[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 378/06 - Three Red Hat Security Advisories:



-----BEGIN PGP SIGNED MESSAGE-----

- ----------------------------------------------------------------------------------
   UNIRAS (UK Govt CERT) Briefing Notice - 378/06 dated 02.06.06  Time: 14:50  
  UNIRAS is part of NISCC (National Infrastructure Security Co-ordination Centre)
- ---------------------------------------------------------------------------------- 
  UNIRAS material is also available from its website at www.uniras.gov.uk and
         Information about NISCC is available from www.niscc.gov.uk
- ----------------------------------------------------------------------------------

Title
=====

Three Red Hat Security Advisories:

1. RHSA-2006:0525-01 - Moderate: quagga security update
       
2. RHSA-2006:0533-01 - Moderate: zebra security update
       
3. RHSA-2006:0541-02 - Moderate: dia security update

Detail
====== 

1. Quagga manages the TCP/IP based routing protocol. It takes a multi-server
and multi-thread approach to resolve the current complexity of the Internet.

2. GNU Zebra is a free software that manages TCP/IP based routing protocol.
An information disclosure flaw was found in the way GNU Zebra interprets
RIP REQUEST packets. RIPd in GNU Zebra will respond to RIP REQUEST packets
for RIP versions that have been disabled or that have authentication
enabled, allowing a remote attacker to acquire information about the local
network. (CVE-2006-2223)

3. The Dia drawing program is designed to draw various types of diagrams.
Several format string flaws were found in the way dia displays certain
messages. If an attacker is able to trick a Dia user into opening a
carefully crafted file, it may be possible to execute arbitrary code as the
user running Dia. (CVE-2006-2453, CVE-2006-2480)




1.



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: quagga security update
Advisory ID:       RHSA-2006:0525-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0525.html
Issue date:        2006-06-01
Updated on:        2006-06-01
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-2223 CVE-2006-2224 CVE-2006-2276 
- - ---------------------------------------------------------------------

1. Summary:

Updated quagga packages that fix several security vulnerabilities are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Quagga manages the TCP/IP based routing protocol. It takes a multi-server
and multi-thread approach to resolve the current complexity of the Internet.

An information disclosure flaw was found in the way Quagga interprets RIP
REQUEST packets. RIPd in Quagga will respond to RIP REQUEST packets for RIP
versions that have been disabled or that have authentication enabled,
allowing a remote attacker to acquire information about the local network.
(CVE-2006-2223)

A route injection flaw was found in the way Quagga interprets RIPv1
RESPONSE packets when RIPv2 authentication is enabled. It is possible for a
remote attacker to inject arbitrary route information into the RIPd routing
tables. This issue does not affect Quagga configurations where only RIPv2
is specified. (CVE-2006-2224)

A denial of service flaw was found in Quagga's telnet interface. If an
attacker is able to connect to the Quagga telnet interface, it is possible
to cause Quagga to consume vast quantities of CPU resources by issuing a
malformed 'sh' command. (CVE-2006-2276)

Users of Quagga should upgrade to these updated packages, which contain
backported patches that correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

191080 - CVE-2006-2223 Quagga RIPd information disclosure
191084 - CVE-2006-2224 Quagga RIPd route injection
191376 - CVE-2006-2276 quagga locks with command sh ip bgp

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/quagga-0.96.2-11.3E.src.rpm
fcd880dd2f1f922e8dc02160a947ec1d  quagga-0.96.2-11.3E.src.rpm

i386:
9161564a5722cb4bfe0ae7beb2b86057  quagga-0.96.2-11.3E.i386.rpm
34df55b9aab74f0dfa8dbb95318af308  quagga-debuginfo-0.96.2-11.3E.i386.rpm

ia64:
c44d0a382713b4c0af22df5c1caa6d26  quagga-0.96.2-11.3E.ia64.rpm
f8660048798bdc57c577b081fb1e39bb  quagga-debuginfo-0.96.2-11.3E.ia64.rpm

ppc:
22137d5727fe3fc6ec094c792735a6ac  quagga-0.96.2-11.3E.ppc.rpm
21a0593e16f0cb55f9ebcfdc431cd594  quagga-debuginfo-0.96.2-11.3E.ppc.rpm

s390:
6b9f107b9c8e403cc70084e644047d60  quagga-0.96.2-11.3E.s390.rpm
45316c7dc06db75489f8cf534fb76d25  quagga-debuginfo-0.96.2-11.3E.s390.rpm

