[Security Announce] [ MDVSA-2008:214 ] mon

[news 28]

This is a multi-part message in MIME format...

 

------------=_1224187210-14940-826

 

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

_______________________________________________________________________

 

Mandriva Linux Security Advisory MDVSA-2008:214

http://www.mandriva.com/security/

_______________________________________________________________________

 

Package : mon

Date : October 16, 2008

Affected: Corporate 3.0

_______________________________________________________________________

 

Problem Description:

 

Dmitry E. Oboukhov found that the test.alert script used in one of

the alert functions in mon created temporary files insecurely, which

could lead to a local denial of service or arbitrary file overwrite

via a symlink attack (CVE-2008-4477).

 

The updated packages have been patched to prevent this issue.

_______________________________________________________________________

 

References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4477

_______________________________________________________________________

 

Updated Packages:

 

Corporate 3.0:

876ccdda7a9bb7c15a748ddbd0c309d8 corporate/3.0/i586/mon-0.99.2-4.1.C30mdk.i586.rpm

d08d7841919e4deaba2ac741ac7bce85 corporate/3.0/SRPMS/mon-0.99.2-4.1.C30mdk.src.rpm

 

Corporate 3.0/X86_64:

4e9cd4af947483a388c192b903fcac40 corporate/3.0/x86_64/mon-0.99.2-4.1.C30mdk.x86_64.rpm

d08d7841919e4deaba2ac741ac7bce85 corporate/3.0/SRPMS/mon-0.99.2-4.1.C30mdk.src.rpm

_______________________________________________________________________

 

To upgrade automatically use MandrivaUpdate or urpmi. The verification

of md5 checksums and GPG signatures is performed automatically for you.

 

All packages are signed by Mandriva for security. You can obtain the

GPG public key of the Mandriva Security Team by executing:

 

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 

You can view other update advisories for Mandriva Linux at:

 

http://www.mandriva.com/security/advisories

 

If you want to report vulnerabilities, please contact

 

security_(at)_mandriva.com

_______________________________________________________________________

 

Type Bits/KeyID Date User ID

pub 1024D/22458A98 2000-07-10 Mandriva Security Team

 

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (GNU/Linux)

 

iD8DBQFI93LgmqjQ0CJFipgRAjIaAKDSlX9DTXaS7pT47+WjNSbvLLBcUQCglilH

PFde0HHL3kTMyT93wXWWGm0=

=wdcc

-----END PGP SIGNATURE-----

 

 

------------=_1224187210-14940-826

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit

 

To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva?

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________

 

------------=_1224187210-14940-826--