[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

UNIRAS Brief - 753/06 - Three Red Hat Security Advisories:



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

 UNIRAS (UK Government CERT) Briefing - 753/06 dated 16.11.06 time 14:10
 UNIRAS is part of NISCC (the UK National Infrastructure Security
 Co-ordination Centre)
______________________________________________________________________________

 UNIRAS material is available from the NISCC website at www.niscc.gov.uk
______________________________________________________________________________

Title
=====

Three Red Hat Security Advisories:

1. RHSA-2006:0719-01 - Moderate: nss_ldap security update

2. RHSA-2006:0738-01 - Low: openssh security update
      
3. RHSA-2006:0742-01 - Critical: elinks security update

Detail
======

1. nss_ldap is a set of C library extensions that allow X.500 and LDAP
directory servers to be used as primary sources for aliases, ethers,
groups, hosts, networks, protocols, users, RPCs, services, and shadow
passwords.

2. OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.

3. Elinks is a text mode Web browser used from the command line that supports
rendering modern web pages.
An arbitrary file access flaw was found in the Elinks SMB protocol handler.
A malicious web page could have caused Elinks to read or write files with
the permissions of the user running Elinks. (CVE-2006-5925)





1.



- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: nss_ldap security update
Advisory ID:       RHSA-2006:0719-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0719.html
Issue date:        2006-11-15
Updated on:        2006-11-15
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-5170 
- - ---------------------------------------------------------------------

1. Summary:

Updated nss_ldap packages that fix a security flaw are now available for
Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat
Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

nss_ldap is a set of C library extensions that allow X.500 and LDAP
directory servers to be used as primary sources for aliases, ethers,
groups, hosts, networks, protocols, users, RPCs, services, and shadow
passwords.

A flaw was found in the way nss_ldap handled a PasswordPolicyResponse
control sent by an LDAP server. If an LDAP server responded to an
authentication request with a PasswordPolicyResponse control, it was
possible for an application using nss_ldap to improperly authenticate
certain users. (CVE-2006-5170)

This flaw was only exploitable within applications which did not properly
process nss_ldap error messages. Only xscreensaver is currently known to
exhibit this behavior.

All users of nss_ldap should upgrade to these updated packages, which
contain a backported patch that resolves this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

207286 - CVE-2006-5170 When using LDAP for authentication, xscreensaver allows access if account locked out.

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/nss_ldap-226-17.src.rpm
8fdad6a352014e9c95f6640896bf91dd  nss_ldap-226-17.src.rpm

i386:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm

ia64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
a8cc0cd2d3bd8f2fa916b8f50506dbfa  nss_ldap-226-17.ia64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
244bcce1538dc5537b860324b219ef3e  nss_ldap-debuginfo-226-17.ia64.rpm

ppc:
8fe0c5612ddac345de98d98daf3b1f47  nss_ldap-226-17.ppc.rpm
fef89f4ddf2879df5d8b3cad563610dc  nss_ldap-226-17.ppc64.rpm
31738b28daabe162736517dcee208011  nss_ldap-debuginfo-226-17.ppc.rpm
88cc4161fb0d1be7e5008a57dc9d614f  nss_ldap-debuginfo-226-17.ppc64.rpm

s390:
07f25516c0a7c24c8119f440f4c1fdf0  nss_ldap-226-17.s390.rpm
aebc40eeef7e7277342dc5c7ae6e8a39  nss_ldap-debuginfo-226-17.s390.rpm

s390x:
07f25516c0a7c24c8119f440f4c1fdf0  nss_ldap-226-17.s390.rpm
e193a588cce944b5fa2a3feb01737b61  nss_ldap-226-17.s390x.rpm
aebc40eeef7e7277342dc5c7ae6e8a39  nss_ldap-debuginfo-226-17.s390.rpm
03545e67b2137ebd7a27162b009a8f26  nss_ldap-debuginfo-226-17.s390x.rpm

x86_64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
804dba9f8720306da14615b1f353e31d  nss_ldap-226-17.x86_64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
e4fd474865ccdfd5907047d6bd0ccdac  nss_ldap-debuginfo-226-17.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/nss_ldap-226-17.src.rpm
8fdad6a352014e9c95f6640896bf91dd  nss_ldap-226-17.src.rpm

i386:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm

x86_64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
804dba9f8720306da14615b1f353e31d  nss_ldap-226-17.x86_64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
e4fd474865ccdfd5907047d6bd0ccdac  nss_ldap-debuginfo-226-17.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/nss_ldap-226-17.src.rpm
8fdad6a352014e9c95f6640896bf91dd  nss_ldap-226-17.src.rpm

