Subject: [yellowdog-updates] Yellow Dog Security Announcement: YDU-20020211-1
dburcaw@newhope.terraplex.com
Date: Tue Feb 12 2002 - 18:30:40 MST
Yellow Dog Linux Security Announcement
--------------------------------------
Package: ucd-snmp
Issue Date: February 11, 2002
Priority: high
Advisory ID: YDU-20020211-1
1. Topic:
The ucd-snmp packages have been updated to
prevent denial of service attacks and other
security flaws recently discovered.
2. Problem:
"The Simple Network Management Protocol (SNMP) enables
monitoring and configuration of network nodes.
The Oulu University Secure Programming Group performed
a vulnerability assessment of various SNMP implementations
through syntax testing and test-suite creation.
The test-suite showed several failures in the ucd-snmp tools
in version 4.2.2 and earlier. These vulnerabilities can cause
denial-of-service conditions, service interruptions, and in
some cases could result in a remote security breach.
Updated ucd-snmp packages are provided that are not susceptible
to these vulnerabilities and which pass all tests of the test-suite
sucessfully.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CAN-2002-0012 and CAN-2002-0013 to these
issues.
All users of ucd-snmp should upgrade to these errata packages."
(from Red Hat advisory)
3. Solution:
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update ucd-snmp
yup update ucd-snmp-devel
yup update ucd-snmp-utils
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
rpm -Fvh ucd-snmp-4.2.3-1.7.0.3.ppc.rpm
rpm -Fvh ucd-snmp-devel-4.2.3-1.7.0.3.ppc.rpm
rpm -Fvh ucd-snmp-utils-4.2.3-1.7.0.3.ppc.rpm
4. Verification
MD5 checksum Package
-------------------------------- ----------------------------
734c0fef3672af49241325526bfd2125 ppc/ucd-snmp-4.2.3-1.7.0.3.ppc.rpm
08cf1e66f3673ae41e2fc5dcc14df2e7 ppc/ucd-snmp-devel-4.2.3-1.7.0.3.ppc.rpm
c220592385f2180905428985c234f3fd ppc/ucd-snmp-utils-4.2.3-1.7.0.3.ppc.rpm
cc8f148b8089dfe0371a4b4312b10356 SRPMS/ucd-snmp-4.2.3-1.7.0.3.src.rpm
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
5. Misc.
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.
For information regarding the usage of yup, the Yellow Dog Update Program, see
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml
This archive was generated by hypermail 2a24 : Tue Feb 12 2002 - 18:31:12 MST