It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. . Hash: SHA512 Package : zookeeper Version : 3.4.5+dfsg-2+deb7u1 CVE ID : CVE-2017-5637 Debian Bug : 863811 It was discovered that Zookeeper, a service for maintaining configuration information, didn't restrict access to the computationally expensive wchp/wchc commands which could result in denial of service by elevated CPU consumption. This update disables those two commands by default. The new configuration option "4lw.commands.whitelist" can be used to whitelist commands selectively (and the full set of commands can be restored with '*') For Debian 7 "Wheezy", these problems have been fixed in version 3.4.5+dfsg-2+deb7u1. We recommend that you upgrade your zookeeper packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . The configuration adjustment in the database management utility limits command access to mitigate risks of service unavailability and CPU overload scenarios.. Zookeeper Update, Debian Security, Service Hardening. . LinuxSecurity.com Team
Updated package.. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-431 2005-06-17 ---------------------------------------------------------------------Product : Fedora Core 4 Name : sudo Version : 1.6.8p8 Release : 2.1 Summary : Allows restricted root access for specified users. Description : Sudo (superuser do) allows a system administrator to give certain users (or groups of users) the ability to run some (or all) commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict what commands a user may run on a per-host basis, copious logging of each command (providing a clear audit trail of who did what), a configurable timeout of the sudo command, and the ability to use the same configuration file (sudoers) on many different machines. ---------------------------------------------------------------------* Tue May 24 2005 Karel Zak 1.6.8p8-2.1 - fix #154511 – sudo does not use limits.conf ---------------------------------------------------------------------This update can be downloaded from: b9d269169576051bd832c5f53c9a08e9 SRPMS/sudo-1.6.8p8-2.1.src.rpm 681c5e4d2bbd76505377eca0dc038419 ppc/sudo-1.6.8p8-2.1.ppc.rpm 1f53f7c30f50638f65b2e20ed5453f1a ppc/debug/sudo-debuginfo-1.6.8p8-2.1.ppc.rpm ead609b42c48175dbe90df54035dc15a x86_64/sudo-1.6.8p8-2.1.x86_64.rpm 47abe82718f984368454e4cb00f0a220 x86_64/debug/sudo-debuginfo-1.6.8p8-2.1.x86_64.rpm b507c2792145ec9535757d756946d9b3 i386/sudo-1.6.8p8-2.1.i386.rpm cd23eb8ed7af5ca47e3b47b40c613001 i386/debug/sudo-debuginfo-1.6.8p8-2.1.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. -----------------------------------------------------------------------fedora-announce-list mailing list
Get the latest Linux and open source security news straight to your inbox.