i386:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm

ia64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
a8cc0cd2d3bd8f2fa916b8f50506dbfa  nss_ldap-226-17.ia64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
244bcce1538dc5537b860324b219ef3e  nss_ldap-debuginfo-226-17.ia64.rpm

x86_64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
804dba9f8720306da14615b1f353e31d  nss_ldap-226-17.x86_64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
e4fd474865ccdfd5907047d6bd0ccdac  nss_ldap-debuginfo-226-17.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/nss_ldap-226-17.src.rpm
8fdad6a352014e9c95f6640896bf91dd  nss_ldap-226-17.src.rpm

i386:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm

ia64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
a8cc0cd2d3bd8f2fa916b8f50506dbfa  nss_ldap-226-17.ia64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
244bcce1538dc5537b860324b219ef3e  nss_ldap-debuginfo-226-17.ia64.rpm

x86_64:
f2728f30aeb7e78623aae9265fae7369  nss_ldap-226-17.i386.rpm
804dba9f8720306da14615b1f353e31d  nss_ldap-226-17.x86_64.rpm
93c6349f5bd8880e6be2af40e4edcda6  nss_ldap-debuginfo-226-17.i386.rpm
e4fd474865ccdfd5907047d6bd0ccdac  nss_ldap-debuginfo-226-17.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5170
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFFWyk/XlSAg2UNWIIRAkyNAKCEWyNMAVsLvxy6F2yusbmLnCMZXACghhQf
+qXzCNXztzj+LmKUHehw7pQ=
=fN3P
- -----END PGP SIGNATURE-----




2.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Low: openssh security update
Advisory ID:       RHSA-2006:0738-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0738.html
Issue date:        2006-11-15
Updated on:        2006-11-15
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-5794 
- - ---------------------------------------------------------------------

1. Summary:

Updated openssh packages that fix an authentication flaw are now available
for Red Hat Enterprise Linux 3 and 4.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

OpenSSH is OpenBSD's SSH (Secure SHell) protocol implementation. This
package includes the core files necessary for both the OpenSSH client and
server.

An authentication flaw was found in OpenSSH's privilege separation monitor.
If it ever becomes possible to alter the behavior of the unprivileged
process when OpenSSH is using privilege separation, an attacker may then be
able to login without possessing proper credentials. (CVE-2006-5794)

Please note that this flaw by itself poses no direct threat to OpenSSH
users. Without another security flaw that could allow an attacker to alter
the behavior of OpenSSH's unprivileged process, this flaw cannot be
exploited. There are currently no known flaws to exploit this behavior. 
However, we have decided to issue this erratum to fix this flaw to reduce
the security impact if an unprivileged process flaw is ever found.

Users of openssh should upgrade to these updated packages, which contain a
backported patch to resolve this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

214640 - CVE-2006-5794 OpenSSH privilege separation flaw

6. RPMs required:

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/openssh-3.6.1p2-33.30.13.src.rpm
b4e08619ea23f2af0429645d98639bd2  openssh-3.6.1p2-33.30.13.src.rpm

i386:
dcd132e60b59e7a7fd75ac15f55b7207  openssh-3.6.1p2-33.30.13.i386.rpm
f1e4ab33051a26303ecf5c8d0fa6d779  openssh-askpass-3.6.1p2-33.30.13.i386.rpm
7fe0c43c9178918e47af5b6cf7a53e50  openssh-askpass-gnome-3.6.1p2-33.30.13.i386.rpm
53cbe1ce4743e7986ec6ca28c61c4941  openssh-clients-3.6.1p2-33.30.13.i386.rpm
7379e0668f24d8e98352326d220bb7b4  openssh-debuginfo-3.6.1p2-33.30.13.i386.rpm
e067fb1660d69db52438fd942b18b238  openssh-server-3.6.1p2-33.30.13.i386.rpm

ia64:
908a742ccbce2dc3633094328135143d  openssh-3.6.1p2-33.30.13.ia64.rpm
3c81416cf2bb3e95a1df43cdb789f1d9  openssh-askpass-3.6.1p2-33.30.13.ia64.rpm
ec530b9aae551ad18982fd7c88ea46c5  openssh-askpass-gnome-3.6.1p2-33.30.13.ia64.rpm
21c01f4d6e41be485e0f4f0866c0bcab  openssh-clients-3.6.1p2-33.30.13.ia64.rpm
c2101a1d81e8dbd6fa5aa66907c55df1  openssh-debuginfo-3.6.1p2-33.30.13.ia64.rpm
52dc05f6756942bb9cd36d652c3e0cb2  openssh-server-3.6.1p2-33.30.13.ia64.rpm

