[Security Announce] [ MDKSA-2006:038 ] - Updated groff packages fix temporary file vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:038
http://www.mandriva.com/security/
_______________________________________________________________________

Package : groff
Date : February 8, 2006
Affected: 10.1, 10.2, 2006.0, Corporate 3.0
_______________________________________________________________________

Problem Description:

The Trustix Secure Linux team discovered a vulnerability in the groffer
utility, part of the groff package. It created a temporary directory
in an insecure way which allowed for the exploitation of a race
condition to create or overwrite files the privileges of the user
invoking groffer.

Likewise, similar temporary file issues were fixed in the pic2graph
and eqn2graph programs which now use mktemp to create temporary
files, as discovered by Javier Fernandez-Sanguino Pena.

The updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0969
_______________________________________________________________________

Updated Packages:

Mandriva Linux 10.1:
2da61d56e608da8cdecd8dcaefa5a608 10.1/RPMS/groff-1.19-6.1.101mdk.i586.rpm
b224b02a6d026ff2d6800c171731c9eb 10.1/RPMS/groff-for-man-1.19-6.1.101mdk.i586.rpm
ccd5222ec22c3413544f4b1a27262cf6 10.1/RPMS/groff-gxditview-1.19-6.1.101mdk.i586.rpm
23814a0830723e7c4ed5fced5995b071 10.1/RPMS/groff-perl-1.19-6.1.101mdk.i586.rpm
d3b1d5792f5f9eb941b0a0111a5488b8 10.1/SRPMS/groff-1.19-6.1.101mdk.src.rpm

Mandriva Linux 10.1/X86_64:
f8a2eec5b2d92413a599f63ea9b0c180 x86_64/10.1/RPMS/groff-1.19-6.1.101mdk.x86_64.rpm
36d3ac889a34af4274dbf966647390fb x86_64/10.1/RPMS/groff-for-man-1.19-6.1.101mdk.x86_64.rpm
d56f7aa42108ea4ff6375714b125e443 x86_64/10.1/RPMS/groff-gxditview-1.19-6.1.101mdk.x86_64.rpm
027479132bfcfc79663f2d4e737f420e x86_64/10.1/RPMS/groff-perl-1.19-6.1.101mdk.x86_64.rpm
d3b1d5792f5f9eb941b0a0111a5488b8 x86_64/10.1/SRPMS/groff-1.19-6.1.101mdk.src.rpm

Mandriva Linux 10.2:
9d2bf8589987d6cb7c35ad12df82c69a 10.2/RPMS/groff-1.19-9.1.102mdk.i586.rpm
2737744582fe03aa752d69bbbe72e8af 10.2/RPMS/groff-for-man-1.19-9.1.102mdk.i586.rpm
f1b10bbbaeb2a0c6310b155168fcf836 10.2/RPMS/groff-gxditview-1.19-9.1.102mdk.i586.rpm
6ebe47194102d0700c902030e9e73638 10.2/RPMS/groff-perl-1.19-9.1.102mdk.i586.rpm
88d91b5a36400352de2cd845a5c16508 10.2/SRPMS/groff-1.19-9.1.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
e274e9135c59de46ee6b81e9173ae564 x86_64/10.2/RPMS/groff-1.19-9.1.102mdk.x86_64.rpm
82320dc08ec42570eaaf7fa172d6b80a x86_64/10.2/RPMS/groff-for-man-1.19-9.1.102mdk.x86_64.rpm
fa52ea5b60cbe0fdc2c3995003fbd63a x86_64/10.2/RPMS/groff-gxditview-1.19-9.1.102mdk.x86_64.rpm
959423c66c0ae1aeecf56f38176f458c x86_64/10.2/RPMS/groff-perl-1.19-9.1.102mdk.x86_64.rpm
88d91b5a36400352de2cd845a5c16508 x86_64/10.2/SRPMS/groff-1.19-9.1.102mdk.src.rpm

Mandriva Linux 2006.0:
2bfa7438040cfdfab92d3d109afa96aa 2006.0/RPMS/groff-1.19.1-1.1.20060mdk.i586.rpm
c408fa608c4234405b91f4cf763b1bd3 2006.0/RPMS/groff-for-man-1.19.1-1.1.20060mdk.i586.rpm
f8e94b09822328151af0aaf213b043a9 2006.0/RPMS/groff-gxditview-1.19.1-1.1.20060mdk.i586.rpm
c64dc660b7a906d9003205caaeabcd62 2006.0/RPMS/groff-perl-1.19.1-1.1.20060mdk.i586.rpm
2821299644c84404e2fa743835722dab 2006.0/SRPMS/groff-1.19.1-1.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
63175fa1b86871cf684d768f08837ec6 x86_64/2006.0/RPMS/groff-1.19.1-1.1.20060mdk.x86_64.rpm
c0fae16eb3f9c2a813f60b4e6b1dbfc5 x86_64/2006.0/RPMS/groff-for-man-1.19.1-1.1.20060mdk.x86_64.rpm
2ff202c91cd6a3e864b92a6c317b4803 x86_64/2006.0/RPMS/groff-gxditview-1.19.1-1.1.20060mdk.x86_64.rpm
7b877faf1a8db9af7e2d2808e100a4a5 x86_64/2006.0/RPMS/groff-perl-1.19.1-1.1.20060mdk.x86_64.rpm
2821299644c84404e2fa743835722dab x86_64/2006.0/SRPMS/groff-1.19.1-1.1.20060mdk.src.rpm

Corporate 3.0:
410ef29b051bfb96703154b26d16d631 corporate/3.0/RPMS/groff-1.19-6.1.C30mdk.i586.rpm
0d5dc3e189003f6809f20dd9b9cb3209 corporate/3.0/RPMS/groff-for-man-1.19-6.1.C30mdk.i586.rpm
cbdbf36d7826f0699dd609d7feb17f66 corporate/3.0/RPMS/groff-gxditview-1.19-6.1.C30mdk.i586.rpm
4e9c264c0d49eb5838a38cd79e0b65a0 corporate/3.0/RPMS/groff-perl-1.19-6.1.C30mdk.i586.rpm
b7a252f9135ebd8f1b9a8b56573f8ee0 corporate/3.0/SRPMS/groff-1.19-6.1.C30mdk.src.rpm

Corporate 3.0/X86_64:
1c4328212aa64ecbd7f51ccba72718b6 x86_64/corporate/3.0/RPMS/groff-1.19-6.1.C30mdk.x86_64.rpm
ea375e1f85f86dd87a886f32ea368228 x86_64/corporate/3.0/RPMS/groff-for-man-1.19-6.1.C30mdk.x86_64.rpm
6e09c552c3953ffa6e99a7a31a8f3516 x86_64/corporate/3.0/RPMS/groff-gxditview-1.19-6.1.C30mdk.x86_64.rpm
2f6f0e853b722e3a94b7dc09a65bcb38 x86_64/corporate/3.0/RPMS/groff-perl-1.19-6.1.C30mdk.x86_64.rpm
b7a252f9135ebd8f1b9a8b56573f8ee0 x86_64/corporate/3.0/SRPMS/groff-1.19-6.1.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFD6mGcmqjQ0CJFipgRAgggAJ4hl6sa7vdtJ9Hh0Vj1IFfKq+8VbgCgs0OY
B6FcTesl9FSEsu/Bow929ms=
=FxzZ
-----END PGP SIGNATURE-----