sysreport bug fix update. Date: Tue, 11 Dec 2007 15:40:14 -0600 Reply-To: Troy Dawson Sender: Security Errata for Scientific Linux From: Troy Dawson Subject: Security ERRATA for sysreport on SL3,x i386/x86_64 Comments: To: "
Low: sysreport security update. Date: Tue, 9 Aug 2005 17:19:23 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 302,303,304,305 x86_64 now available Comments: To:
Low: sysreport security update. Date: Tue, 9 Aug 2005 17:17:58 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 301,302,303,304,305 i386 now available Comments: To:
An updated sysreport package that fixes an insecure temporary file flaw is now available. This update has been rated as having low security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Low: sysreport security update Advisory ID: RHSA-2005:598-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:598.html Issue date: 2005-08-09 Updated on: 2005-08-09 Product: Red Hat Enterprise Linux CVE Names: CAN-2005-2104 - ---------------------------------------------------------------------1. Summary: An updated sysreport package that fixes an insecure temporary file flaw is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - noarch Red Hat Linux Advanced Workstation 2.1 - noarch Red Hat Enterprise Linux ES version 2.1 - noarch Red Hat Enterprise Linux WS version 2.1 - noarch Red Hat Enterprise Linux AS version 3 - noarch Red Hat Desktop version 3 - noarch Red Hat Enterprise Linux ES version 3 - noarch Red Hat Enterprise Linux WS version 3 - noarch Red Hat Enterprise Linux AS version 4 - noarch Red Hat Enterprise Linux Desktop version 4 - noarch Red Hat Enterprise Linux ES version 4 - noarch Red Hat Enterprise Linux WS version 4 - noarch 3. Problem description: Sysreport is a utility that gathers information about a system's hardware and configuration. The information can then be used for diagnostic purposes and debugging. Bill Stearns discovered a bug in the way sysreport creates temporary files. It is possible that a local attacker could obtain sensitive information about the system when sysreport is run. The Common Vulnerabilities and Exposures project assigned the name CAN-2005-2104 to this issue. Users of sysreport should update tothis erratum package, which contains a patch that resolves this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 162978 - CAN-2005-2104 sysreport insecure temporary directory usage 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: 4558755e1cc511396658944e1053f6aa sysreport-1.3.7.0-7.src.rpm noarch: daf737b43a6d4f16404f5770611c65a3 sysreport-1.3.7.0-7.noarch.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: 4558755e1cc511396658944e1053f6aa sysreport-1.3.7.0-7.src.rpm noarch: daf737b43a6d4f16404f5770611c65a3 sysreport-1.3.7.0-7.noarch.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: 4558755e1cc511396658944e1053f6aa sysreport-1.3.7.0-7.src.rpm noarch: daf737b43a6d4f16404f5770611c65a3 sysreport-1.3.7.0-7.noarch.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: 4558755e1cc511396658944e1053f6aa sysreport-1.3.7.0-7.src.rpm noarch: daf737b43a6d4f16404f5770611c65a3 sysreport-1.3.7.0-7.noarch.rpm Red Hat Enterprise Linux AS version 3: SRPMS: 3f70a16e5d4f624b5be103e605c90173 sysreport-1.3.7.2-9.src.rpm noarch: 6f4d2d6c29e37480481c63f6926fe0bd sysreport-1.3.7.2-9.noarch.rpm Red Hat Desktop version 3: SRPMS: 3f70a16e5d4f624b5be103e605c90173 sysreport-1.3.7.2-9.src.rpm noarch: 6f4d2d6c29e37480481c63f6926fe0bd sysreport-1.3.7.2-9.noarch.rpm Red Hat Enterprise Linux ES version 3: SRPMS: 3f70a16e5d4f624b5be103e605c90173 sysreport-1.3.7.2-9.src.rpm noarch: 6f4d2d6c29e37480481c63f6926fe0bd sysreport-1.3.7.2-9.noarch.rpm Red Hat Enterprise Linux WS version3: SRPMS: 3f70a16e5d4f624b5be103e605c90173 sysreport-1.3.7.2-9.src.rpm noarch: 6f4d2d6c29e37480481c63f6926fe0bd sysreport-1.3.7.2-9.noarch.rpm Red Hat Enterprise Linux AS version 4: SRPMS: aa4ea7507b4bf5709f6b19b48cb70350 sysreport-1.3.15-5.src.rpm noarch: f7f12746b9e39765250b75ccca71a9b6 sysreport-1.3.15-5.noarch.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: aa4ea7507b4bf5709f6b19b48cb70350 sysreport-1.3.15-5.src.rpm noarch: f7f12746b9e39765250b75ccca71a9b6 sysreport-1.3.15-5.noarch.rpm Red Hat Enterprise Linux ES version 4: SRPMS: aa4ea7507b4bf5709f6b19b48cb70350 sysreport-1.3.15-5.src.rpm noarch: f7f12746b9e39765250b75ccca71a9b6 sysreport-1.3.15-5.noarch.rpm Red Hat Enterprise Linux WS version 4: SRPMS: aa4ea7507b4bf5709f6b19b48cb70350 sysreport-1.3.15-5.src.rpm noarch: f7f12746b9e39765250b75ccca71a9b6 sysreport-1.3.15-5.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2005-2104 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2005 Red Hat, Inc. . New version released for sysreport software addressing minor security vulnerability in Red Hat Linux, associated with advisory identifier RHSA-2005:598-02.. Red Hat Enterprise Linux Update, sysreport Security Fix. . Severity: Low. LinuxSecurity.com Team