ppc:
74d7a40819ac28ffe57b4d0358637aa5  openssh-3.6.1p2-33.30.13.ppc.rpm
fb1b5891efc8fb9db26f989b48f7df9f  openssh-askpass-3.6.1p2-33.30.13.ppc.rpm
30c4c779e67f9f140c1ba818d16b3389  openssh-askpass-gnome-3.6.1p2-33.30.13.ppc.rpm
42654616ea74a154c8ec943ce0c99ced  openssh-clients-3.6.1p2-33.30.13.ppc.rpm
9df1c1ed2d66127bf491c531f7b3a569  openssh-debuginfo-3.6.1p2-33.30.13.ppc.rpm
dfca8ed1c115ea29121a6a75852d32a7  openssh-server-3.6.1p2-33.30.13.ppc.rpm

s390:
047c99c9d1f0a8302f3c0a751da3f99a  openssh-3.6.1p2-33.30.13.s390.rpm
2dab72bc1e5f9f54b4e9caf201f9f617  openssh-askpass-3.6.1p2-33.30.13.s390.rpm
1dd2d0fdf4f8abf1b7fb839ff611dff1  openssh-askpass-gnome-3.6.1p2-33.30.13.s390.rpm
fda4dabc8b23e7f860766f8412b7abf7  openssh-clients-3.6.1p2-33.30.13.s390.rpm
78e29572db8ea19ed2e6fd06beb00d14  openssh-debuginfo-3.6.1p2-33.30.13.s390.rpm
fccc35c776978fe2654e7fbba3461dbf  openssh-server-3.6.1p2-33.30.13.s390.rpm

s390x:
e92b4ce6f01fca8daca17c7787253ce6  openssh-3.6.1p2-33.30.13.s390x.rpm
b600a2739c93ecdb6e43821d1bafe16f  openssh-askpass-3.6.1p2-33.30.13.s390x.rpm
56bb8de4d2423ee720bbfea87274a40e  openssh-askpass-gnome-3.6.1p2-33.30.13.s390x.rpm
5a4a37e51b6f7a0f36a698b5cc833628  openssh-clients-3.6.1p2-33.30.13.s390x.rpm
efbaa975735c2e28cc9063997c78f34d  openssh-debuginfo-3.6.1p2-33.30.13.s390x.rpm
518f3d002574064fe0401d724df50abd  openssh-server-3.6.1p2-33.30.13.s390x.rpm

x86_64:
881bb14daa2f11d4ccbf6b2479df1074  openssh-3.6.1p2-33.30.13.x86_64.rpm
52a84e68e0900fa418a61f72ddb1c531  openssh-askpass-3.6.1p2-33.30.13.x86_64.rpm
a621607fdbaafd4c58aa3627eeee5fe9  openssh-askpass-gnome-3.6.1p2-33.30.13.x86_64.rpm
84688b731d914ad46b35afb375aacd5f  openssh-clients-3.6.1p2-33.30.13.x86_64.rpm
8a459f09eaa33da0f400397bc7dedff2  openssh-debuginfo-3.6.1p2-33.30.13.x86_64.rpm
6e95eef8d383b8fe4f21dc64eebbd3cf  openssh-server-3.6.1p2-33.30.13.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/openssh-3.6.1p2-33.30.13.src.rpm
b4e08619ea23f2af0429645d98639bd2  openssh-3.6.1p2-33.30.13.src.rpm

i386:
dcd132e60b59e7a7fd75ac15f55b7207  openssh-3.6.1p2-33.30.13.i386.rpm
f1e4ab33051a26303ecf5c8d0fa6d779  openssh-askpass-3.6.1p2-33.30.13.i386.rpm
7fe0c43c9178918e47af5b6cf7a53e50  openssh-askpass-gnome-3.6.1p2-33.30.13.i386.rpm
53cbe1ce4743e7986ec6ca28c61c4941  openssh-clients-3.6.1p2-33.30.13.i386.rpm
7379e0668f24d8e98352326d220bb7b4  openssh-debuginfo-3.6.1p2-33.30.13.i386.rpm
e067fb1660d69db52438fd942b18b238  openssh-server-3.6.1p2-33.30.13.i386.rpm

x86_64:
881bb14daa2f11d4ccbf6b2479df1074  openssh-3.6.1p2-33.30.13.x86_64.rpm
52a84e68e0900fa418a61f72ddb1c531  openssh-askpass-3.6.1p2-33.30.13.x86_64.rpm
a621607fdbaafd4c58aa3627eeee5fe9  openssh-askpass-gnome-3.6.1p2-33.30.13.x86_64.rpm
84688b731d914ad46b35afb375aacd5f  openssh-clients-3.6.1p2-33.30.13.x86_64.rpm
8a459f09eaa33da0f400397bc7dedff2  openssh-debuginfo-3.6.1p2-33.30.13.x86_64.rpm
6e95eef8d383b8fe4f21dc64eebbd3cf  openssh-server-3.6.1p2-33.30.13.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/openssh-3.6.1p2-33.30.13.src.rpm
b4e08619ea23f2af0429645d98639bd2  openssh-3.6.1p2-33.30.13.src.rpm

