Bugtraq mailing list archives
[RHSA-2000:006-01] New nmh packages available
From: bugzilla () REDHAT COM (bugzilla () REDHAT COM)
Date: Mon, 6 Mar 2000 20:59:00 -0500
--------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: New nmh packages available Advisory ID: RHSA-2000:006-01 Issue date: 2000-03-06 Updated on: 2000-03-06 Product: Red Hat Linux Keywords: nmh mime mhshow Cross references: N/A --------------------------------------------------------------------- 1. Topic: New nmh packages are available to fix a security problem in mime header parsing. 2. Relevant releases/architectures: Red Hat Linux 5.2 - i386 alpha sparc Red Hat Linux 6.0 - i386 alpha sparc Red Hat Linux 6.1 - i386 alpha sparc 3. Problem description: By creating specially formed MIME headers, it was possible to have nmh's 'mhshow' utility execute arbitrary shell code. It is recommended that all users of nmh upgrade to the fixed packages. 4. Solution: For each RPM for your particular architecture, run: rpm -Fvh [filename] where filename is the name of the RPM. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 9921 - security bug in nmh 6. Obsoleted by: N/A 7. Conflicts with: N/A 8. RPMs required: Red Hat Linux 5.2: intel: ftp://updates.redhat.com/5.2/i386/nmh-1.0.3-5x.i386.rpm alpha: ftp://updates.redhat.com/5.2/alpha/nmh-1.0.3-5x.alpha.rpm sparc: ftp://updates.redhat.com/5.2/sparc/nmh-1.0.3-5x.sparc.rpm sources: ftp://updates.redhat.com/5.2/SRPMS/nmh-1.0.3-5x.src.rpm Red Hat Linux 6.0: intel: ftp://updates.redhat.com/6.0/i386/nmh-1.0.3-6x.i386.rpm alpha: ftp://updates.redhat.com/6.0/alpha/nmh-1.0.3-6x.alpha.rpm sparc: ftp://updates.redhat.com/6.0/sparc/nmh-1.0.3-6x.sparc.rpm sources: ftp://updates.redhat.com/6.0/SRPMS/nmh-1.0.3-6x.src.rpm Red Hat Linux 6.1: intel: ftp://updates.redhat.com/6.1/i386/nmh-1.0.3-6x.i386.rpm alpha: ftp://updates.redhat.com/6.1/alpha/nmh-1.0.3-6x.alpha.rpm sparc: ftp://updates.redhat.com/6.1/sparc/nmh-1.0.3-6x.sparc.rpm sources: ftp://updates.redhat.com/6.1/SRPMS/nmh-1.0.3-6x.src.rpm 9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 158d9ce6bcbc130fdcc069218440c14e 6.0/alpha/nmh-1.0.3-6x.alpha.rpm 34ff509708a6878e9b58b5ed98cb27df 5.2/alpha/nmh-1.0.3-5x.alpha.rpm 158d9ce6bcbc130fdcc069218440c14e 6.1/alpha/nmh-1.0.3-6x.alpha.rpm 829927f436bab62a4a6b3e9ba0b8ab36 6.0/SRPMS/nmh-1.0.3-6x.src.rpm 383e55c58bea25d6fa73216e86fc27ba 5.2/SRPMS/nmh-1.0.3-5x.src.rpm 829927f436bab62a4a6b3e9ba0b8ab36 6.1/SRPMS/nmh-1.0.3-6x.src.rpm ca6a19156b88516362e9404b8ac8fd06 5.2/sparc/nmh-1.0.3-5x.sparc.rpm 59a31706a3747717e6aaec9c5f1b3122 6.0/sparc/nmh-1.0.3-6x.sparc.rpm 59a31706a3747717e6aaec9c5f1b3122 6.1/sparc/nmh-1.0.3-6x.sparc.rpm 5633c3097e0f6503615957778d572b52 5.2/i386/nmh-1.0.3-5x.i386.rpm 272c5a8bbdd1c6b7ed60595cf4521d01 6.0/i386/nmh-1.0.3-6x.i386.rpm 272c5a8bbdd1c6b7ed60595cf4521d01 6.1/i386/nmh-1.0.3-6x.i386.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg <filename> 10. References: N/A
Current thread:
- Foundry Networks ServerIron sequence predictability fix soon to be available, (continued)
- Foundry Networks ServerIron sequence predictability fix soon to be available Andrew van der Stock (Mar 01)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Przemyslaw Frasunek (Mar 01)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Ronald Huizer (Mar 04)
- OpenLinux 2.3: rpm_query harikiri (Mar 04)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Eugene Teo (Mar 02)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Derek Callaway (Mar 02)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Przemyslaw Frasunek (Mar 03)
- Potential security problem with mtr Viktor Fougstedt (Mar 03)
- Re: Potential security problem with mtr LaMont Jones (Mar 03)
- Re: Potential security problem with mtr Viktor Fougstedt (Mar 03)
- [RHSA-2000:006-01] New nmh packages available bugzilla () REDHAT COM (Mar 06)
- Microsoft Security Bulletin (MS00-015) Microsoft Product Security (Mar 06)
- @Stake Advisory: Microsoft Office 2000 ClipArt Vulnerablity Weld Pond (Mar 07)
- Re: @Stake Advisory: Microsoft Office 2000 ClipArt Vulnerablity Dustin Miller (Mar 07)
- Re: @Stake Advisory: Microsoft Office 2000 ClipArt Vulnerablity Weld Pond (Mar 08)
- Re: [ Hackerslab bug_paper ] Linux dump buffer overflow Derek Callaway (Mar 02)
- Problem with MacOS 9 Multiple Users and Netware AFP Don Lambert (Mar 03)
- Re: Potential security problem with mtr Rogier Wolff (Mar 03)
- Re: Potential security problem with mtr Viktor Fougstedt (Mar 04)
- Re: Potential security problem with mtr - fixed Jeff Dafoe (Mar 06)
- userv (security boundary tool) 1.0.0 released Ian Jackson (Mar 06)