August 2006
Mandriva - Two Security Announcements
ID: 00554
Ref: 530/06
Date: 15 August 2006:15:25:31
Version: 1
Title: Mandriva - Two Security Announcements
Abstract: 1. Updated gnupg packages fix vulnerability [MDKSA-2006:141] -- 2. Updated heartbeat packages fix vulnerability [MDKSA-2006:142]
Vendors affected: Mandriva
Operating systems affected: Mandriva
Applications affected: Mandriva
Title
=====
Mandriva - Two Security Announcements:
1. Updated gnupg packages fix vulnerability [MDKSA-2006:141]
2. Updated heartbeat packages fix vulnerability [MDKSA-2006:142]
Detail
======
Security announcement summaries:
1. An integer overflow vulnerability was discovered in gnupg where an
attacker could create a carefully-crafted message packet with a large
length that could cause gnupg to crash or possibly overwrite memory
when opened.
2. Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan
Rong Ge. The first is that heartbeat would set insecure permissions in
an shmget call for shared memory (CVE-2006-3815). The second is a remote
vulnerability that could allow allow the master control process to read
invalid memory due (CVE-2006-3121).
Security announcement content:
1.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:141
http://www.mandriva.com/security/
_______________________________________________________________________
Package : gnupg
Date : August 14, 2006
Affected: 2006.0, Corporate 3.0, Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
An integer overflow vulnerability was discovered in gnupg where an
attacker could create a carefully-crafted message packet with a large
length that could cause gnupg to crash or possibly overwrite memory
when opened.
Updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3746
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
dad4f89b0659db5ce5f0ea5346937f84 2006.0/RPMS/gnupg-1.4.2.2-0.3.20060mdk.i586.rpm
235e259f35fc3e064da19eeafb1928bb 2006.0/RPMS/gnupg2-1.9.16-4.2.20060mdk.i586.rpm
4868f4809119c3eb251c750082eafb0c 2006.0/SRPMS/gnupg-1.4.2.2-0.3.20060mdk.src.rpm
e200d2b1d9fd36bf87a2a115921671e1 2006.0/SRPMS/gnupg2-1.9.16-4.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
72633103b324b4a6304849b9adde6dee x86_64/2006.0/RPMS/gnupg-1.4.2.2-0.3.20060mdk.x86_64.rpm
1080c501a35fb063e45fffca91d1c577 x86_64/2006.0/RPMS/gnupg2-1.9.16-4.2.20060mdk.x86_64.rpm
4868f4809119c3eb251c750082eafb0c x86_64/2006.0/SRPMS/gnupg-1.4.2.2-0.3.20060mdk.src.rpm
e200d2b1d9fd36bf87a2a115921671e1 x86_64/2006.0/SRPMS/gnupg2-1.9.16-4.2.20060mdk.src.rpm
Corporate 3.0:
48a68f90d599061b4605580c6dfb87c5 corporate/3.0/RPMS/gnupg-1.4.2.2-0.3.C30mdk.i586.rpm
4948bb972e446f136d8f0c81045a68d6 corporate/3.0/SRPMS/gnupg-1.4.2.2-0.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
ca85cec5ae88d2a6aa0216aed0f38ffd x86_64/corporate/3.0/RPMS/gnupg-1.4.2.2-0.3.C30mdk.x86_64.rpm
4948bb972e446f136d8f0c81045a68d6 x86_64/corporate/3.0/SRPMS/gnupg-1.4.2.2-0.3.C30mdk.src.rpm
Multi Network Firewall 2.0:
0d17b96d0b992d95a74c9a215088425b mnf/2.0/RPMS/gnupg-1.4.2.2-0.4.M20mdk.i586.rpm
6f752ebe3c8094f11f6bf2d3b7f3cb2e mnf/2.0/SRPMS/gnupg-1.4.2.2-0.4.M20mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFE4MFVmqjQ0CJFipgRAmyEAJ0aTvIeW+OJxKW/q/cWKxThqTy86QCfSs0U
DEbL1baQptTF7BJh164sn/Y=
=GPyb
- -----END PGP SIGNATURE-----
2.
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:142
http://www.mandriva.com/security/
_______________________________________________________________________
Package : heartbeat
Date : August 14, 2006
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan
Rong Ge. The first is that heartbeat would set insecure permissions in
an shmget call for shared memory, allowing a local attacker to cause an
unspecified denial of service via unknown vectors (CVE-2006-3815).
The second is a remote vulnerability that could allow allow the master
control process to read invalid memory due to a specially crafted
heartbeat message and die of a SEGV, all prior to any authentication
(CVE-2006-3121).
Updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3815
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
7797a304e73645cb0dd518936b6a0d59 2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.i586.rpm
9024d2ddeabed550864f4087f5d1203a 2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.i586.rpm
0cc86c13aa345167fc28732ad8d4c488 2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.i586.rpm
32ae04a5e100527f28005cc95d58bab3 2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.i586.rpm
0b0c39c8f6bc55a1742346c2ab74d476 2006.0/RPMS/libheartbeat0-1.2.3-5.2.20060mdk.i586.rpm
a4306e4730d23f7c44cde38148d2fbf0 2006.0/RPMS/libheartbeat0-devel-1.2.3-5.2.20060mdk.i586.rpm
d9ed984f7044b1fd895bf48a17646149 2006.0/RPMS/libheartbeat-pils0-1.2.3-5.2.20060mdk.i586.rpm
893136133c78f81f45c5a46b90bd56f6 2006.0/RPMS/libheartbeat-pils0-devel-1.2.3-5.2.20060mdk.i586.rpm
fc48ae914852b91d25e204df5013ea88 2006.0/RPMS/libheartbeat-stonith0-1.2.3-5.2.20060mdk.i586.rpm
27dba06cd918f4e44e7316f37c0728e1 2006.0/RPMS/libheartbeat-stonith0-devel-1.2.3-5.2.20060mdk.i586.rpm
ec184261c2b75735f245058cc102875b 2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
ceefc3ca6b8bfd9e5342c7e57c9d22de x86_64/2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.x86_64.rpm
056f0fc351514d5daf25e8b7c0dac268 x86_64/2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.x86_64.rpm
511ed82622928343faa187cd4be07b23 x86_64/2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.x86_64.rpm
ccedb1fac9aa393d83b1e261b83ca32e x86_64/2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.x86_64.rpm
bbb2d50dabbf3c782282403e185e3ed3 x86_64/2006.0/RPMS/lib64heartbeat0-1.2.3-5.2.20060mdk.x86_64.rpm
e960d1a0be192e27325e8080ff805d30 x86_64/2006.0/RPMS/lib64heartbeat0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
3806435d23c0d78c01f095349098ab32 x86_64/2006.0/RPMS/lib64heartbeat-pils0-1.2.3-5.2.20060mdk.x86_64.rpm
56f6f6748b15477595954cf62fb1be4f x86_64/2006.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
1b7ec3e3232f92f4798f1f27e791f5fa x86_64/2006.0/RPMS/lib64heartbeat-stonith0-1.2.3-5.2.20060mdk.x86_64.rpm
b4eba13e67ddb63f4e945fd3623b70dc x86_64/2006.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
ec184261c2b75735f245058cc102875b x86_64/2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm
Corporate 3.0:
cedaede52beb3d048afe667f26c38fde corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.i586.rpm
bc8a44f9c3bbc42ae092da7f738af2c4 corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.i586.rpm
a0f4b51b272f037c17fba097784d7177 corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.i586.rpm
cf113ac1f2847706f3a69c7b809f62ea corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.i586.rpm
93fd800765604254140a6f067d482c8b corporate/3.0/RPMS/libheartbeat0-1.2.3-2.3.C30mdk.i586.rpm
2dbb453665fcb6386734f5b9150b92e8 corporate/3.0/RPMS/libheartbeat0-devel-1.2.3-2.3.C30mdk.i586.rpm
718bf907afe2cee9677395082905cd77 corporate/3.0/RPMS/libheartbeat-pils0-1.2.3-2.3.C30mdk.i586.rpm
44b21aad591fe193b9e7236cbbfce967 corporate/3.0/RPMS/libheartbeat-pils0-devel-1.2.3-2.3.C30mdk.i586.rpm
3a421e29c6c74fe75d3b5a47a32a1003 corporate/3.0/RPMS/libheartbeat-stonith0-1.2.3-2.3.C30mdk.i586.rpm
44b30593b986755b6805474251c0b843 corporate/3.0/RPMS/libheartbeat-stonith0-devel-1.2.3-2.3.C30mdk.i586.rpm
362a30fb09bd24d2507a030d82e3d020 corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
b5c12159643089bfc87aeb4e08719467 x86_64/corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.x86_64.rpm
dec8e2ef290fb9fbcf0515478aab2a96 x86_64/corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.x86_64.rpm
4816a2dbc933099da9e6d8969fac9395 x86_64/corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.x86_64.rpm
a5b482fe798f98eeb1cb702898807560 x86_64/corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.x86_64.rpm
1fb38b260833c55999be24fbf63a3aac x86_64/corporate/3.0/RPMS/lib64heartbeat0-1.2.3-2.3.C30mdk.x86_64.rpm
f3ebccf215e1e96cb35c252db87bcd80 x86_64/corporate/3.0/RPMS/lib64heartbeat0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
8ff7be0054b3a529facc33004f5f6d0f x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-1.2.3-2.3.C30mdk.x86_64.rpm
bc7419d6d959e8088c5c2a39c0adcc4d x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
04716c3769327dc854ad8425cfe08233 x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-1.2.3-2.3.C30mdk.x86_64.rpm
16beaa0ad35f93a1e750d0e7f71a7e3c x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
362a30fb09bd24d2507a030d82e3d020 x86_64/corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFE4Md0mqjQ0CJFipgRArKMAJ47bA0Ei+FRD9gfIsaTaBnvMCokmACg09Xp
X7+Aj9VhwpZtOTiRJFwClSU=
=5nFb
- -----END PGP SIGNATURE-----