i386:
dcd132e60b59e7a7fd75ac15f55b7207  openssh-3.6.1p2-33.30.13.i386.rpm
f1e4ab33051a26303ecf5c8d0fa6d779  openssh-askpass-3.6.1p2-33.30.13.i386.rpm
7fe0c43c9178918e47af5b6cf7a53e50  openssh-askpass-gnome-3.6.1p2-33.30.13.i386.rpm
53cbe1ce4743e7986ec6ca28c61c4941  openssh-clients-3.6.1p2-33.30.13.i386.rpm
7379e0668f24d8e98352326d220bb7b4  openssh-debuginfo-3.6.1p2-33.30.13.i386.rpm
e067fb1660d69db52438fd942b18b238  openssh-server-3.6.1p2-33.30.13.i386.rpm

ia64:
908a742ccbce2dc3633094328135143d  openssh-3.6.1p2-33.30.13.ia64.rpm
3c81416cf2bb3e95a1df43cdb789f1d9  openssh-askpass-3.6.1p2-33.30.13.ia64.rpm
ec530b9aae551ad18982fd7c88ea46c5  openssh-askpass-gnome-3.6.1p2-33.30.13.ia64.rpm
21c01f4d6e41be485e0f4f0866c0bcab  openssh-clients-3.6.1p2-33.30.13.ia64.rpm
c2101a1d81e8dbd6fa5aa66907c55df1  openssh-debuginfo-3.6.1p2-33.30.13.ia64.rpm
52dc05f6756942bb9cd36d652c3e0cb2  openssh-server-3.6.1p2-33.30.13.ia64.rpm

x86_64:
881bb14daa2f11d4ccbf6b2479df1074  openssh-3.6.1p2-33.30.13.x86_64.rpm
52a84e68e0900fa418a61f72ddb1c531  openssh-askpass-3.6.1p2-33.30.13.x86_64.rpm
a621607fdbaafd4c58aa3627eeee5fe9  openssh-askpass-gnome-3.6.1p2-33.30.13.x86_64.rpm
84688b731d914ad46b35afb375aacd5f  openssh-clients-3.6.1p2-33.30.13.x86_64.rpm
8a459f09eaa33da0f400397bc7dedff2  openssh-debuginfo-3.6.1p2-33.30.13.x86_64.rpm
6e95eef8d383b8fe4f21dc64eebbd3cf  openssh-server-3.6.1p2-33.30.13.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/openssh-3.6.1p2-33.30.13.src.rpm
b4e08619ea23f2af0429645d98639bd2  openssh-3.6.1p2-33.30.13.src.rpm

i386:
dcd132e60b59e7a7fd75ac15f55b7207  openssh-3.6.1p2-33.30.13.i386.rpm
f1e4ab33051a26303ecf5c8d0fa6d779  openssh-askpass-3.6.1p2-33.30.13.i386.rpm
7fe0c43c9178918e47af5b6cf7a53e50  openssh-askpass-gnome-3.6.1p2-33.30.13.i386.rpm
53cbe1ce4743e7986ec6ca28c61c4941  openssh-clients-3.6.1p2-33.30.13.i386.rpm
7379e0668f24d8e98352326d220bb7b4  openssh-debuginfo-3.6.1p2-33.30.13.i386.rpm
e067fb1660d69db52438fd942b18b238  openssh-server-3.6.1p2-33.30.13.i386.rpm

ia64:
908a742ccbce2dc3633094328135143d  openssh-3.6.1p2-33.30.13.ia64.rpm
3c81416cf2bb3e95a1df43cdb789f1d9  openssh-askpass-3.6.1p2-33.30.13.ia64.rpm
ec530b9aae551ad18982fd7c88ea46c5  openssh-askpass-gnome-3.6.1p2-33.30.13.ia64.rpm
21c01f4d6e41be485e0f4f0866c0bcab  openssh-clients-3.6.1p2-33.30.13.ia64.rpm
c2101a1d81e8dbd6fa5aa66907c55df1  openssh-debuginfo-3.6.1p2-33.30.13.ia64.rpm
52dc05f6756942bb9cd36d652c3e0cb2  openssh-server-3.6.1p2-33.30.13.ia64.rpm

