Subject: [yellowdog-updates] Yellow Dog Linux Security Update: YDU-20020127-6
dburcaw@newhope.terraplex.com
Date: Sun Jan 27 2002 - 18:32:35 MST
Yellow Dog Linux Security Announcement
--------------------------------------
Package: sane-backends
Issue Date: January 27, 2002
Priority: medium
Advisory ID: YDU-20020127-6
1. Topic:
Updated SANE and XSane packages are available, which fix insecure handling
of temporary files.
2. Problem:
XSane is an X-based interface providing access to scanners, digital
cameras, and other capture devices. When XSane creates temporary files, it
does so with predictable filenames in a manner that would follow symbolic
links. This could allow a local user to overwrite files written by the user
running XSane.
Additionally, the SANE library that XSane uses also has some similar
problems. When some SANE backend drivers created temporary files they
did so in a manner that would follow symbolic links. These packages
prevent that kind of attack. The default configuration had one of these
dangerous backends enabled. These packages update XSane to version 0.82 and
turn off the vulnerable backend in the default configuration.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the names CAN-2001-0887 and CAN-2001-0890 to these issues.
(from Red Hat advisory)
3. Solution:
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update sane-backends sane-backends-devel xsane xsane-devel
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
rpm -Fvh sane-backends-1.0.5-4.1a.ppc.rpm
rpm -Fvh sane-backends-devel-1.0.5-4.1a.ppc.rpm
rpm -Fvh xsane-0.82-3.1.ppc.rpm
rpm -Fvh xsane-devel-0.82-3.1.ppc.rpm
4. Verification
MD5 checksum Package
-------------------------------- ----------------------------
9580f8dd3bc6fd599ef85b537d010e34 ppc/sane-backends-1.0.5-4.1a.ppc.rpm
ad75256ad0b0bce0cd27af865037780a ppc/sane-backends-devel-1.0.5-4.1a.ppc.rpm
3677306df3ff4db31472c28f453a16ab ppc/xsane-0.82-3.1.ppc.rpm
cf31d815b945fb2eab549fa7a4ebc5e0 ppc/xsane-gimp-0.82-3.1.ppc.rpm
43d394126ef9d293f6ae4d995f2424e8 SRPMS/sane-backends-1.0.5-4.1a.src.rpm
001eb222cb61ceb6e5daf09a1c0391ed SRPMS/xsane-0.82-3.1.src.rpm
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
5. Misc.
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.
For information regarding the usage of yup, the Yellow Dog Update Program, see
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml
This archive was generated by hypermail 2a24 : Sun Jan 27 2002 - 19:26:06 MST