[RHSA-2000:016-03] Multiple local imwheel vulnerabilities (fwd)

[Gunnar Wolf <gwolf en campus iztacala unam mx>]

-------------------------------------------------------------------
           Gunnar Wolf    gwolf en campus iztacala unam mx
     Universidad Nacional Autónoma de México, Campus Iztacala
   Jefatura de Sección de Desarrollo y Admon. de Sistemas en Red
        Area de Seguridad en Computo - DCI - DGSCA - UNAM
-------------------------------------------------------------------
  Beginner thinks 1Kb == 1000 bytes.   Master knows 1Km == 1024m

---------- Forwarded message ----------
Date: Tue, 4 Jul 2000 00:03 -0400
From: bugzilla en redhat com
Reply-To: redhat-watch-list en redhat com
To: redhat-watch-list en redhat com
Cc: linux-security en redhat com, bugtraq en securityfocus com
Subject: [RHSA-2000:016-03] Multiple local imwheel vulnerabilities
Resent-Date: 4 Jul 2000 04:08:21 -0000
Resent-From: redhat-watch-list en redhat com
Resent-cc: recipient list not shown: ;

---------------------------------------------------------------------
                   Red Hat, Inc. Security Advisory

Synopsis:          Multiple local imwheel vulnerabilities
Advisory ID:       RHSA-2000:016-03
Issue date:        2000-04-20
Updated on:        2000-07-03
Product:           Red Hat Powertools
Keywords:          imwheel buffer imwheel-solo
Cross references:  N/A
---------------------------------------------------------------------

1. Topic:

Multiple vulnerabilities exist in imwheel.

2. Relevant releases/architectures:

Red Hat Powertools 6.1 - i386 alpha sparc
Red Hat Powertools 6.2 - i386 alpha sparc

3. Problem description:

Multiple local vulnerabilities exist in imwheel.

* Read access violations where there is no checking of the file
  itself, it follows a symlink blindly.

* Perl wrapper might allow other users on the machine to kill
  the imwheel process.

4. Solution:

Because the core functionality of imwheel has been incorporated
into many existing applications, removing imwheel will not
incur a significant loss of functionality.

If the machine which has imwheel installed is not a single user
machine we recommend removing imwheel. To remove imwheel run
this command:

rpm -e imwheel

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

N/A

6. RPMs required:

N/A

7. Verification:

MD5 sum                           Package Name
--------------------------------------------------------------------------
N/A

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/corp/contact.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

N/A




-- 
         To unsubscribe: mail redhat-watch-list-request en redhat com with 
                       "unsubscribe" as the Subject.


-- 
Para desuscribirse, mande correo a: ayuda-unsubscribe en linux org mx
Para comandos adicionales, envíelo a: ayuda-help en linux org mx