x86_64:
881bb14daa2f11d4ccbf6b2479df1074  openssh-3.6.1p2-33.30.13.x86_64.rpm
52a84e68e0900fa418a61f72ddb1c531  openssh-askpass-3.6.1p2-33.30.13.x86_64.rpm
a621607fdbaafd4c58aa3627eeee5fe9  openssh-askpass-gnome-3.6.1p2-33.30.13.x86_64.rpm
84688b731d914ad46b35afb375aacd5f  openssh-clients-3.6.1p2-33.30.13.x86_64.rpm
8a459f09eaa33da0f400397bc7dedff2  openssh-debuginfo-3.6.1p2-33.30.13.x86_64.rpm
6e95eef8d383b8fe4f21dc64eebbd3cf  openssh-server-3.6.1p2-33.30.13.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.17.1.src.rpm
5270fb8ec13f23828a277857ae68b986  openssh-3.9p1-8.RHEL4.17.1.src.rpm

i386:
8b1c7fbd0bf72ceb0b2f5eda16d3fa5d  openssh-3.9p1-8.RHEL4.17.1.i386.rpm
79f74f20a37e5e5d9f88bfc80927d201  openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm
96db1c1a17e9348677f8d0eaf7d99116  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm
f349608f4e1e588f8c544564319f6388  openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm
a4f09849af54d40c51c399e07c7a424d  openssh-debuginfo-3.9p1-8.RHEL4.17.1.i386.rpm
2c021513b7f7d86783342293d0a229e0  openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm

ia64:
9f7af45fa7b5a5960dae6481797df65f  openssh-3.9p1-8.RHEL4.17.1.ia64.rpm
396afde30d013dc3b99473070c9ca016  openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm
05504a84c2ef6cd7eb50e8044d537733  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm
85931af336574b468781c5348c5be257  openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm
e6d2d155030f71bc215130d697041cee  openssh-debuginfo-3.9p1-8.RHEL4.17.1.ia64.rpm
90098e9f32a04b29e707cc0b3716d438  openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm

ppc:
2af4e90aa5c152ab51bae154ab54d69c  openssh-3.9p1-8.RHEL4.17.1.ppc.rpm
b6433ae6bb5b320b16b1970aaad929b1  openssh-askpass-3.9p1-8.RHEL4.17.1.ppc.rpm
246880b444305e3e2781ae06f6b0af4b  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ppc.rpm
c4cc7545bc8c4e68f9efc14cbee42069  openssh-clients-3.9p1-8.RHEL4.17.1.ppc.rpm
f24ca28950dee922c9c58c8610b7c8f4  openssh-debuginfo-3.9p1-8.RHEL4.17.1.ppc.rpm
0232045e1c230a1cb37ba40f44f4ec96  openssh-server-3.9p1-8.RHEL4.17.1.ppc.rpm

s390:
d3ca921e20d2ed9af35eaba73baa434d  openssh-3.9p1-8.RHEL4.17.1.s390.rpm
2bac8f50617955b5be6173b0b386f270  openssh-askpass-3.9p1-8.RHEL4.17.1.s390.rpm
f853497e2fb1124055b4d2bede7c56de  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.s390.rpm
fd1d9c9aaa84763fb1ad4d93df7da3df  openssh-clients-3.9p1-8.RHEL4.17.1.s390.rpm
cf451945401a2dd942bb7a697188df10  openssh-debuginfo-3.9p1-8.RHEL4.17.1.s390.rpm
81c1dfd0f611b7509e2d715e0dc005f0  openssh-server-3.9p1-8.RHEL4.17.1.s390.rpm

s390x:
79767ede8be763dab8cf825dfb203374  openssh-3.9p1-8.RHEL4.17.1.s390x.rpm
1e1891b117b67d9ae272fefa96f0b2df  openssh-askpass-3.9p1-8.RHEL4.17.1.s390x.rpm
5418dda31a691b7e1d86d367ae3e34cd  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.s390x.rpm
f239e3313b6f50a5c75e1ffe86ecfde1  openssh-clients-3.9p1-8.RHEL4.17.1.s390x.rpm
5f2caa775daf4d32e5fafc3fe26ee3f1  openssh-debuginfo-3.9p1-8.RHEL4.17.1.s390x.rpm
4d7d4015d1fa094b782079fcf046f887  openssh-server-3.9p1-8.RHEL4.17.1.s390x.rpm

