From aliz@gentoo.org Tue Sep 2 14:51:44 2003 From: Daniel Ahlberg To: gentoo-announce@gentoo.org, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com Date: Tue, 2 Sep 2003 11:57:49 +0200 (CEST) Subject: [Full-Disclosure] GLSA: eroaster (200309-04) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - --------------------------------------------------------------------- GENTOO LINUX SECURITY ANNOUNCEMENT 200309-04 - - - ---------------------------------------------------------------------           PACKAGE : eroaster           SUMMARY : symlink attack              DATE : 2003-09-02 09:57 UTC           EXPLOIT : local VERSIONS AFFECTED : =eroaster-2.1.0-r2               CVE : CAN-2003-0656 - - - --------------------------------------------------------------------- Previous eroaster versions allowwed local users to overwrite arbitrary files via a symlink attack on a temporary file that is used as a lockfile. SOLUTION It is recommended that all Gentoo Linux users who are running app-cdr/eroaster upgrade to eroaster-2.1.0-r2 as follows: emerge sync emerge eroaster emerge clean - - - --------------------------------------------------------------------- aliz@gentoo.org - GnuPG key is available at http://dev.gentoo.org/~aliz - - - --------------------------------------------------------------------- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.3 (GNU/Linux) iD8DBQE/VGmdfT7nyhUpoZMRAg2YAKCY0hNYsrhirHwqHpN9exykGJhn3wCfbyIW gYYFsd1A4rF6FOni7qg3jdg= =rrmf -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html