Re: [hylafax-users] MDKSA-2003:105 - Updated hylafax packages fix remote root vulnerability

[Lee Howard <faxguy@xxxxxxxxxxxxxxxx>]

Mandrake (and other distributions) tend to hold on to releases for a 
long time rather than continually staying current, and so they just 
apply security patches to the old releases as needed until it becomes 
trivial or necessary to upgrade.  So, that's probably why Mandrake is 
still distributing 4.1.3.

The bug does affect 4.1.7 and that's why 4.1.8 was just released today 
(website doesn't yet show it, but the ftp site does).

Lee.


On 2003.11.11 12:18 martin wrote:
> This vulnerability was announced today, but seems to only refer to 
> HylaFAX 4.1.3.
>
> Is that because that is latest version that Mandrake cares about, or 
> because it has been fixed in more recent versions of HylaFAX?
>
> In particular, does this bug affect HylaFAX4.1.7?
>
> Thanks in advance.
>
> Regards.
>
> Martin
>
>
>
> _______________________________________________________________________
>
>                Mandrake Linux Security Update Advisory
> _______________________________________________________________________
>
> Package name:           hylafax
> Advisory ID:            MDKSA-2003:105
> Date:                   November 11th, 2003
>
> Affected versions:	 9.0, 9.1, 9.2, Corporate Server 2.1
> ______________________________________________________________________
>
> Problem Description:
>
> During a code review of the hfaxd server, part of the hylafax
> package, the SuSE Security Team discovered a format bug condition
> that allows remote attackers to execute arbitrary code as the root
> user.  Updated packages have been patched to correct the problem.
> _______________________________________________________________________
>
> References:
>
>  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0886
> ______________________________________________________________________
>
> Updated Packages:
>  Corporate Server 2.1:
> 5276f1258c15247e1349b25b74e04bce  
> corporate/2.1/RPMS/hylafax-4.1.3-5.1.C21mdk.i586.rpm
> df41ac36f154bc7b5b4c999bb1d77cfd  
> corporate/2.1/RPMS/hylafax-client-4.1.3-5.1.C21mdk.i586.rpm
> 27d38e72f4f9c0536078e9739d8aa525  
> corporate/2.1/RPMS/hylafax-server-4.1.3-5.1.C21mdk.i586.rpm
> b5a196bafef616b480aee94ced1cfeca  
> corporate/2.1/RPMS/libhylafax4.1.1-4.1.3-5.1.C21mdk.i586.rpm
> e735316dd89d83679273583117eafefc  
> corporate/2.1/RPMS/libhylafax4.1.1-devel-4.1.3-5.1.C21mdk.i586.rpm
> a417945a8f4c88d216060e53484e1342  
> corporate/2.1/SRPMS/hylafax-4.1.3-5.1.C21mdk.src.rpm
>
> Corporate Server 2.1/x86_64:
> 8e2d216e6e706570416d7713a8a5d5b9  
> x86_64/corporate/2.1/RPMS/hylafax-4.1.3-5.1.C21mdk.x86_64.rpm
> 9a4733e46d35cc1889c0ed5f7db5d0d5  
> x86_64/corporate/2.1/RPMS/hylafax-client-4.1.3-5.1.C21mdk.x86_64.rpm
> da70df4e2cf2c95edc7a926cf62c5934  
> x86_64/corporate/2.1/RPMS/hylafax-server-4.1.3-5.1.C21mdk.x86_64.rpm
> 7c63ef78fab0c214134a899bb6b01165  
> x86_64/corporate/2.1/RPMS/libhylafax4.1.1-4.1.3-5.1.C21mdk.x86_64.rpm
> ea47f2c922153e969177569c81a88fe3  
> x86_64/corporate/2.1/RPMS/libhylafax4.1.1-devel-4.1.3-5.1.C21mdk.x86_64.rpm
> a417945a8f4c88d216060e53484e1342  
> x86_64/corporate/2.1/SRPMS/hylafax-4.1.3-5.1.C21mdk.src.rpm
>
> Mandrake Linux 9.0:
> 6d801bc4ac6bd340b182108a922968ad  
> 9.0/RPMS/hylafax-4.1.3-5.1.90mdk.i586.rpm