x86_64:
0ce295c848385f2a25fa17ae7c0beb52  openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm
826459d7ddfb2b39e718cbb303f246bb  openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm
3d56f032c9ab9d15327173acad692f93  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm
7076713a1e1732e10a66be5dcdea4faa  openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm
1419e2d38ce536e89b80621deaa3abc1  openssh-debuginfo-3.9p1-8.RHEL4.17.1.x86_64.rpm
3a7c7aa5c2378ac7c2954ff17acfca19  openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/openssh-3.9p1-8.RHEL4.17.1.src.rpm
5270fb8ec13f23828a277857ae68b986  openssh-3.9p1-8.RHEL4.17.1.src.rpm

i386:
8b1c7fbd0bf72ceb0b2f5eda16d3fa5d  openssh-3.9p1-8.RHEL4.17.1.i386.rpm
79f74f20a37e5e5d9f88bfc80927d201  openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm
96db1c1a17e9348677f8d0eaf7d99116  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm
f349608f4e1e588f8c544564319f6388  openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm
a4f09849af54d40c51c399e07c7a424d  openssh-debuginfo-3.9p1-8.RHEL4.17.1.i386.rpm
2c021513b7f7d86783342293d0a229e0  openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm

x86_64:
0ce295c848385f2a25fa17ae7c0beb52  openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm
826459d7ddfb2b39e718cbb303f246bb  openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm
3d56f032c9ab9d15327173acad692f93  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm
7076713a1e1732e10a66be5dcdea4faa  openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm
1419e2d38ce536e89b80621deaa3abc1  openssh-debuginfo-3.9p1-8.RHEL4.17.1.x86_64.rpm
3a7c7aa5c2378ac7c2954ff17acfca19  openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/openssh-3.9p1-8.RHEL4.17.1.src.rpm
5270fb8ec13f23828a277857ae68b986  openssh-3.9p1-8.RHEL4.17.1.src.rpm

i386:
8b1c7fbd0bf72ceb0b2f5eda16d3fa5d  openssh-3.9p1-8.RHEL4.17.1.i386.rpm
79f74f20a37e5e5d9f88bfc80927d201  openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm
96db1c1a17e9348677f8d0eaf7d99116  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm
f349608f4e1e588f8c544564319f6388  openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm
a4f09849af54d40c51c399e07c7a424d  openssh-debuginfo-3.9p1-8.RHEL4.17.1.i386.rpm
2c021513b7f7d86783342293d0a229e0  openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm

ia64:
9f7af45fa7b5a5960dae6481797df65f  openssh-3.9p1-8.RHEL4.17.1.ia64.rpm
396afde30d013dc3b99473070c9ca016  openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm
05504a84c2ef6cd7eb50e8044d537733  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm
85931af336574b468781c5348c5be257  openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm
e6d2d155030f71bc215130d697041cee  openssh-debuginfo-3.9p1-8.RHEL4.17.1.ia64.rpm
90098e9f32a04b29e707cc0b3716d438  openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm

x86_64:
0ce295c848385f2a25fa17ae7c0beb52  openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm
826459d7ddfb2b39e718cbb303f246bb  openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm
3d56f032c9ab9d15327173acad692f93  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm
7076713a1e1732e10a66be5dcdea4faa  openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm
1419e2d38ce536e89b80621deaa3abc1  openssh-debuginfo-3.9p1-8.RHEL4.17.1.x86_64.rpm
3a7c7aa5c2378ac7c2954ff17acfca19  openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/openssh-3.9p1-8.RHEL4.17.1.src.rpm
5270fb8ec13f23828a277857ae68b986  openssh-3.9p1-8.RHEL4.17.1.src.rpm

i386:
8b1c7fbd0bf72ceb0b2f5eda16d3fa5d  openssh-3.9p1-8.RHEL4.17.1.i386.rpm
79f74f20a37e5e5d9f88bfc80927d201  openssh-askpass-3.9p1-8.RHEL4.17.1.i386.rpm
96db1c1a17e9348677f8d0eaf7d99116  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.i386.rpm
f349608f4e1e588f8c544564319f6388  openssh-clients-3.9p1-8.RHEL4.17.1.i386.rpm
a4f09849af54d40c51c399e07c7a424d  openssh-debuginfo-3.9p1-8.RHEL4.17.1.i386.rpm
2c021513b7f7d86783342293d0a229e0  openssh-server-3.9p1-8.RHEL4.17.1.i386.rpm

ia64:
9f7af45fa7b5a5960dae6481797df65f  openssh-3.9p1-8.RHEL4.17.1.ia64.rpm
396afde30d013dc3b99473070c9ca016  openssh-askpass-3.9p1-8.RHEL4.17.1.ia64.rpm
05504a84c2ef6cd7eb50e8044d537733  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.ia64.rpm
85931af336574b468781c5348c5be257  openssh-clients-3.9p1-8.RHEL4.17.1.ia64.rpm
e6d2d155030f71bc215130d697041cee  openssh-debuginfo-3.9p1-8.RHEL4.17.1.ia64.rpm
90098e9f32a04b29e707cc0b3716d438  openssh-server-3.9p1-8.RHEL4.17.1.ia64.rpm

