-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Trustix Secure Linux Advisory #2004-0066 Package name: samba, php Summary: Security update Date: 2004-12-17 Affected versions: Trustix Secure Linux 1.5 Trustix Secure Linux 2.0 Trustix Secure Linux 2.1 Trustix Secure Linux 2.2 Trustix Operating System - Enterprise Server 2 - -------------------------------------------------------------------------- Package description: samba: Samba provides an SMB server which can be used to provide network services to SMB (sometimes called "Lan Manager") clients, including various versions of MS Windows, OS/2, and other Linux machines. php: PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. Problem description: samba: From the Samba security advisory: Remote exploitation of an integer overflow vulnerability in the smbd daemon included in Samba 2.0.x, Samba 2.2.x, and Samba 3.0.x prior to and including 3.0.9 could allow an attacker to cause controllable heap corruption, leading to execution of arbitrary commands with root privileges. The vulnerability was discovered by Greg MacManus, iDEFENSE Labs. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1154 to this issue. php: (Taken from the php.net announce:) The PHP Development Team would like to announce the immediate release of PHP 4.3.10 and PHP 5.0.3. These are maintenance releases that in addition to non-critical bug fixes address several very serious security issues. All Users of PHP are strongly encouraged to upgrade to one of these releases as soon as possible. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to these issues: CAN-2004-1018 CAN-2004-1019 CAN-2004-1020 CAN-2004-1063 CAN-2004-1064 CAN-2004-1065 These issues were discovered during development of Hardened-PHP. Action: We recommend that all systems with this package installed be upgraded. Please note that if you do not need the functionality provided by this package, you may want to remove it from your system. Location: All Trustix Secure Linux updates are available from <URI:http://http.trustix.org/pub/trustix/updates/> <URI:ftp://ftp.trustix.org/pub/trustix/updates/> About Trustix Secure Linux: Trustix Secure Linux is a small Linux distribution for servers. With focus on security and stability, the system is painlessly kept safe and up to date from day one using swup, the automated software updater. Automatic updates: Users of the SWUP tool can enjoy having updates automatically installed using 'swup --upgrade'. Questions? Check out our mailing lists: <URI:http://www.trustix.org/support/> Verification: This advisory along with all Trustix packages are signed with the TSL sign key. This key is available from: <URI:http://www.trustix.org/TSL-SIGN-KEY> The advisory itself is available from the errata pages at <URI:http://www.trustix.org/errata/trustix-1.5/>, <URI:http://www.trustix.org/errata/trustix-2.0/>, <URI:http://www.trustix.org/errata/trustix-2.1/> and <URI:http://www.trustix.org/errata/trustix-2.2/> or directly at <URI:http://www.trustix.org/errata/2004/0066/> MD5sums of the packages: - -------------------------------------------------------------------------- 7ebef6eb72e110964698ad5f09f3981f 2.2/rpms/php-5.0.3-1tr.i586.rpm c1058c80de6c30e59a87cdd63963aefc 2.2/rpms/php-cli-5.0.3-1tr.i586.rpm 0539366f0d0fdfa229280d359d2fd2f3 2.2/rpms/php-devel-5.0.3-1tr.i586.rpm 5ce4ce359089abc97d2f48e995dc873f 2.2/rpms/php-exif-5.0.3-1tr.i586.rpm 4dbd598c1435b21ec6631141fc45546d 