MDKSA-2004:121 - Updated netatalk packages fix temporary file vulnerability

[Mandrake Linux Security Team <security@xxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

                 Mandrakelinux Security Update Advisory
 _______________________________________________________________________

 Package name:           netatalk
 Advisory ID:            MDKSA-2004:121
 Date:                   November 1st, 2004

 Affected versions:      10.0, 10.1, 9.2, Corporate Server 2.1
 ______________________________________________________________________

 Problem Description:

 The etc2ps.sh script, part of the netatalk package, creates files in
 /tmp with predicatable names which could allow a local attacker to use
 symbolic links to point to a valid file on the filesystem which could
 lead to the overwriting of arbitrary files if etc2ps.sh is executed
 by someone with enough privilege.
 
 The updated packages are patched to prevent this problem.
 _______________________________________________________________________

 References:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0974
 ______________________________________________________________________

 Updated Packages:
  
 Mandrakelinux 10.0:
 4ce3756d43716be6821269eef25f82c0  10.0/RPMS/netatalk-1.6.4-1.1.100mdk.i586.rpm
 59ca7a79a2e6685791e03bafcf61acc7  
10.0/RPMS/netatalk-devel-1.6.4-1.1.100mdk.i586.rpm
 1b132e2b84a2486676eaa86501ae762c  10.0/SRPMS/netatalk-1.6.4-1.1.100mdk.src.rpm

 Mandrakelinux 10.0/AMD64:
 c92dd42a1b1ff1ad9a1586cdb0245a5a  
amd64/10.0/RPMS/netatalk-1.6.4-1.1.100mdk.amd64.rpm
 97331e055754a796e90a1779f2bebbb5  
amd64/10.0/RPMS/netatalk-devel-1.6.4-1.1.100mdk.amd64.rpm
 1b132e2b84a2486676eaa86501ae762c  
amd64/10.0/SRPMS/netatalk-1.6.4-1.1.100mdk.src.rpm

 Mandrakelinux 10.1:
 3fd55bd3b38abb459abc432d61b317a3  
10.1/RPMS/netatalk-2.0-0beta2.3.1.101mdk.i586.rpm
 2e7f7add5982ab63b881421465d4c37f  
10.1/RPMS/netatalk-devel-2.0-0beta2.3.1.101mdk.i586.rpm
 602615d65ae34e5e1da29bcebfe19f96  
10.1/SRPMS/netatalk-2.0-0beta2.3.1.101mdk.src.rpm

 Mandrakelinux 10.1/X86_64:
 c000e90061aaa97b3ab07e93b326a0f9  
x86_64/10.1/RPMS/netatalk-2.0-0beta2.3.1.101mdk.x86_64.rpm
 bd24d4eee231988c0a0d7d9c50b6accb  
x86_64/10.1/RPMS/netatalk-devel-2.0-0beta2.3.1.101mdk.x86_64.rpm
 602615d65ae34e5e1da29bcebfe19f96  
x86_64/10.1/SRPMS/netatalk-2.0-0beta2.3.1.101mdk.src.rpm

 Corporate Server 2.1:
 95c81937a581763fa82469a7a74dccaa  
corporate/2.1/RPMS/netatalk-1.6.2-2.1.C21mdk.i586.rpm
 73a2742b87e26cadb0ee3784b5a80eb8  
corporate/2.1/RPMS/netatalk-devel-1.6.2-2.1.C21mdk.i586.rpm
 3cfea962d1d2d83b329e367a5fa054ff  
corporate/2.1/SRPMS/netatalk-1.6.2-2.1.C21mdk.src.rpm

 Corporate Server 2.1/x86_64:
 8312c749319643c5176f26279fa016a0  
x86_64/corporate/2.1/RPMS/netatalk-1.6.2-2.1.C21mdk.x86_64.rpm
 6ecbd6075522822e5d88df4b0fdf90f5  
x86_64/corporate/2.1/RPMS/netatalk-devel-1.6.2-2.1.C21mdk.x86_64.rpm
 3cfea962d1d2d83b329e367a5fa054ff  
x86_64/corporate/2.1/SRPMS/netatalk-1.6.2-2.1.C21mdk.src.rpm

 Mandrakelinux 9.2:
 6b85ea8cd82a8cc10c5431d41853a89b  9.2/RPMS/netatalk-1.6.3-4.1.92mdk.i586.rpm
 4adfdcaef8e4264db889b2f97a628e29  
9.2/RPMS/netatalk-devel-1.6.3-4.1.92mdk.i586.rpm
 7cb04faaacc7a689f47d83ec7204b173  9.2/SRPMS/netatalk-1.6.3-4.1.92mdk.src.rpm

 Mandrakelinux 9.2/AMD64:
 9ad364504c8288cb659a762341aee089  
amd64/9.2/RPMS/netatalk-1.6.3-4.1.92mdk.amd64.rpm
 03fb757d32760b3428db35c182fcdf15  
amd64/9.2/RPMS/netatalk-devel-1.6.3-4.1.92mdk.amd64.rpm
 7cb04faaacc7a689f47d83ec7204b173  
amd64/9.2/SRPMS/netatalk-1.6.3-4.1.92mdk.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrakeUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandrakesoft for security.  You can obtain
 the GPG public key of the Mandrakelinux Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandrakelinux at:

  http://www.mandrakesoft.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_linux-mandrake.com

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Linux Mandrake Security Team
  <security linux-mandrake.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBhtW2mqjQ0CJFipgRAq2IAKCc1d1RICO3WU6ANTpAStFggDognACgodti
S8L/+MW5cdH0NaAKWIX8nqk=
=ef7r
-----END PGP SIGNATURE-----