Welcome to our website
To take full advantage of all features you need to login or register. Registration is completely free and takes only a few seconds.
RHSA-2004:536-01: Updated ncompress package fixes security issue and bug
Posted by Philipp Esselbach on: 12/13/2004 05:14 PM [ Print | 0 comment(s) ]
Updated ncompress packages are available for Red Hat Enterprise Linux 2.1
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated ncompress package fixes security issue and bug.
Advisory ID: RHSA-2004:536-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2004-536.html
Issue date: 2004-12-13
Updated on: 2004-12-13
Product: Red Hat Enterprise Linux
CVE Names: CAN-2001-1413
----------------------------------------------------------------------
1. Summary:
An updated ncompress package that fixes a buffer overflow and problem in the handling of files larger than 2 GB is now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Updated ncompress package fixes security issue and bug.
Advisory ID: RHSA-2004:536-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2004-536.html
Issue date: 2004-12-13
Updated on: 2004-12-13
Product: Red Hat Enterprise Linux
CVE Names: CAN-2001-1413
----------------------------------------------------------------------
1. Summary:
An updated ncompress package that fixes a buffer overflow and problem in the handling of files larger than 2 GB is now available.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
3. Problem description:
The ncompress package contains the compress and uncompress file compression and decompression utilities, which are compatible with the original UNIX compress utility (.Z file extensions).
A bug in the way ncompress handles long filenames has been discovered. ncompress versions 4.2.4 and earlier contain a stack based buffer overflow when handling very long filenames. It is possible that an attacker could execute arbitrary code on a victims machine by tricking the user into decompressing a carefully crafted filename. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2001-1413 to this issue.
This updated ncompress package also fixes a problem in the handling of files larger than 2 GB.
All users of ncompress should upgrade to this updated package, which contains fixes for these issues.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):
126776 - [RHEL2.1] compress does not work if the file size is greater than 2GB
136661 - CAN-2001-1413 Stack-based buffer overflow in the comprexx function
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
ia64:
36338acd3f00f119ed4b50fe2c67663d ncompress-4.2.4-37.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
ia64:
36338acd3f00f119ed4b50fe2c67663d ncompress-4.2.4-37.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key.html#package
7. References:
http://www.kb.cert.org/vuls/id/176363
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1413
8. Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://www.redhat.com/security/team/contact.html
Copyright 2004 Red Hat, Inc.
The ncompress package contains the compress and uncompress file compression and decompression utilities, which are compatible with the original UNIX compress utility (.Z file extensions).
A bug in the way ncompress handles long filenames has been discovered. ncompress versions 4.2.4 and earlier contain a stack based buffer overflow when handling very long filenames. It is possible that an attacker could execute arbitrary code on a victims machine by tricking the user into decompressing a carefully crafted filename. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2001-1413 to this issue.
This updated ncompress package also fixes a problem in the handling of files larger than 2 GB.
All users of ncompress should upgrade to this updated package, which contains fixes for these issues.
4. Solution:
Before applying this update, make sure that all previously-released errata relevant to your system have been applied. Use Red Hat Network to download and update your packages. To launch the Red Hat Update Agent, use the following command:
up2date
For information on how to install packages manually, refer to the following Web page for the System Administration or Customization guide specific to your system:
http://www.redhat.com/docs/manuals/enterprise/
5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):
126776 - [RHEL2.1] compress does not work if the file size is greater than 2GB
136661 - CAN-2001-1413 Stack-based buffer overflow in the comprexx function
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
ia64:
36338acd3f00f119ed4b50fe2c67663d ncompress-4.2.4-37.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
ia64:
36338acd3f00f119ed4b50fe2c67663d ncompress-4.2.4-37.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61 ncompress-4.2.4-37.src.rpm
i386:
b3cd3462d6a09d8d7d14c4e7b2744923 ncompress-4.2.4-37.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key.html#package
7. References:
http://www.kb.cert.org/vuls/id/176363
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1413
8. Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://www.redhat.com/security/team/contact.html
Copyright 2004 Red Hat, Inc.
