--------------------------------------------------------------------- Fedora Legacy Update Advisory Synopsis: Updated perl packages fix security issue Advisory ID: FLSA:176731 Issue date: 2006-02-25 Product: Red Hat Linux, Fedora Core Keywords: Bugfix CVE Names: CVE-2005-3962 --------------------------------------------------------------------- --------------------------------------------------------------------- 1. Topic: Updated perl packages that fix a security flaw are now available. Perl is a high-level programming language commonly used for system administration utilities and Web programming. 2. Relevant releases/architectures: Red Hat Linux 9 - i386 Fedora Core 1 - i386 Fedora Core 2 - i386 3. Problem description: An integer overflow bug was found in Perl's format string processor. It is possible for an attacker to cause perl to crash or execute arbitrary code if the attacker is able to process a malicious format string. This issue is only exploitable through a script which passes arbitrary untrusted strings to the format string processor. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-3962 to this issue. Note that this vulnerability do not affect perl packages in Red Hat Linux 7.3 Users of perl are advised to upgrade to these packages which contain a backported patch and are not vulnerable to this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via yum and apt. Many people find this an easier way to apply updates. To use yum issue: yum update or to use apt: apt-get update; apt-get upgrade This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. This assumes that you have yum or apt-get configured for obtaining Fedora Legacy content. Please visit http://www.fedoralegacy.org/docs for directions on how to configure yum and apt-get. 5. Bug IDs fixed: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=176731 6. RPMs required: Red Hat Linux 9: SRPM: http://download.fedoralegacy.org/redhat/9/updates/SRPMS/perl-5.8.0-90.0.13.legacy.src.rpm i386: http://download.fedoralegacy.org/redhat/9/updates/i386/perl-5.8.0-90.0.13.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/perl-CGI-2.81-90.0.13.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/perl-CPAN-1.61-90.0.13.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/perl-DB_File-1.804-90.0.13.legacy.i386.rpm http://download.fedoralegacy.org/redhat/9/updates/i386/perl-suidperl-5.8.0-90.0.13.legacy.i386.rpm Fedora Core 1: SRPM: http://download.fedoralegacy.org/fedora/1/updates/SRPMS/perl-5.8.3-17.5.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/1/updates/i386/perl-5.8.3-17.5.legacy.i386.rpm http://download.fedoralegacy.org/fedora/1/updates/i386/perl-suidperl-5.8.3-17.5.legacy.i386.rpm Fedora Core 2: SRPM: http://download.fedoralegacy.org/fedora/2/updates/SRPMS/perl-5.8.3-19.5.legacy.src.rpm i386: http://download.fedoralegacy.org/fedora/2/updates/i386/perl-5.8.3-19.5.legacy.i386.rpm http://download.fedoralegacy.org/fedora/2/updates/i386/perl-suidperl-5.8.3-19.5.legacy.i386.rpm 7. Verification: SHA1 sum Package Name --------------------------------------------------------------------- 4d2401a09f2cc0b126df88659bd9e259a528146d redhat/9/updates/i386/perl-5.8.0-90.0.13.legacy.i386.rpm 3b5448a2a8d8241a85c4c54ad5d5deb4b9d466d4 redhat/9/updates/i386/perl-CGI-2.81-90.0.13.legacy.i386.rpm 40a05fcf3a7d128e7fa79b00022d54d0542bd3af redhat/9/updates/i386/perl-CPAN-1.61-90.0.13.legacy.i386.rpm 5444ce68de7e8f0b1b051a15a1658c7d497be61b redhat/9/updates/i386/perl-DB_File-1.804-90.0.13.legacy.i386.rpm 76ff3cdbe78a2e7c92c1f95760906fd396f974bf redhat/9/updates/i386/perl-suidperl-5.8.0-90.0.13.legacy.i386.rpm 62fbcae6dd839fd18aabcf5c9fcc6babfd844d94 redhat/9/updates/SRPMS/perl-5.8.0-90.0.13.legacy.src.rpm 3267a9d83ac3cadcfa650b1625cf5c458adb5540 fedora/1/updates/i386/perl-5.8.3-17.5.legacy.i386.rpm 2445d66c7ced8bccc7d875a21404216a0cd5cdb6 fedora/1/updates/i386/perl-suidperl-5.8.3-17.5.legacy.i386.rpm 297a649694e03e67b13cfbac7ae8211554cea44b fedora/1/updates/SRPMS/perl-5.8.3-17.5.legacy.src.rpm 772f9571df3a0eab7749bb0d162311f4cd539879 fedora/2/updates/i386/perl-5.8.3-19.5.legacy.i386.rpm 83cf2b36b48760eb1f99a042214eead7a9650d38 fedora/2/updates/i386/perl-suidperl-5.8.3-19.5.legacy.i386.rpm 260cf2c8b759afe09f205318e1fd78cabdeefcb0 fedora/2/updates/SRPMS/perl-5.8.3-19.5.legacy.src.rpm These packages are GPG signed by Fedora Legacy for security. Our key is available from http://www.fedoralegacy.org/about/security.php You can verify each package with the following command: rpm --checksig -v <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the sha1sum with the following command: sha1sum <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3962 9. Contact: The Fedora Legacy security contact is <secnotice@xxxxxxxxxxxxxxxx>. More project details at http://www.fedoralegacy.org ---------------------------------------------------------------------
Attachment:
signature.asc
Description: OpenPGP digital signature