[Lotus and Outlook users: please do not use out-of-office autoreplies.
They are extremely annoying. Thanks.]
-----------------------------------------------------------------------
Immunix Secured OS Security Advisory
Packages updated: fileutils
Affected products: Immunix OS 7+
Bugs fixed: CAN-2003-0853 CAN-2003-0854
Date: Fri Oct 31 2003
Advisory ID: IMNX-2003-7+-026-01
Author: Seth Arnold <sarnold@xxxxxxxxxxx>
-----------------------------------------------------------------------
Description:
Georgi Guninski has discovered an off-by-one error in ls(1)'s columns
handling code. This provided a providential opportunity to handle the
exponential memory usage involved in the columnar display; thus, we
have included a patch from Solar Designer to limit the number of
columns to 1024, reducing the chance of memory exhaustion and working
around the off-by-one vulnerability.
ls(1) is exposed through wu-ftpd, potentially to unauthenticated users.
If your setup is a chroot wu-ftpd, please replace the copy of ls in
the chroot with this copy.
This patch fixes CAN-2003-0853 and CAN-2003-0854. Many thanks to
Georgi Guninski and Solar Designer for spotting the problem and
providing the solution.
Package names and locations:
Precompiled binary packages for Immunix 7+ are available at:
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/fileutils-4.0x-3_imnx_3.i386.rpm
A source package for Immunix 7+ can be found at:
http://download.immunix.org/ImmunixOS/7+/Updates/SRPMS/fileutils-4.0x-3_imnx_3.src.rpm
Immunix OS 7+ md5sums:
0e1d67ef1cd87d351963a8f85170d1d0 RPMS/fileutils-4.0x-3_imnx_3.i386.rpm
0bed0757cfa529a63a73cd62696dceec SRPMS/fileutils-4.0x-3_imnx_3.src.rpm
GPG verification:
Our public keys are available at http://download.immunix.org/GPG_KEY
Immunix, Inc., has changed policy with GPG keys. We maintain several
keys now: C53B2B53 for Immunix 7+ package signing, D3BA6C17 for
Immunix 7.3 package signing, and 1B7456DA for general security issues.
NOTE:
Ibiblio is graciously mirroring our updates, so if the links above are
slow, please try:
ftp://ftp.ibiblio.org/pub/Linux/distributions/immunix/
or one of the many mirrors available at:
http://www.ibiblio.org/pub/Linux/MIRRORS.html
ImmunixOS 6.2 is no longer officially supported.
ImmunixOS 7.0 is no longer officially supported.
Contact information:
To report vulnerabilities, please contact security@xxxxxxxxxxxx
Immunix attempts to conform to the RFP vulnerability disclosure protocol
http://www.wiretrip.net/rfp/policy.html.
Attachment:
pgpNOxQh0wmFP.pgp
Description: PGP signature