Risks
Advisories
Browse
or
or
Conectiva Linux Security Announcement - slocate
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : slocate
SUMMARY   : Buffer overflow vulnerability
DATE      : 2003-05-08 12:45:00
ID        : CLA-2003:643
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 "slocate"[1] is a program which catalogues existing files and allows
 for a quick lookup later.
 
 It has been reported[2] that slocate contains a buffer overflow
 vulnerability which could be used by a local attacker to obtain the
 privileges of the slocate user.
 
 With these privileges, the attacker could read and alter the slocate
 database, insert false data or find out paths to files which he/she
 would otherwise not know due to filesystem restrictions.
 
 The author released version 2.7 which is not vulnerable to this
 issue.


SOLUTION
 It is recommended that all slocate users upgrade their packages.
 
 
 REFERENCES
 1. http://www.geekreview.org/slocate/
 2. http://marc.theaimsgroup.com/?l=bugtraq&m=104342864418213&w=2
 3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2003-0056


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/slocate-2.7-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/slocate-2.7-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/slocate-2.7-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/slocate-2.7-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/slocate-2.7-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/slocate-2.7-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+unwp42jd0JmAcZARAnWNAJ0ZBU4N/ChhGmu+YAIAkPSzh9hSOQCdGRcv
XWl8t7GbakmA1MNsQuuad6A=
=IxEr
-----END PGP SIGNATURE-----




Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //