Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2005.0557 -- FLSA:152917
Updated curl packages fix a security issue
18 July 2005
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: curl
Publisher: The Fedora Legacy Project
Operating System: Fedora Core 2
Fedora Core 1
Red Hat Linux 9
Red Hat Linux 7.3
Linux variants
Impact: Execute Arbitrary Code/Commands
Access: Remote/Unauthenticated
CVE Names: CAN-2005-0490
Ref: ESB-2005.0275
- --------------------------BEGIN INCLUDED TEXT--------------------
- ---------------------------------------------------------------------
Fedora Legacy Update Advisory
Synopsis: Updated curl packages fix a security issue
Advisory ID: FLSA:152917
Issue date: 2005-07-15
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
CVE Names: CAN-2005-0490
- ---------------------------------------------------------------------
- ---------------------------------------------------------------------
1. Topic:
Updated curl packages are now available.
cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and
Dict servers, using any of the supported protocols. cURL is designed
to work without user interaction or any kind of interactivity.
2. Relevant releases/architectures:
Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386
Fedora Core 2 - i386
3. Problem description:
Multiple buffer overflow bugs were found in the way curl processes
base64 encoded replies. If a victim can be tricked into visiting a URL
with curl, a malicious web server could execute arbitrary code on a
victim's machine. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2005-0490 to this issue.
All users of curl are advised to upgrade to these updated packages,
which contain backported fixes for these issues.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which
are not installed but included in the list will not be updated. Note
that you can also use wildcards (*.rpm) if your current directory *only*
contains the desired RPMs.
Please note that this update is also available via yum and apt. Many
people find this an easier way to apply updates. To use yum issue:
yum update
or to use apt:
apt-get update; apt-get upgrade
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www.fedoralegacy.org/docs for directions on how to
configure yum and apt-get.
5. Bug IDs fixed:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=152917
6. RPMs required:
Red Hat Linux 7.3:
SRPM:
http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm
Red Hat Linux 9:
SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm
Fedora Core 1:
SRPM:
http://download.fedoralegacy.org/fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm
http://download.fedoralegacy.org/fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm
Fedora Core 2:
SRPM:
http://download.fedoralegacy.org/fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm
i386:
http://download.fedoralegacy.org/fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm
http://download.fedoralegacy.org/fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm
7. Verification:
SHA1 sum Package Name
- ---------------------------------------------------------------------
8032bf94d434873de3f02100fd8eb36b206cba02
redhat/7.3/updates/i386/curl-7.9.5-2.2.legacy.i386.rpm
2d95c39024f58f3a7897e58da3da39dd297c8109
redhat/7.3/updates/i386/curl-devel-7.9.5-2.2.legacy.i386.rpm
559d63a957091747972eb963a29642ef7c3835d7
redhat/7.3/updates/SRPMS/curl-7.9.5-2.2.legacy.src.rpm
ca02f070ca45c96cfb93157e88b81f96c4646051
redhat/9/updates/i386/curl-7.9.8-5.2.legacy.i386.rpm
57329416fa302765f25ba963bf9a6d334a225e72
redhat/9/updates/i386/curl-devel-7.9.8-5.2.legacy.i386.rpm
e793df5a65927b98203c0308972389cc80896749
redhat/9/updates/SRPMS/curl-7.9.8-5.2.legacy.src.rpm
c083d601e3b6f1c54dede72bb635e0215bb6230b
fedora/1/updates/i386/curl-7.10.6-7.2.legacy.i386.rpm
835a427b82413d4ccc83a17dbc0ea0204dfd1e4a
fedora/1/updates/i386/curl-devel-7.10.6-7.2.legacy.i386.rpm
cb59fc5fd7f74e1e5d407fe6fdd4d086e7f93bac
fedora/1/updates/SRPMS/curl-7.10.6-7.2.legacy.src.rpm
c8c23e7748058bd6965efb188fc02fc27bc1f1c1
fedora/2/updates/i386/curl-7.11.1-1.2.legacy.i386.rpm
401b44aeb653730fb6dcc7b83ecb88f9600f64cc
fedora/2/updates/i386/curl-devel-7.11.1-1.2.legacy.i386.rpm
d0fbc3ee3137034a02cdc136959f7e119daae817
fedora/2/updates/SRPMS/curl-7.11.1-1.2.legacy.src.rpm
These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy.org/about/security.php
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:
sha1sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0490
9. Contact:
The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
project details at http://www.fedoralegacy.org
- ---------------------------------------------------------------------
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
If you believe that your computer system has been compromised or attacked in
any way, we encourage you to let us know by completing the secure National IT
Incident Reporting Form at:
http://www.auscert.org.au/render.html?it=3192
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQCVAwUBQtsG/ih9+71yA2DNAQLT9wP/cDP8O78zLO+LUjM7sMppIbrvuqJ/ujBT
wTZteS8hBY2TKSdKn3Wri88zZtujfgdalAmdBPD2glGv3yDC++eF35KQGp657mIx
0sTDVlFm0sf/5AZsbywspAJnCmLjREBXh6vQ+bC1eHWhfYPYmZnoXGSs8oUZ3+Ta
kJxMZwhf2pc=
=h2MF
-----END PGP SIGNATURE-----