x86_64:
0ce295c848385f2a25fa17ae7c0beb52  openssh-3.9p1-8.RHEL4.17.1.x86_64.rpm
826459d7ddfb2b39e718cbb303f246bb  openssh-askpass-3.9p1-8.RHEL4.17.1.x86_64.rpm
3d56f032c9ab9d15327173acad692f93  openssh-askpass-gnome-3.9p1-8.RHEL4.17.1.x86_64.rpm
7076713a1e1732e10a66be5dcdea4faa  openssh-clients-3.9p1-8.RHEL4.17.1.x86_64.rpm
1419e2d38ce536e89b80621deaa3abc1  openssh-debuginfo-3.9p1-8.RHEL4.17.1.x86_64.rpm
3a7c7aa5c2378ac7c2954ff17acfca19  openssh-server-3.9p1-8.RHEL4.17.1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5794
http://www.redhat.com/security/updates/classification/#low

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFFWylWXlSAg2UNWIIRArrZAJ9gyhNfG6jBy5vKzhoHzfly2QWl1gCcC5GA
aJX3No+Hlx2jlvbTWvsJmes=
=ZONu
- -----END PGP SIGNATURE-----



3.


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Critical: elinks security update
Advisory ID:       RHSA-2006:0742-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2006-0742.html
Issue date:        2006-11-15
Updated on:        2006-11-15
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2006-5925 
- - ---------------------------------------------------------------------

1. Summary:

An updated elinks package that corrects a security vulnerability is now
available for Red Hat Enterprise Linux 4.

This update has been rated as having critical security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Elinks is a text mode Web browser used from the command line that supports
rendering modern web pages.

An arbitrary file access flaw was found in the Elinks SMB protocol handler.
A malicious web page could have caused Elinks to read or write files with
the permissions of the user running Elinks. (CVE-2006-5925)

All users of Elinks are advised to upgrade to this updated package, which
resolves this issue by removing support for the SMB protocol from Elinks.

Note: this issue did not affect the Elinks package shipped with Red Hat
Enterprise Linux 3, or the Links package shipped with Red Hat Enterprise
Linux 2.1.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

215731 - CVE-2006-5925 elinks smb protocol arbitrary file access

6. RPMs required:

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/elinks-0.9.2-3.3.src.rpm
643211bd98a9d92223bedbc69f71d68c  elinks-0.9.2-3.3.src.rpm

i386:
700134005525634e35dc940cd6d7c843  elinks-0.9.2-3.3.i386.rpm
6f6e5705ae2364733702c9b7b5e8c2ff  elinks-debuginfo-0.9.2-3.3.i386.rpm

ia64:
15eac414d532897f4da1ecb0063768a7  elinks-0.9.2-3.3.ia64.rpm
e9d176e583deb37e34487af2d794ca8f  elinks-debuginfo-0.9.2-3.3.ia64.rpm

ppc:
39d20a380d0d55d6d9ac40d89e389392  elinks-0.9.2-3.3.ppc.rpm
d9980fe0a60b2889ca6dbb00a2a71a3b  elinks-debuginfo-0.9.2-3.3.ppc.rpm

s390:
3fe1f629f197048d770e327f1b5ca923  elinks-0.9.2-3.3.s390.rpm
a4ae0a0dfa968b7dd9ac67a4c511440f  elinks-debuginfo-0.9.2-3.3.s390.rpm

s390x:
5c5129455dfbd5318477b1fc32421bb6  elinks-0.9.2-3.3.s390x.rpm
14c9a759ed58fc3ea25893aec3bdfae1  elinks-debuginfo-0.9.2-3.3.s390x.rpm

x86_64:
c9058b064da38141780a52ae4d429709  elinks-0.9.2-3.3.x86_64.rpm
695ae2d149930b299c04dbd822c45e24  elinks-debuginfo-0.9.2-3.3.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/elinks-0.9.2-3.3.src.rpm
643211bd98a9d92223bedbc69f71d68c  elinks-0.9.2-3.3.src.rpm

i386:
700134005525634e35dc940cd6d7c843  elinks-0.9.2-3.3.i386.rpm
6f6e5705ae2364733702c9b7b5e8c2ff  elinks-debuginfo-0.9.2-3.3.i386.rpm

