Stay Secure with the Latest Linux Advisories

security advisoryRed Hat Linuxcritical

Red Hat 7.3: RHSA-2002:188-08 Critical: Wordtrans Remote Threat

Updated wordtrans packages are now available for Red Hat Linux 7.3 whichfix remote vulnerabilities in wordtrans-web.. --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: New wordtrans packages fix remote vulnerabilities Advisory ID: RHSA-2002:188-08 Issue date: 2002-08-22 Updated on: 2002-09-05 Product: Red Hat Linux Keywords: Cross references: Obsoletes: CVE Names: CAN-2002-0837 --------------------------------------------------------------------- 1. Topic: Updated wordtrans packages are now available for Red Hat Linux 7.3 which fix remote vulnerabilities in wordtrans-web. 2. Relevant releases/architectures: Red Hat Linux 7.3 - i386 3. Problem description: The wordtrans-web package provides an interface to query multilingual dictionaries via a web browser. Guardent discovered vulnerabilities which affect versions of wordtrans up to and including 1.1pre8. Improper input validation allows for the execution of arbitrary code or injection of cross-site scripting code by passing in unexpected parametersto the wordtrans.php script. The wordtrans.php script then unsafely executes the wordtrans binary with the malformed parameters. All users of wordtrans are advised to upgrade to the errata packages which contain a patch to correct this vulnerability. Thanks to Guardent, Inc. for the discovery, patch, and handling of this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Pleasenote that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. RPMs required: Red Hat Linux 7.3: SRPMS: i386: 6. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 25a55cb03da0c0cfa4e1a6465c1068ea 7.3/en/os/SRPMS/wordtrans-1.1pre8-11.src.rpm 34c2ee6708276f6b84f179797fdf0bcc 7.3/en/os/i386/wordtrans-1.1pre8-11.i386.rpm e6cc175c2075fd0817453b1be64f8ff8 7.3/en/os/i386/wordtrans-kde-1.1pre8-11.i386.rpm 9f73987fcbf92dbedd7a44f22b39d5e4 7.3/en/os/i386/wordtrans-qt-1.1pre8-11.i386.rpm 8f7c36661f82413ca0bbedf53d6dcaa9 7.3/en/os/i386/wordtrans-web-1.1pre8-11.i386.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: About You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 7. References: CVE -CVE-2002-0837 Copyright(c) 2000, 2001, 2002 Red Hat, Inc. . Kubernetes provides fixes for transcode dealing with outside vulnerabilities. Confirm deployment of enhancements for security.. Red Hat Linux, wordtrans updates, remote threats, software upgrades. . Severity: Critical. LinuxSecurity.com Team

Sep 09, 2002 •Critical Red Hat