From:	 TurboLinux Security Team <security@www1.turbolinux.com>
To:	 tl-security-announce@www1.turbolinux.com
Subject: [TL-Security-Announce] TLSA2001026 gtk+-1.2.8-10
Date:	 Wed, 6 Jun 2001 19:06:22 -0700 (PDT)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


___________________________________________________________________________

                     Turbolinux Security Announcement

        Package: gtk+
        Vulnerable Packages: All Turbolinux versions previous to 1.2.8-6
        Date: 06/06/2001 5:00 PDT

        Affected Turbolinux platforms:  TL 6.1 Workstation,
                                        All Turbolinux versions
                                        6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001026

   References: http://www.securityfocus.com/vdb/bottom.html?vid=2165

___________________________________________________________________________

A security hole has been discovered in the package gtk+.  Please update
this package in your installation as soon as possible.
___________________________________________________________________________

1. Problem Summary
   
       The environment variable GTK_MODULES allows a local user to enter a 
   directory path to a module that may not be associated with the GTK+ tool-
   kit.  Hence, an attacker can create a custom module and load it using 
   the toolkit.

2. Impact

       An attacker can elevate his privileges, overwrite system files and 
   execute potentially harmful code.
   
  
3. Solution

  Update the package from our ftp server by running the following command:

      rpm -Uvh ftp_path_to_filename

  Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/gtk+-1.2.8-10.i386.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/gtk+-devel-1.2.8-10.i386.rpm

  The source RPM can be downloaded here:

ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/gtk+-1.2.8-10.src.rpm

  **Note: You must rebuild and install the RPM if you choose to download
  and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
  THE SECURITY HOLE.

          In order to rebuild the gtk+ binaries from the SRPM, be sure
  you have XFree86-devel, glib(v1.2.8 or greater), and glib-devel(v1.2.8
  or greater) installed on your system.

 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
___________________________________________________________________________

  b0c2d5dc77ba3ecb3cd2d9d11848acd9      gtk+-1.2.8-10.i386.rpm
  9bdc5579224c5cbe0ed139d0db39279c      gtk+-devel-1.2.8-10.i386.rpm
  eb8464e01901535828848c5ea66f5c65      gtk+-1.2.8-10.src.rpm
___________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

___________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 
   for TL6.x Workstation and Server security updates
  
Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
___________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (GNU/Linux)
Comment: pgpenvelope 2.10.0 - http://pgpenvelope.sourceforge.net/

iD8DBQE7HuGtcpw52/ZatwoRAqrgAJ4679h602hMgfoOEL/EoSou95F4OQCdGoAo
6kHkzXqBSMtAPrxx4biAsNw=
=5EOF
-----END PGP SIGNATURE-----



_______________________________________________
TL-Security-Announce mailing list
TL-Security-Announce@www.turbolinux.com
http://www.turbolinux.com/mailman/listinfo/tl-security-announce