x86_64:
c9058b064da38141780a52ae4d429709  elinks-0.9.2-3.3.x86_64.rpm
695ae2d149930b299c04dbd822c45e24  elinks-debuginfo-0.9.2-3.3.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/elinks-0.9.2-3.3.src.rpm
643211bd98a9d92223bedbc69f71d68c  elinks-0.9.2-3.3.src.rpm

i386:
700134005525634e35dc940cd6d7c843  elinks-0.9.2-3.3.i386.rpm
6f6e5705ae2364733702c9b7b5e8c2ff  elinks-debuginfo-0.9.2-3.3.i386.rpm

ia64:
15eac414d532897f4da1ecb0063768a7  elinks-0.9.2-3.3.ia64.rpm
e9d176e583deb37e34487af2d794ca8f  elinks-debuginfo-0.9.2-3.3.ia64.rpm

x86_64:
c9058b064da38141780a52ae4d429709  elinks-0.9.2-3.3.x86_64.rpm
695ae2d149930b299c04dbd822c45e24  elinks-debuginfo-0.9.2-3.3.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/elinks-0.9.2-3.3.src.rpm
643211bd98a9d92223bedbc69f71d68c  elinks-0.9.2-3.3.src.rpm

i386:
700134005525634e35dc940cd6d7c843  elinks-0.9.2-3.3.i386.rpm
6f6e5705ae2364733702c9b7b5e8c2ff  elinks-debuginfo-0.9.2-3.3.i386.rpm

ia64:
15eac414d532897f4da1ecb0063768a7  elinks-0.9.2-3.3.ia64.rpm
e9d176e583deb37e34487af2d794ca8f  elinks-debuginfo-0.9.2-3.3.ia64.rpm

x86_64:
c9058b064da38141780a52ae4d429709  elinks-0.9.2-3.3.x86_64.rpm
695ae2d149930b299c04dbd822c45e24  elinks-debuginfo-0.9.2-3.3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5925
http://marc.theaimsgroup.com/?&m=116355556512780
http://www.redhat.com/security/updates/classification/#critical

8. Contact:

The Red Hat security contact is <secalert@xxxxxxxxxx>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2006 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFFW3b1XlSAg2UNWIIRAoZkAJwMszcO14arlklDMUnKABza7Hc9sgCdFwaT
t0KrlF5iGmxRXDAoJk4ot7U=
=SnP0
- -----END PGP SIGNATURE-----



______________________________________________________________________________

NISCC values your feedback.

1. Which of the following most reflects the value of the briefing to you?
(Place an 'X' next to your choice)

Very useful:__ Useful:__ Not useful:__ 

2. If you did not find it useful, why not?


3. Any other comments? How could we improve our briefings?


Thank you for your contribution.
______________________________________________________________________________

For additional information or assistance, please contact our help desk
by telephone.  You may send Not Protectively Marked information via
e-mail to uniras@xxxxxxxxxxxxx

Office hours:

Mon - Fri: 08:30 - 17:00 hours
Tel: +44 (0) 870 487 0748 and follow the voice prompts
Fax: +44 (0) 870 487 0749

On-call duty officer outside office hours:
Tel: +44 (0) 870 487 0748 and follow the voice prompts

______________________________________________________________________________

UNIRAS wishes to acknowledge the contributions of Red Hat for the
information contained in this briefing.
______________________________________________________________________________

This notice contains information released by the original author.
Some of the information may have changed since it was released. If the
vulnerability affects you, it may be prudent to retrieve the advisory
from the site of the original source to ensure that you receive the most
current information concerning that problem.

Reference to any specific commercial product, process, or service by
trade name, trademark manufacturer, or otherwise, does not constitute or
imply its endorsement, recommendation, or favouring by UNIRAS or NISCC.
The views and opinions of authors expressed within this notice shall not
be used for advertising or product endorsement purposes.

Neither UNIRAS or NISCC shall also accept responsibility for any errors
or omissions contained within this briefing notice. In particular, they
shall not be liable for any loss or damage whatsoever, arising from or
in connection with the usage of information contained within this
notice.

UNIRAS is a member of the Forum of Incident Response and Security Teams
(FIRST) and has contacts with other international Incident Response
Teams (IRTs) in order to foster cooperation and coordination in incident
prevention, to prompt rapid reaction to incidents, and to promote
information sharing amongst its members and the community at large.
______________________________________________________________________________

<End of UNIRAS Briefing>

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.1

iQA/AwUBRVxwgml7oeQsXfKvEQInugCdEjtx+ZW5S3Yq8Mg7UHNFl7IZmKUAn0Ir
taw8swrK0f/057gOxduSrRqG
=OeLA
-----END PGP SIGNATURE-----


______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________

______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email 
______________________________________________________________________