[Security Announce] [ MDKSA-2006:183 ] - Updated libksba packages correct DoS vulnerability

Posted by Bob on: 10/17/2006 11:25 PM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:183
http://www.mandriva.com/security/
_______________________________________________________________________

Package : libksba
Date : October 17, 2006
Affected: 2006.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

The libksba library, as used by gpgsm in the gnupg2 package, allows
attackers to cause a denial of service (application crash) via a
malformed X.509 certificate in a signature.

libksba-0.9.15 in Mandriva 2007.0 is not affected by this issue.

Updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5111
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
8f3e8e56ed3cc75930ac17526e565e12 2006.0/i586/libksba8-0.9.11-2.1.20060mdk.i586.rpm
c3e82905d3281c6c32bf3689ad606866 2006.0/i586/libksba8-devel-0.9.11-2.1.20060mdk.i586.rpm
2e4266dd10459a85e466e0158d980b31 2006.0/SRPMS/libksba-0.9.11-2.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
34895ba2aef7cedd7463720a333e125c 2006.0/x86_64/lib64ksba8-0.9.11-2.1.20060mdk.x86_64.rpm
014585f62f3074d3bd6646eac7076d39 2006.0/x86_64/lib64ksba8-devel-0.9.11-2.1.20060mdk.x86_64.rpm
2e4266dd10459a85e466e0158d980b31 2006.0/SRPMS/libksba-0.9.11-2.1.20060mdk.src.rpm

Corporate 4.0:
cddf7be9c4bbf73b688cc0c95a6b77ce corporate/4.0/i586/libksba8-0.9.11-2.1.20060mlcs4.i586.rpm
d6252717330d573c24dea70899365e4d corporate/4.0/i586/libksba8-devel-0.9.11-2.1.20060mlcs4.i586.rpm
e8c7164eac4cc325120847f858944f2d corporate/4.0/SRPMS/libksba-0.9.11-2.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
6e447266e8b71fa94dfc271613f1df43 corporate/4.0/x86_64/lib64ksba8-0.9.11-2.1.20060mlcs4.x86_64.rpm
6eab52fe9640a888f358ffa3e978cbea corporate/4.0/x86_64/lib64ksba8-devel-0.9.11-2.1.20060mlcs4.x86_64.rpm
e8c7164eac4cc325120847f858944f2d corporate/4.0/SRPMS/libksba-0.9.11-2.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFNSQymqjQ0CJFipgRAhtHAJ9gOCcITRQAbJAMg8q5BRHInzJ+mgCgo+Ut
tAH7mnhzdPxq3B0CZwX+HNE=
=1mA6
-----END PGP SIGNATURE-----