Moderate: sysreport security update. Date: Tue, 14 Jun 2005 14:47:58 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 302/303/304 x86_64 now available Comments: To: scientific ,
Moderate: sysreport security update. Date: Tue, 14 Jun 2005 14:42:19 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 301/302/303/304 i386 now available Comments: To: scientific ,
An updated sysreport package that fixes an information disclosure flaw is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: sysreport security update Advisory ID: RHSA-2005:502-01 Advisory URL: https://access.redhat.com/errata/RHSA-2005:502.html Issue date: 2005-06-13 Updated on: 2005-06-13 Product: Red Hat Enterprise Linux CVE Names: CAN-2005-1760 - ---------------------------------------------------------------------1. Summary: An updated sysreport package that fixes an information disclosure flaw is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - noarch Red Hat Linux Advanced Workstation 2.1 - noarch Red Hat Enterprise Linux ES version 2.1 - noarch Red Hat Enterprise Linux WS version 2.1 - noarch Red Hat Enterprise Linux AS version 3 - noarch Red Hat Desktop version 3 - noarch Red Hat Enterprise Linux ES version 3 - noarch Red Hat Enterprise Linux WS version 3 - noarch Red Hat Enterprise Linux AS version 4 - noarch Red Hat Enterprise Linux Desktop version 4 - noarch Red Hat Enterprise Linux ES version 4 - noarch Red Hat Enterprise Linux WS version 4 - noarch 3. Problem description: Sysreport is a utility that gathers information about a system's hardware and configuration. The information can then be used for diagnostic purposes and debugging. When run by the root user, sysreport includes the contents of the /etc/sysconfig/rhn/up2date configuration file. If up2date has been configured to connect to a proxy server that requires an authentication password, that password is included in plain text in the system report. The Common Vulnerabilitiesand Exposures project assigned the name CAN-2005-1760 to this issue. Users of sysreport should update to this erratum package, which contains a patch that removes any proxy authentication passwords. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 159502 - CAN-2005-1760 sysreport includes proxy password in cleartext 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ee0162efdf945753f3870eabbd6f2ace sysreport-1.3.7.0-4.src.rpm noarch: 877c7a9ce70dc7f83852485666cd7b81 sysreport-1.3.7.0-4.noarch.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ee0162efdf945753f3870eabbd6f2ace sysreport-1.3.7.0-4.src.rpm noarch: 877c7a9ce70dc7f83852485666cd7b81 sysreport-1.3.7.0-4.noarch.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ee0162efdf945753f3870eabbd6f2ace sysreport-1.3.7.0-4.src.rpm noarch: 877c7a9ce70dc7f83852485666cd7b81 sysreport-1.3.7.0-4.noarch.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ee0162efdf945753f3870eabbd6f2ace sysreport-1.3.7.0-4.src.rpm noarch: 877c7a9ce70dc7f83852485666cd7b81 sysreport-1.3.7.0-4.noarch.rpm Red Hat Enterprise Linux AS version 3: SRPMS: 3d862802529be0c1751719fcc0769460 sysreport-1.3.7.2-6.src.rpm noarch: cb23bfbecf4a03066410253fed765549 sysreport-1.3.7.2-6.noarch.rpm Red Hat Desktop version 3: SRPMS: 3d862802529be0c1751719fcc0769460 sysreport-1.3.7.2-6.src.rpm noarch: cb23bfbecf4a03066410253fed765549 sysreport-1.3.7.2-6.noarch.rpm Red Hat Enterprise Linux ES version 3: SRPMS: 3d862802529be0c1751719fcc0769460 sysreport-1.3.7.2-6.src.rpm noarch: cb23bfbecf4a03066410253fed765549 sysreport-1.3.7.2-6.noarch.rpm Red Hat Enterprise Linux WS version 3: SRPMS: 3d862802529be0c1751719fcc0769460 sysreport-1.3.7.2-6.src.rpm noarch: cb23bfbecf4a03066410253fed765549 sysreport-1.3.7.2-6.noarch.rpm Red Hat Enterprise Linux AS version 4: SRPMS: 776bab105ff07f51652caab88d1d6597 sysreport-1.3.15-2.src.rpm noarch: ec397dff4766feb681352573cb105db8 sysreport-1.3.15-2.noarch.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: 776bab105ff07f51652caab88d1d6597 sysreport-1.3.15-2.src.rpm noarch: ec397dff4766feb681352573cb105db8 sysreport-1.3.15-2.noarch.rpm Red Hat Enterprise Linux ES version 4: SRPMS: 776bab105ff07f51652caab88d1d6597 sysreport-1.3.15-2.src.rpm noarch: ec397dff4766feb681352573cb105db8 sysreport-1.3.15-2.noarch.rpm Red Hat Enterprise Linux WS version 4: SRPMS: 776bab105ff07f51652caab88d1d6597 sysreport-1.3.15-2.src.rpm noarch: ec397dff4766feb681352573cb105db8 sysreport-1.3.15-2.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CAN-2005-1760 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2005 Red Hat, Inc. . Ubuntu Security Notification alerts users of potential data exposure through the sysstatus tool, stressing the need for prompt software updates to safeguard systems.. Red Hat Security, Sysreport Patch, Security Update, Information Leak, Update Advisory. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.