> 9ccbba7f9fe20e0e3c6151229cca6199  
> 9.0/RPMS/hylafax-client-4.1.3-5.1.90mdk.i586.rpm
> 60fb31c8a0275475e09be002dfd86285  
> 9.0/RPMS/hylafax-server-4.1.3-5.1.90mdk.i586.rpm
> 2a3608cf7a7743d6164c575b9dadb8b8  
> 9.0/RPMS/libhylafax4.1.1-4.1.3-5.1.90mdk.i586.rpm
> d7dc0df22dc192903e190c27c094e81d  
> 9.0/RPMS/libhylafax4.1.1-devel-4.1.3-5.1.90mdk.i586.rpm
> f1b9526f6a51738dc4fa2d6927dc6c8f  
> 9.0/SRPMS/hylafax-4.1.3-5.1.90mdk.src.rpm
>
> Mandrake Linux 9.1:
> 780b008e39507fba91211231fa82da28  
> 9.1/RPMS/hylafax-4.1.5-1.1.91mdk.i586.rpm
> 4c911ae821a6937a8405a848564f98b2  
> 9.1/RPMS/hylafax-client-4.1.5-1.1.91mdk.i586.rpm
> 79e1de48e2be5aa3cd3f0223a7dbb4ce  
> 9.1/RPMS/hylafax-server-4.1.5-1.1.91mdk.i586.rpm
> adc0f78e0202b6d520658c11fb090fdd  
> 9.1/RPMS/libhylafax4.1.1-4.1.5-1.1.91mdk.i586.rpm
> 4f93697bd00bfcd16b7e9e866a7a1ca2  
> 9.1/RPMS/libhylafax4.1.1-devel-4.1.5-1.1.91mdk.i586.rpm
> 168bb1b208ca168728ce5890d6bc9148  
> 9.1/SRPMS/hylafax-4.1.5-1.1.91mdk.src.rpm
>
> Mandrake Linux 9.2:
> 1a834e39a54a3d047f456fb975ceecd3  
> 9.2/RPMS/hylafax-4.1.6-3.1.92mdk.i586.rpm
> a7e0549c31d187995b2a2d4e08a80c79  
> 9.2/RPMS/hylafax-client-4.1.6-3.1.92mdk.i586.rpm
> adbaa2999118bcef1454d1cc9741f70c  
> 9.2/RPMS/hylafax-server-4.1.6-3.1.92mdk.i586.rpm
> 652f6452f70c6c64ad50afe9ce0ffb86  
> 9.2/RPMS/libhylafax4.1.1-4.1.6-3.1.92mdk.i586.rpm
> 63b11bab4396db5e955e5fcd7787398a  
> 9.2/RPMS/libhylafax4.1.1-devel-4.1.6-3.1.92mdk.i586.rpm
> 4355fa8ef700fb2284d636fe02a762a4  
> 9.2/SRPMS/hylafax-4.1.6-3.1.92mdk.src.rpm
> _______________________________________________________________________
>
> To upgrade automatically use MandrakeUpdate or urpmi.  The 
> verification
> of md5 checksums and GPG signatures is performed automatically for 
> you.
>
> A list of FTP mirrors can be obtained from:
>
>  http://www.mandrakesecure.net/en/ftp.php
>
> All packages are signed by MandrakeSoft for security.  You can obtain
> the GPG public key of the Mandrake Linux Security Team by executing:
>
>  gpg --recv-keys --keyserver www.mandrakesecure.net 0x22458A98
>
> Please be aware that sometimes it takes the mirrors a few hours to
> update.
>
> You can view other update advisories for Mandrake Linux at:
>
>  http://www.mandrakesecure.net/en/advisories/
>
> MandrakeSoft has several security-related mailing list services that
> anyone can subscribe to.  Information on these lists can be obtained 
> by
> visiting:
>
>  http://www.mandrakesecure.net/en/mlist.php
>
> If you want to report vulnerabilities, please contact
>
>  security_linux-mandrake.com
>
> Type Bits/KeyID     Date       User ID
> pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
>  <security linux-mandrake.com>
>
>
>
> ____________________ HylaFAX(tm) Users Mailing List 
> _______________________
>  To subscribe/unsubscribe, click 
> http://lists.hylafax.org/cgi-bin/lsg2.cgi
> On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < 
> /dev/null
>  *To learn about commercial HylaFAX(tm) support, mail 
> sales@xxxxxxxxxxxx*

____________________ HylaFAX(tm) Users Mailing List _______________________
 To subscribe/unsubscribe, click http://lists.hylafax.org/cgi-bin/lsg2.cgi
On UNIX: mail -s unsubscribe hylafax-users-request@xxxxxxxxxxx < /dev/null
 *To learn about commercial HylaFAX(tm) support, mail sales@xxxxxxxxxxxx*