security advisorycritical fixslackware
Fixes the zlib vulnerability and supplementary groups are removed from a server process after changing uid and gid.. Date: Mon, 11 Mar 2002 15:25:45 -0800 (PST) From: Slackware Security Team To: This email address is being protected from spambots. You need JavaScript enabled to view it. Subject: [slackware-security] rsync update fixes security problems New rsync packages are available to fix security problems. Here's the information from the Slackware 8.0 ChangeLog: ---------------------------- Mon Mar 11 15:09:26 PST 2002 patches/packages/rsync.tgz: Upgraded to rsync-2.5.3. This fixes two security problems: * Make sure that supplementary groups are removed from a server process after changing uid and gid. (Ethan Benson) (Debian bug #132272, CVE CAN-2002-0080) * Fix zlib double-free bug. (Owen Taylor, Mark J Cox) (CVE CAN-2002-0059) (* Security fix *) ---------------------------- We recommend that sites providing external rsync access upgrade to the fixed rsync package as soon as possible. WHERE TO FIND THE NEW PACKAGE: ------------------------------ Updated rsync package for Slackware 8.0: Updated rsync package for Slackware 7.1: MD5 SIGNATURE: -------------- Here are the md5sums for the packages: Slackware 8.0: e88390bae124be2af4b707ad3fbfc791 rsync.tgz Slackware 7.1: 959b82dd4fbb84da564b2ce18eb56afc rsync.tgz INSTALLATION INSTRUCTIONS: -------------------------- Simply upgrade as root: # upgradepkg rsync.tgz Remember, it's also a good idea to backup configuration files before upgrading packages. - Slackware Linux Security Team The Slackware Linux Project . Latest modifications to scp for Arch Linux tackle several safety issues, including weaknesses associated with libpng, alongside changes to permissions and access rights.. Rsync Security, Slackware Update, Zlib Fix, Server Access, Linux Security. . Severity: Critical. LinuxSecurity.com Team
Mar 12, 2002
•Critical
Slackware