2.2/rpms/php-gd-5.0.3-1tr.i586.rpm 7380f251f027e0311f906991da5d8d27 2.2/rpms/php-imap-5.0.3-1tr.i586.rpm 5062dfde4cc6661950739ecb69972573 2.2/rpms/php-ldap-5.0.3-1tr.i586.rpm d2a980389878953f4f464b989984ee26 2.2/rpms/php-mysql-5.0.3-1tr.i586.rpm 15928d6fe2583caf82ca440b5a7f14c6 2.2/rpms/php-mysqli-5.0.3-1tr.i586.rpm f94be48dd4f3d18ab049013353fe5289 2.2/rpms/php-pgsql-5.0.3-1tr.i586.rpm d7585dda89f750e6d2d08653f799a68a 2.2/rpms/php-zlib-5.0.3-1tr.i586.rpm 29f5387759587834b61981ff45735882 2.2/rpms/samba-3.0.10-2tr.i586.rpm be1bac2ac2b29acc75108d8195cdf4c6 2.2/rpms/samba-client-3.0.10-2tr.i586.rpm 4ccd996bb5f4bef03bbeb58ce77be97b 2.2/rpms/samba-common-3.0.10-2tr.i586.rpm 66a68733c7aedf3c1951e71b6bc46531 2.2/rpms/samba-mysql-3.0.10-2tr.i586.rpm c1264842436599418875d122de0a6089 2.1/rpms/mod_php4-4.3.10-2tr.i586.rpm 0e462ae3d2e4972770f2bfdac552e221 2.1/rpms/mod_php4-cli-4.3.10-2tr.i586.rpm 8c6fa506cec54a7f74dbaddadcc4f01e 2.1/rpms/mod_php4-devel-4.3.10-2tr.i586.rpm f66f188a1c77e7e4e21935b19508c0f2 2.1/rpms/mod_php4-domxml-4.3.10-2tr.i586.rpm 1241029e12a40e02175d6f7606d9061e 2.1/rpms/mod_php4-exif-4.3.10-2tr.i586.rpm cdf39d3223096b07cf3ec2fdff51a607 2.1/rpms/mod_php4-gd-4.3.10-2tr.i586.rpm 324eefe2e5988429a6a8ee8914010811 2.1/rpms/mod_php4-imap-4.3.10-2tr.i586.rpm 67f90486f7d703990da6fb261ec0ea66 2.1/rpms/mod_php4-ldap-4.3.10-2tr.i586.rpm 547b254cd49576451b6b4842b56724a3 2.1/rpms/mod_php4-mysql-4.3.10-2tr.i586.rpm c1ba8277cc10651885e30ad300c14ee5 2.1/rpms/mod_php4-pgsql-4.3.10-2tr.i586.rpm cb3c0b177b7db0e67d3d2e0cceec7666 2.1/rpms/mod_php4-test-4.3.10-2tr.i586.rpm f41699eca46f9354c61dff96a498dad9 2.1/rpms/samba-3.0.10-1tr.i586.rpm b3dbc70b7476fcb56c600e8ead07ac2f 2.1/rpms/samba-client-3.0.10-1tr.i586.rpm eb68d9044c87db5b0f587e2ab9868257 2.1/rpms/samba-common-3.0.10-1tr.i586.rpm 498a4a71b63b5d2c4ae93b142ef7793a 2.1/rpms/samba-mysql-3.0.10-1tr.i586.rpm 024d23f9108346caa6bacf602436f763 2.0/rpms/mod_php4-4.3.10-0.1tr.i586.rpm f152358ed5d07df15fe0b19ee2108541 2.0/rpms/mod_php4-cli-4.3.10-0.1tr.i586.rpm 77aae342d3c43f206c965fa602fbac5c 2.0/rpms/mod_php4-devel-4.3.10-0.1tr.i586.rpm 6d5b80443ec117e84f18a4fa93ea8a8b 2.0/rpms/mod_php4-domxml-4.3.10-0.1tr.i586.rpm5332230743998221708f9805b09912a5 2.0/rpms/mod_php4-exif-4.3.10-0.1tr.i586.rpm 9a3fe6445e5fd378671f24bbae602568 2.0/rpms/mod_php4-gd-4.3.10-0.1tr.i586.rpm d72b78cb7feeefe0315a4abdd60ff84d 2.0/rpms/mod_php4-imap-4.3.10-0.1tr.i586.rpm 5c064294d87a81ead083c4c29436d90e 2.0/rpms/mod_php4-ldap-4.3.10-0.1tr.i586.rpm fc92531cc819444c0c5f0a05c5eb00fe 2.0/rpms/mod_php4-mysql-4.3.10-0.1tr.i586.rpm ee7940420aa095f9a75ed0ff7043c529 2.0/rpms/mod_php4-pgsql-4.3.10-0.1tr.i586.rpm a5bd0870de912f1b0acdcd910744a90c 2.0/rpms/mod_php4-test-4.3.10-0.1tr.i586.rpm d8a1e4a95522036f92c8ff29004565e4 2.0/rpms/samba-2.2.12-2tr.i586.rpm bd0bca48c1f9c2098058702d66071294 2.0/rpms/samba-client-2.2.12-2tr.i586.rpm 5a168fad64662df3c24da7ace22b9d12 2.0/rpms/samba-common-2.2.12-2tr.i586.rpm 0df3a8b4019fa7ba15924ce00f0a473f 1.5/rpms/samba-2.2.12-0.2tr.i586.rpm ad25ffeec248f82f291ef11f498aa511 1.5/rpms/samba-client-2.2.12-0.2tr.i586.rpm 7c36b9e93ce777c524e360634d0d2c94 1.5/rpms/samba-common-2.2.12-0.2tr.i586.rpm - -------------------------------------------------------------------------- Trustix Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) iD8DBQFBxopqi8CEzsK9IksRAqApAJ9+lagoL9IgFQIb7jDy+fCOuQpmxACeO9FC Q0a+PBvUj7N3y9ftJIKJPw0= =JiKZ -----END PGP SIGNATURE-----