Synopsis: Updated WindowMaker packages fix vulnerability in theme-loading
Advisory ID: RHSA-2003:009-03
Issue date: 2003-01-07
Updated on: 2003-06-19
Product: Red Hat Enterprise Linux
Keywords: WindowMaker wmaker theme flaw:buf
Cross references: RHSA-2002:279
Obsoletes:
CVE Names:
CAN-2002-1277
- ---------------------------------------------------------------------
1. Topic:
Updated packages are available to fix a vulnerability in Window Maker.
[Updated 06 Feb 2003]
Fixed packages for Advanced Workstation 2.1 have been added.
[Updated 31 Mar 2003]
New erratum packages are available to fix a bug in the original security
patch.
[Updated 18 Jun 2003]
The last update did not include the Advanced Workstation 2.1 packages,
these have now been added back.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
3. Problem description:
Window Maker is an X11 window manager that emulates the look and feel
of the NeXTSTEP graphical user interface.
Al Viro found a buffer overflow in Window Maker 0.80.0 and earlier which
may allow remote attackers to execute arbitrary code through a certain
image file that is not properly handled when Window Maker uses width and
height information to allocate a buffer. A user can exploit this
vulnerability, for example, by opening a malicious theme.
Users of Window Maker are advised to upgrade to these updated packages
which contain a patch to correct this vulnerability.
4. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.
5. Bug IDs fixed (
http://bugzilla.redhat.com/bugzilla for more info):
81266 - Al Viro found a buffer overflow in Window Maker
86077 - updated WindowMaker messes up title bar
6. RPMs required:
Red Hat Enterprise Linux AS (Advanced Server) version 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/WindowMaker-0.65.1-4.2.src.rpm
i386:
Available from Red Hat Network: WindowMaker-0.65.1-4.2.i386.rpm
Available from Red Hat Network: WindowMaker-libs-0.65.1-4.2.i386.rpm
ia64:
Available from Red Hat Network: WindowMaker-0.65.1-4.2.ia64.rpm
Available from Red Hat Network: WindowMaker-libs-0.65.1-4.2.ia64.rpm
Red Hat Linux Advanced Workstation 2.1:
SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/WindowMaker-0.65.1-4.2.src.rpm
ia64:
Available from Red Hat Network: WindowMaker-0.65.1-4.2.ia64.rpm
Available from Red Hat Network: WindowMaker-libs-0.65.1-4.2.ia64.rpm
7. Verification:
MD5 sum Package Name
- --------------------------------------------------------------------------
c81326cf2bf1ed00968f60842225ffc4 2.1AS/en/os/SRPMS/WindowMaker-0.65.1-4.2.src.rpm
1cf969b59251094843f235a759e09b8f 2.1AS/en/os/i386/WindowMaker-0.65.1-4.2.i386.rpm
646a3270b0539eee6c0467e9365a2667 2.1AS/en/os/i386/WindowMaker-libs-0.65.1-4.2.i386.rpm
478b8828775158e5be177425b9fdb954 2.1AS/en/os/ia64/WindowMaker-0.65.1-4.2.ia64.rpm
bc4b5e3167c4b158773efcc06bc54ae1 2.1AS/en/os/ia64/WindowMaker-libs-0.65.1-4.2.ia64.rpm
c81326cf2bf1ed00968f60842225ffc4 2.1AW/en/os/SRPMS/WindowMaker-0.65.1-4.2.src.rpm
478b8828775158e5be177425b9fdb954 2.1AW/en/os/ia64/WindowMaker-0.65.1-4.2.ia64.rpm
bc4b5e3167c4b158773efcc06bc54ae1 2.1AW/en/os/ia64/WindowMaker-libs-0.65.1-4.2.ia64.rpm
These packages are GPG signed by Red Hat for security. Our key is
available from
http://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
md5sum <filename>
8. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=
CAN-2002-1277
9. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at
http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE+8bEYXlSAg2UNWIIRAoU9AJ96C2b1ucjTvX0gztftSitntviuFQCfb5U/
/1cWmZonou4Orh52TVLIp7w=
=8Yo7
-----END PGP SIGNATURE-----
