005 Jeff Johnston 6.3.0.0-1.61
- - Bump up release number.
* Tue Jul 26 2005 Jeff Johnston 6.3.0.0-1.57
- - Bump up release number.
* Tue Jul 26 2005 Jeff Johnston 6.3.0.0-1.54
- - Add testcase to verify printing of inherited members
- - Bugzilla 146835
* Mon Jul 25 2005 Jeff Johnston 6.3.0.0-1.53
- - Bump up release number.
* Mon Jul 25 2005 Jeff Johnston 6.3.0.0-1.50
- - Fix bug with info frame and cursor address on ia64.
- - Add testcase to verify pseudo-registers calculated for ia64 sigtramp.
- - Bugzilla 160339
* Fri Jul 22 2005 Jeff Johnston 6.3.0.0-1.49
- - Bump up release number.
* Fri Jul 22 2005 Jeff Johnston 6.3.0.0-1.46
- - Fix attaching to 32-bit processes on 64-bit systems.
- - Bugzilla 160254
* Thu Jul 14 2005 Jeff Johnston 6.3.0.0-1.45
- - Bump up release number.
* Thu Jul 14 2005 Jeff Johnston 6.3.0.0-1.42
- - Add work-around to make ia64 gcore work faster.
- - Bugzilla 147436
* Thu Jul 14 2005 Jeff Johnston 6.3.0.0-1.41
- - Bump up release number.
* Mon Jul 11 2005 Jeff Johnston 6.3.0.0-1.38
- - Fix backtracing across sigaltstack for ia64
- - Bugzilla 151741
* Fri Jul 8 2005 Jeff Johnston 6.3.0.0-1.37
- - Bump up release number.
* Fri Jul 8 2005 Jeff Johnston 6.3.0.0-1.35
- - Build pseudo-registers properly for sigtramp frame.
- - Bugzilla 160339
* Fri Jul 8 2005 Jeff Johnston 6.3.0.0-1.34
- - Bump up release number.
* Thu Jul 7 2005 Jeff Johnston 6.3.0.0-1.31
- - Modify security errata to include additional bfd robustness updates
- - Bugzilla 158680
* Fri Jun 10 2005 Jeff Johnston 6.3.0.0-1.30
- - Bump up release number.
* Fri Jun 10 2005 Jeff Johnston 6.3.0.0-1.28
- - Security errata for bfd and .gdbinit file usage
- - Bugzilla 158680
* Wed May 18 2005 Jeff Johnston 6.3.0.0-1.24
- - Bump up release number.
* Wed May 18 2005 Jeff Johnston 6.3.0.0-1.23
- - Bump up release number.
* Wed May 18 2005 Jeff Johnston 6.3.0.0-1.22
- - Specify SA_RESTART for linux-nat.c handlers and use my_waitpid
which handles EINTR.
- ---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/
13dc7a0519af07517322966a31755c14 SRPMS/gdb-6.3.0.0-1.84.src.rpm
105ad05894d1a6473ac22bf923e59f63 ppc/gdb-6.3.0.0-1.84.ppc.rpm
983c714df523fe92774bc77a99660c47 ppc/debug/gdb-debuginfo-6.3.0.0-1.84.ppc.rpm
b46209774e0b189c93bd45565dbd57a2 x86_64/gdb-6.3.0.0-1.84.x86_64.rpm
ea77f6d39f6e994be2f81335f0925de8 x86_64/debug/gdb-debuginfo-6.3.0.0-1.84.x86_64.rpm
5456f46ec1b03267210b9f045612a9b8 i386/gdb-6.3.0.0-1.84.i386.rpm
fc72f8be341eaf9142aa768de9ad06e1 i386/debug/gdb-debuginfo-6.3.0.0-1.84.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
- ---------------------------------------------------------------------
3.
- ---------------------------------------------------------------------
Fedora Update Notification
FEDORA-2005-1032
2005-10-27
- ---------------------------------------------------------------------
Product : Fedora Core 3
Name : gdb
Version : 6.1post
Release : 1.20040607.43.0.1
Summary : A GNU source-level debugger for C, C++ and other languages.
Description :
GDB, the GNU debugger, allows you to debug programs written in C, C++,
and other languages, by executing them in a controlled fashion and
printing their data.
- ---------------------------------------------------------------------
Update Information:
This is an fc3 update for gdb regarding security issues:
CAN-2005-1704 Integer Overflow in gdb
This problem is that gdb's internal copy of bfd
does not protect against heap-based overflow.
CAN-2005-1705 gdb arbitrary command execution
This problem allows unprotected .gdbinit files
to execute arbitrary commands during gdb startup.
Fixes for both problems are found in:
gdb-6.1post-1.20040607.43.0.1
- ---------------------------------------------------------------------
* Tue Oct 4 2005 Jeff Johnston 1.200400607.43.0.1
- - Security errata to handle untrusted .gdbinit and bfd integer overflow.
- - Bugzilla 158683 and bugzilla 158686
- ---------------------------------------------------------------------
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/
b8b1221e0bee3f36f56d97a5a14f967e SRPMS/gdb-6.1post-1.20040607.43.0.1.src.rpm
5888949940a560c9ba95df6e06d844c1 x86_64/gdb-6.1post-1.20040607.43.0.1.x86_64.rpm
503a943143b7d0493f138db9d3884829 x86_64/debug/gdb-debuginfo-6.1post-1.20040607.43.0.1.x86_64.rpm
1c0c3d31110fef65ebde55bc1c77bde1 i386/gdb-6.1post-1.20040607.43.0.1.i386.rpm
36c25e23d587ebf23099e4bf300e8ae2 i386/debug/gdb-debuginfo-6.1post-1.20040607.43.0.1.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the 'up2date' command.
- ---------------------------------------------------------------------