![[LWN Logo]](/images/lcorner.png)
![[Timeline]](/images/Included.png)
|
|
|
|
Date: Wed, 20 Dec 2000 12:25:50 -0200 To: lwn@lwn.net, bugtraq@securityfocus.com, security-alert@linuxsecurity.com, Subject: [CLA-2000:363] Conectiva Linux Security Announcement - stunnel From: secure@conectiva.com.br -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ----------------------------------------------------------------------- CONECTIVA LINUX SECURITY ANNOUNCEMENT - ----------------------------------------------------------------------- PACKAGE : stunnel SUMMARY : Remote exploit and other bug fixes DATE : 2000-12-20 12:18:00 ID : CLA-2000:363 RELEVANT RELEASES : 4.0, 4.0es, 4.1, 4.2, 5.0, 5.1, 6.0 - ---------------------------------------------------------------------- DESCRIPTION "stunnel" is a package which offers wrapped SSL connections for generic TCP services, such as pop3, ldap and others. Versions prior do 3.9 have a format string vulnerability in a syslog() call which could be exploited remotely. The package distributed with Conectiva Linux 5.1 and 6.0 has the daemon running as the "stunnel" user, and not root, which diminishes the effect of this vulnerability somewhat. Also, versions prior to 3.8 created the PID file in an insecure manner, possibly making it vulnerable to symlink attacks depending on where the user chose to put the PID file. Other bugs were also fixed in the 3.10 release, please refer to the Changelog for a full description. SOLUTION All stunnel users should upgrade immediatelly. DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES ftp://atualizacoes.conectiva.com.br/4.0/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/4.0/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/4.0es/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/4.0es/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/4.1/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/4.1/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/4.2/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/4.2/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/5.0/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/5.0/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/5.1/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/5.1/i386/stunnel-3.10-1cl.i386.rpm ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/stunnel-3.10-1cl.src.rpm ftp://atualizacoes.conectiva.com.br/6.0/RPMS/stunnel-3.10-1cl.i386.rpm ADDITIONAL INSTRUCTIONS Users of Conectiva Linux version 6.0 or higher may use apt to perform upgrades: - add the following line to /etc/apt/sources.list if it is not there yet (you may also use linuxconf to do this): rpm [cncbr] ftp://atualizacoes.conectiva.com.br 6.0/conectiva updates - run: apt-get update - after that, execute: apt-get upgrade Detailed instructions reagarding the use of apt and upgrade examples can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en - ---------------------------------------------------------------------- All packages are signed with Conectiva's GPG key. The key can be obtained at http://www.conectiva.com.br/contato - ----------------------------------------------------------------------- All our advisories and generic update instructions can be viewed at http://www.conectiva.com.br/suporte/atualizacoes - ---------------------------------------------------------------------- subscribe: atualizacoes-anuncio-subscribe@papaleguas.conectiva.com.br unsubscribe: atualizacoes-anuncio-unsubscribe@papaleguas.conectiva.com.br -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6QMFt42jd0JmAcZARAu+JAKD0SBX0PH8n6duNv5rPTr03d0oGyQCgo4JM HDrUjBvUt8KMV33JvpMhfHo= =Vbfs -----END PGP SIGNATURE-----