-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:114
http://www.mandriva.com/security/
_______________________________________________________________________
Package : file
Date : June 5, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0,
Multi Network Firewall 2.0
_______________________________________________________________________
Problem Description:
The update to correct CVE-2007-1536 (MDKSA-2007:067), a buffer overflow
in the file_printf() function, introduced a new integer overflow as
reported by Colin Percival. This flaw, if an atacker could trick a
user into running file on a specially crafted file, could possibly
lead to the execution of arbitrary code with the privileges of the
user running file (CVE-2007-2799).
As well, in file 4.20, flawed regular expressions to identify OS/2
REXX files could lead to a denial of service via CPU consumption
(CVE-2007-2026).
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2026
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2799
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
3da3923de6da550bab34801eef616c65 2007.0/i586/file-4.17-2.2mdv2007.0.i586.rpm
cdda9efd3b6b29b3bd959c27b9b4ff45 2007.0/i586/libmagic1-4.17-2.2mdv2007.0.i586.rpm
7a7639ae8578d60800a3606ea7846046 2007.0/i586/libmagic1-devel-4.17-2.2mdv2007.0.i586.rpm
b88d355059a7abaa684ca4ccd2902f5e 2007.0/i586/libmagic1-static-devel-4.17-2.2mdv2007.0.i586.rpm
8be4b2fc01aae6687cea3d32bf13adec 2007.0/i586/python-magic-4.17-2.2mdv2007.0.i586.rpm
0faac11bd3ceb07623dcc538259b4920 2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
7b236e74e29e7322a63db012508f4ff7 2007.0/x86_64/file-4.17-2.2mdv2007.0.x86_64.rpm
c9ee191afb3c4f13989aecc4c0550a64 2007.0/x86_64/lib64magic1-4.17-2.2mdv2007.0.x86_64.rpm
895f9822301c950fa52b34a8f1e6458d 2007.0/x86_64/lib64magic1-devel-4.17-2.2mdv2007.0.x86_64.rpm
a667f8207f61a7407ad3434e779cd2a3 2007.0/x86_64/lib64magic1-static-devel-4.17-2.2mdv2007.0.x86_64.rpm
87b499c21853acc87c968c6a24a5f0d4 2007.0/x86_64/python-magic-4.17-2.2mdv2007.0.x86_64.rpm
0faac11bd3ceb07623dcc538259b4920 2007.0/SRPMS/file-4.17-2.2mdv2007.0.src.rpm
Mandriva Linux 2007.1:
0f340f48900656e4d393c26f41cfd24a 2007.1/i586/file-4.20-1.1mdv2007.1.i586.rpm
d690cf39a2b9d4bce78eb3ba76f89034 2007.1/i586/libmagic1-4.20-1.1mdv2007.1.i586.rpm
adf38bdec1118a46cbc8063cd1c87bfd 2007.1/i586/libmagic1-devel-4.20-1.1mdv2007.1.i586.rpm
7f650e75b6bcbfee83f356e6a39f5d8b 2007.1/i586/libmagic1-static-devel-4.20-1.1mdv2007.1.i586.rpm
d5556e8963b4f8e3750a8c2b4844f3cb 2007.1/i586/python-magic-4.20-1.1mdv2007.1.i586.rpm
4335066ac789ab04b344be24e80f26c7 2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
649ff715c11ed4de3233ac50f1cf0773 2007.1/x86_64/file-4.20-1.1mdv2007.1.x86_64.rpm
