Conectiva alert: libtool

Posted by dave on Feb 5, 2004 11:29 AM EDT
Mailing list
Mail this story
Print this story

Joseph S. Myers and Stefan Nordhausen independently found[1,2] a vulnerability[3] in the way the ltmain.sh script (which is part of the libtool package) creates temporary directories for its use.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - --------------------------------------------------------------------------

PACKAGE : libtool SUMMARY : Insecure handling of temporary files DATE : 2004-02-05 18:11:00 ID : CLA-2004:811 RELEVANT RELEASES : 8, 9

- -------------------------------------------------------------------------

DESCRIPTION GNU libtool consists of a set of shell scripts used to build shared libraries. Joseph S. Myers and Stefan Nordhausen independently found[1,2] a vulnerability[3] in the way the ltmain.sh script (which is part of the libtool package) creates temporary directories for its use. A local attacker could exploit this vulnerability to change/delete arbitrary files in the system on behalf of the user who is calling the script. The vulnerability has been fixed in the 1.5.2 version of libtool. This update keeps the original versions distributed with Conectiva Linux, fixing the vulnerability by using mktemp to securely create the directories.

SOLUTION All developers using libtool should upgrade. REFERENCES 1.http://www.securityfocus.com/archive/1/352333 2.http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405 3.http://www.securityfocus.com/bid/9530

UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/8/RPMS/libtool-1.4.2-4U80_2cl.i386.rpm ftp://atualizacoes.conectiva.com.br/8/SRPMS/libtool-1.4.2-4U80_2cl.src.rpm ftp://atualizacoes.conectiva.com.br/9/RPMS/libtool-1.4.3-21152U90_1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/9/SRPMS/libtool-1.4.3-21152U90_1cl.src.rpm

ADDITIONAL INSTRUCTIONS The apt tool can be used to perform RPM packages upgrades:

- run: apt-get update - after that, execute: apt-get upgrade

Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- ------------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key and instructions on how to import it can be found at http://distro.conectiva.com.br/seguranca/chave/?idioma=en Instructions on how to check the signatures of the RPM packages can be found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- ------------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://distro.conectiva.com.br/atualizacoes/?idioma=en

- ------------------------------------------------------------------------- Copyright (c) 2004 Conectiva Inc. http://www.conectiva.com

- ------------------------------------------------------------------------- subscribe: [E-mail:conectiva-updates-subscribe@papaleguas.conectiva.com.br] unsubscribe: [E-mail:conectiva-updates-unsubscribe@papaleguas.conectiva.com.br] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see http://www.gnupg.org

iD8DBQFAIqO342jd0JmAcZARArR7AJ9GvIg/XwNco0Nm35czt4Jo+DT7jACgwTyE lN5/U6mHObEGxXNZ89ij2kc= =ZV9T -----END PGP SIGNATURE-----



  Nav
» Read more about: Story Type: Security; Groups: Conectiva

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.