s390x:
23524c23823e5b2c5c936be3f924a2ba  quagga-0.96.2-11.3E.s390x.rpm
4c22b6cd495766672968f874ad87a527  quagga-debuginfo-0.96.2-11.3E.s390x.rpm

x86_64:
8e752b034be7388f9487ccd502767699  quagga-0.96.2-11.3E.x86_64.rpm
5ce61ba937c19527617c9f2db2f817de  quagga-debuginfo-0.96.2-11.3E.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/quagga-0.96.2-11.3E.src.rpm
fcd880dd2f1f922e8dc02160a947ec1d  quagga-0.96.2-11.3E.src.rpm

i386:
9161564a5722cb4bfe0ae7beb2b86057  quagga-0.96.2-11.3E.i386.rpm
34df55b9aab74f0dfa8dbb95318af308  quagga-debuginfo-0.96.2-11.3E.i386.rpm

ia64:
c44d0a382713b4c0af22df5c1caa6d26  quagga-0.96.2-11.3E.ia64.rpm
f8660048798bdc57c577b081fb1e39bb  quagga-debuginfo-0.96.2-11.3E.ia64.rpm

x86_64:
8e752b034be7388f9487ccd502767699  quagga-0.96.2-11.3E.x86_64.rpm
5ce61ba937c19527617c9f2db2f817de  quagga-debuginfo-0.96.2-11.3E.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c  quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0  quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2  quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b  quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee  quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18  quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565  quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c  quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24  quagga-devel-0.98.3-2.4E.ia64.rpm

ppc:
c5e07e8add5263b5d6fd48ca8f626f86  quagga-0.98.3-2.4E.ppc.rpm
23b66824e77246d0d66288c960d59e23  quagga-contrib-0.98.3-2.4E.ppc.rpm
18db7cc3db560be1606cff7285df7443  quagga-debuginfo-0.98.3-2.4E.ppc.rpm
08d3640a55e8c4324a3920f69520eaaa  quagga-devel-0.98.3-2.4E.ppc.rpm

s390:
046f86b73376db4020dbfb1e86035e68  quagga-0.98.3-2.4E.s390.rpm
9b98a6ede299736704f3d936f0b1d504  quagga-contrib-0.98.3-2.4E.s390.rpm
3ff1c0c9c283f58a8958859d4efadf2a  quagga-debuginfo-0.98.3-2.4E.s390.rpm
0219dc67fd0a6ce68f872d8e3e4a4414  quagga-devel-0.98.3-2.4E.s390.rpm

s390x:
9bf4e48db2b520bc6b961439d83a7a93  quagga-0.98.3-2.4E.s390x.rpm
9c063760f39f25aad41268d84053fe71  quagga-contrib-0.98.3-2.4E.s390x.rpm
33f8fb06581e74361664c1e7a5afdcbf  quagga-debuginfo-0.98.3-2.4E.s390x.rpm
a91489306834d2101f437082aa6204ad  quagga-devel-0.98.3-2.4E.s390x.rpm

x86_64:
3445db9b16c81b7949c292093447696e  quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59  quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94  quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250  quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c  quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0  quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2  quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b  quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee  quagga-devel-0.98.3-2.4E.i386.rpm

x86_64:
3445db9b16c81b7949c292093447696e  quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59  quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94  quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250  quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c  quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0  quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2  quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b  quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee  quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18  quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565  quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c  quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24  quagga-devel-0.98.3-2.4E.ia64.rpm

x86_64:
3445db9b16c81b7949c292093447696e  quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59  quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94  quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250  quagga-devel-0.98.3-2.4E.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/quagga-0.98.3-2.4E.src.rpm
8e1e520295b2e60ec3a3a1456f4ac32c  quagga-0.98.3-2.4E.src.rpm

i386:
424c22075e47eaad5a39d1ffae6d12f0  quagga-0.98.3-2.4E.i386.rpm
ceb72b1d6d397937e95b265fe07506c2  quagga-contrib-0.98.3-2.4E.i386.rpm
4ea4f2364e99c7383304339d9369132b  quagga-debuginfo-0.98.3-2.4E.i386.rpm
2f723641cd3667ab3f71b3b037f3f1ee  quagga-devel-0.98.3-2.4E.i386.rpm