a5c7e2604290b2523288614191ecb153 2007.1/x86_64/lib64magic1-4.20-1.1mdv2007.1.x86_64.rpm
239042ad851510f9e66e3c03067e3129 2007.1/x86_64/lib64magic1-devel-4.20-1.1mdv2007.1.x86_64.rpm
a8597d9708ea995c85ae640b468ed43a 2007.1/x86_64/lib64magic1-static-devel-4.20-1.1mdv2007.1.x86_64.rpm
f13b9cb6c65c4247a66a18b32f02a253 2007.1/x86_64/python-magic-4.20-1.1mdv2007.1.x86_64.rpm
4335066ac789ab04b344be24e80f26c7 2007.1/SRPMS/file-4.20-1.1mdv2007.1.src.rpm
Corporate 3.0:
1df48d0c9911aa0bb1ffd7cd6541841a corporate/3.0/i586/file-4.07-3.2.C30mdk.i586.rpm
a874520fc37514088e859482cecc1e74 corporate/3.0/i586/libmagic1-4.07-3.2.C30mdk.i586.rpm
45f463521c4a48a6fe5a94af29c0bf08 corporate/3.0/i586/libmagic1-devel-4.07-3.2.C30mdk.i586.rpm
8d2c8f7eafc9a606913c0d4ec5e4398c corporate/3.0/i586/libmagic1-static-devel-4.07-3.2.C30mdk.i586.rpm
f3f6d9560bd1ef14795abec51391e776 corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm
Corporate 3.0/X86_64:
554baaf5942ac5e533e72812394fc6ec corporate/3.0/x86_64/file-4.07-3.2.C30mdk.x86_64.rpm
5880184431f8918886543337a43f19d5 corporate/3.0/x86_64/lib64magic1-4.07-3.2.C30mdk.x86_64.rpm
a1c8b2cd7a721e1429f3a4cd855b0235 corporate/3.0/x86_64/lib64magic1-devel-4.07-3.2.C30mdk.x86_64.rpm
b56eba4a34a18ea5df00a1bfbd103b91 corporate/3.0/x86_64/lib64magic1-static-devel-4.07-3.2.C30mdk.x86_64.rpm
f3f6d9560bd1ef14795abec51391e776 corporate/3.0/SRPMS/file-4.07-3.2.C30mdk.src.rpm
Corporate 4.0:
0a2f24f69b886df7c5439dd4726bae7a corporate/4.0/i586/file-4.14-2.3.20060mlcs4.i586.rpm
cf7484c68d78b2888290ed83ca69b2f7 corporate/4.0/i586/libmagic1-4.14-2.3.20060mlcs4.i586.rpm
4f71702b0528d8cb8f3a999043a37b60 corporate/4.0/i586/libmagic1-devel-4.14-2.3.20060mlcs4.i586.rpm
05d475851788a7e2c1e2ff0ae1bf783e corporate/4.0/i586/libmagic1-static-devel-4.14-2.3.20060mlcs4.i586.rpm
f23dc6744da226429ea647881c10e253 corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
60519ec0a662cfd9501527b1476595d7 corporate/4.0/x86_64/file-4.14-2.3.20060mlcs4.x86_64.rpm
96b1ce3bf2e2b45ff51ab6c83f9e41c8 corporate/4.0/x86_64/lib64magic1-4.14-2.3.20060mlcs4.x86_64.rpm
5d167574eb45cdea383ce87ea933fa9e corporate/4.0/x86_64/lib64magic1-devel-4.14-2.3.20060mlcs4.x86_64.rpm
bb4bba87454e9c9d098e68ededde68af corporate/4.0/x86_64/lib64magic1-static-devel-4.14-2.3.20060mlcs4.x86_64.rpm
f23dc6744da226429ea647881c10e253 corporate/4.0/SRPMS/file-4.14-2.3.20060mlcs4.src.rpm
Multi Network Firewall 2.0:
9186aca370a3692ac9552e43e4eecc9f mnf/2.0/i586/file-4.07-3.2.M20mdk.i586.rpm
595a5d6433d2adbcb068de6c8076411b mnf/2.0/i586/libmagic1-4.07-3.2.M20mdk.i586.rpm
2197334faacdf1e24067cd02e8dec993 mnf/2.0/SRPMS/file-4.07-3.2.M20mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGZcJpmqjQ0CJFipgRAt3hAKCUKl739wcB+BbX/V/jSiNi4zh5agCfSl76
12rwbbkfYa/z/vdUPZDNkU4=
=d33Q
-----END PGP SIGNATURE-----
