RedHat: Low: slocate security update RHSA-2005:747-02
Summary
Summary
Slocate is a security-enhanced version of locate. Like locate, slocate searches through a nightly-updated central database for files that match a given pattern. A bug was found in the way slocate processes very long paths. A local user could create a carefully crafted directory structure that would prevent updatedb from completing its file system scan, resulting in an incomplete slocate database. The Common Vulnerabilities and Exposures project has assigned the name CAN-2005-2499 to this issue. Users are advised to upgrade to this updated package, which includes a backported patch to resolve this issue.
Solution
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
165430 - CAN-2005-2499 slocate DOS
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
48bc2399648a71b9cdc6f7eee3457f5c slocate-2.7-1.el2.1.src.rpm
i386:
422f42516805c04797c817a4e8c4d333 slocate-2.7-1.el2.1.i386.rpm
ia64:
68f823b854a10eec8a180b05cca7a240 slocate-2.7-1.el2.1.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
48bc2399648a71b9cdc6f7eee3457f5c slocate-2.7-1.el2.1.src.rpm
ia64:
68f823b854a10eec8a180b05cca7a240 slocate-2.7-1.el2.1.ia64.rpm
Red Hat Enterprise Linux ES version 2.1:
SRPMS:
48bc2399648a71b9cdc6f7eee3457f5c slocate-2.7-1.el2.1.src.rpm
i386:
422f42516805c04797c817a4e8c4d333 slocate-2.7-1.el2.1.i386.rpm
Red Hat Enterprise Linux WS version 2.1:
SRPMS:
48bc2399648a71b9cdc6f7eee3457f5c slocate-2.7-1.el2.1.src.rpm
i386:
422f42516805c04797c817a4e8c4d333 slocate-2.7-1.el2.1.i386.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2499
Package List
Topic
Topic
Relevant Releases Architectures
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Bugs Fixed