ia64:
772fcd0889d99758eef81559e2921c18  quagga-0.98.3-2.4E.ia64.rpm
240dbef8215983cace23e4ce75b17565  quagga-contrib-0.98.3-2.4E.ia64.rpm
b3342116d7fb8ab17cd60ef3bf13ef1c  quagga-debuginfo-0.98.3-2.4E.ia64.rpm
2ed5fa5bda76e0c12e8fb37a78eb1c24  quagga-devel-0.98.3-2.4E.ia64.rpm

x86_64:
3445db9b16c81b7949c292093447696e  quagga-0.98.3-2.4E.x86_64.rpm
b2e0ea7266db9aff12029cb12cfc5a59  quagga-contrib-0.98.3-2.4E.x86_64.rpm
38e49074ab20c380330ceaee2e243a94  quagga-debuginfo-0.98.3-2.4E.x86_64.rpm
2ea23e24a534bae762383d659b2ea250  quagga-devel-0.98.3-2.4E.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2276
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFEfyiDXlSAg2UNWIIRAs9FAJ4ro3BoO92esgAuP6CC685zPDWhDgCgvV4y
03ZXwXlOXyONu/QjFUO1Iqg=
=qf8e
- -----END PGP SIGNATURE-----


2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: zebra security update
Advisory ID:       RHSA-2006:0533-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0533.html
Issue date:        2006-06-01
Updated on:        2006-06-01
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-2223 CVE-2006-2224 CVE-2006-2276 
- - ---------------------------------------------------------------------

1. Summary:

Updated zebra packages that fix several security vulnerabilities are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64

3. Problem description:

GNU Zebra is a free software that manages TCP/IP based routing protocol.

An information disclosure flaw was found in the way GNU Zebra interprets
RIP REQUEST packets. RIPd in GNU Zebra will respond to RIP REQUEST packets
for RIP versions that have been disabled or that have authentication
enabled, allowing a remote attacker to acquire information about the local
network. (CVE-2006-2223)

A route injection flaw was found in the way GNU Zebra interprets RIPv1
RESPONSE packets when RIPv2 authentication is enabled. It is possible for a
remote attacker to inject arbitrary route information into the RIPd routing
tables. This issue does not affect GNU Zebra configurations where only
RIPv2 is specified. (CVE-2006-2224)

A denial of service flaw was found in GNU Zebra's telnet interface. If an
attacker is able to connect to the GNU Zebra telnet interface, it is
possible to cause GNU Zebra to consume vast quantities of CPU resources by
issuing a malformed 'sh' command. (CVE-2006-2276)

Users of GNU Zebra should upgrade to these updated packages, which contain
backported patches that correct these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

192757 - CVE-2006-2224 zebra RIPd route injection
192758 - CVE-2006-2276 zebra locks with command sh ip bgp
192759 - CVE-2006-2223 zebra RIPd information disclosure

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/zebra-0.91a-11.21AS.src.rpm
b6e01074d122bd8b5c4058fb38b7fec9  zebra-0.91a-11.21AS.src.rpm

i386:
4d2926158a338aa627b941e3e03e9fbc  zebra-0.91a-11.21AS.i386.rpm

ia64:
abb964bf1fe301e0faea7e05c4bd048f  zebra-0.91a-11.21AS.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/zebra-0.91a-11.21AS.src.rpm
b6e01074d122bd8b5c4058fb38b7fec9  zebra-0.91a-11.21AS.src.rpm

ia64:
abb964bf1fe301e0faea7e05c4bd048f  zebra-0.91a-11.21AS.ia64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2223
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2224
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2276
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFEfyidXlSAg2UNWIIRAhSMAKC7/sdsUK1KQU/M4aceZInC5kdvIACgqyWI
eJw1nBiR1HlXBnyDWBCcbYM=
=QOT2
- -----END PGP SIGNATURE-----



3.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: dia security update
Advisory ID:       RHSA-2006:0541-02
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0541.html
Issue date:        2006-06-01
Updated on:        2006-06-01
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-2453 CVE-2006-2480 
- - ---------------------------------------------------------------------

1. Summary:

Updated Dia packages that fix several buffer overflow bugs are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

The Dia drawing program is designed to draw various types of diagrams.

Several format string flaws were found in the way dia displays certain
messages. If an attacker is able to trick a Dia user into opening a
carefully crafted file, it may be possible to execute arbitrary code as the
user running Dia. (CVE-2006-2453, CVE-2006-2480)

Users of Dia should update to these erratum packages, which contain
backported patches and are not vulnerable to these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

192698 - CVE-2006-2480 Dia format string issue (CVE-2006-2453)

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380  dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15  dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785  dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562  dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c  dia-debuginfo-0.94-5.7.1.ia64.rpm

ppc:
c468d0fda6ef02ef7ed3706701b5ef80  dia-0.94-5.7.1.ppc.rpm
6e913ed7eb05ff1764178822ab0ea249  dia-debuginfo-0.94-5.7.1.ppc.rpm

s390:
fb8026ab24b596855a59552f78efcc44  dia-0.94-5.7.1.s390.rpm
4159c13dca73903490b98499c5c60eb2  dia-debuginfo-0.94-5.7.1.s390.rpm

s390x:
aa3cd319dac56c3b8f423cda410eef53  dia-0.94-5.7.1.s390x.rpm
579389e8483e1b94e381c2801e17d752  dia-debuginfo-0.94-5.7.1.s390x.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8  dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110  dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380  dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15  dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785  dia-debuginfo-0.94-5.7.1.i386.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8  dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110  dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380  dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15  dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785  dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562  dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c  dia-debuginfo-0.94-5.7.1.ia64.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8  dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110  dia-debuginfo-0.94-5.7.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/dia-0.94-5.7.1.src.rpm
d55df9a68f2c56a994dd8f71aee11380  dia-0.94-5.7.1.src.rpm

i386:
bc2e13813b8131cd8ea6dcdab910ed15  dia-0.94-5.7.1.i386.rpm
f0cfd596249745cce1dc26854fa2d785  dia-debuginfo-0.94-5.7.1.i386.rpm

ia64:
46e39c3112958e964d3aee06c5ec0562  dia-0.94-5.7.1.ia64.rpm
32a07c762ff0f4e2b35176c9b851d33c  dia-debuginfo-0.94-5.7.1.ia64.rpm

x86_64:
8f0f6342f2c3fcb6cbd07ff8a0887ac8  dia-0.94-5.7.1.x86_64.rpm
851110084403997d62847d332f07b110  dia-debuginfo-0.94-5.7.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2453
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-2480
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFEfyiuXlSAg2UNWIIRAvRkAKCHjUvZlkc6GIbppLWNqUKUDavUPACfZ/aC
yK1kgE68WqMXifFTwnf71jQ=
=Znec
- -----END PGP SIGNATURE-----




- ----------------------------------------------------------------------------------

For additional information or assistance, please contact the HELP Desk by 
telephone or Not Protectively Marked information may be sent via 
EMail to: uniras@xxxxxxxxxxxx

Office Hours:
Mon - Fri: 08:30 - 17:00 Hrs
Tel: +44 (0) 870 487 0748 Ext 4511
Fax: +44 (0) 870 487 0749

Outside of Office Hours:
On Call Duty Officer:
Tel: +44 (0) 870 487 0748 and follow the prompts

- ----------------------------------------------------------------------------------
UNIRAS wishes to acknowledge the contributions of Red Hat for the information 
contained in this Briefing. 
- ----------------------------------------------------------------------------------
This Briefing contains the information released by the original author. Some 
of the information may have changed since it was released. If the vulnerability 
affects you, it may be prudent to retrieve the advisory from the site of the
original source to ensure that you receive the most current information concerning 
that problem.

Reference to any specific commercial product, process, or service by trade 
name, trademark manufacturer, or otherwise, does not constitute or imply 
its endorsement, recommendation, or favouring by UNIRAS or NISCC.  The views 
and opinions of authors expressed within this notice shall not be used for 
advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors 
or omissions contained within this briefing notice. In particular, they shall 
not be liable for any loss or damage whatsoever, arising from or in connection 
with the usage of information contained within this notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams (FIRST) 
and has contacts with other international Incident Response Teams (IRTs) in 
order to foster cooperation and coordination in incident prevention, to prompt 
rapid reaction to incidents, and to promote information sharing amongst its 
members and the community at large. 
- ----------------------------------------------------------------------------------
<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQCVAwUBRIBA54pao72zK539AQGq2wQArz9knD7RGUePTkHWYJftXy2heAThelfM
H/Bi7I7AO/e6edXFdPWXC6dUDSjjw4rklrH6+xMRt4/MeDZstempZJpWY49LPr7C
Z45NPHWXhdrZsmDysD9osrDK5DHed28MVCQqH0ii81qEelcLk0P6ONzX4GJP9cSt
y+rV4thqyI0=
=8ls0
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________