AnNyung 1.3 Update Notice

samba 보안 업데이트

김정균 — Sun, 21 Oct 2012 01:04:34 +0900

samba 보안 업데이트


상세내용

- 버그 픽스
  #532094 - Fix credentials file handling for mount.cifs.
  #559609 - Avoid enumeration of trusted domains when "allow trusted domains = no"
  #467775 - Allow to switch off krb5.conf creation
  #493962 - Fix POSIX open
  #562836 - Fix mtab locking in mount.cifs
  #585360 - Fix Windows Server 2008 R2 support
  #518785 - Fix unclean update issues when restorecon is unavailable

- 보안 버그 픽스
  #602319 - Security Release, fixes CVE-2010-2063
  #632226 - Security Release, fixes CVE-2010-3069
  #678329 - Security Release, fixes CVE-2011-0719
  #722551 - Security Release, fixes CVE-2011-0547, CVE-2011-2694, CVE-2011-2522
  #722551 - Add security fix also for CVE-2010-0787, CVE-2011-1678
  #722551 - Add security fix also for CVE-2011-2724
  #795717 - Security release, fixes CVE-2012-0870
  #812010 - Security Release, fixes CVE-2012-1182


Autoupdates 지원 : Packages System
    pkgadd -F "samba*"


update 패키지

  RPMS :

    . samba-common-3.0.33-3.36.el4.i686.rpm
    . samba-3.0.33-3.36.el4.i686.rpm
    . samba-clients-3.0.33-3.36.el4.i686.rpm
    . samba-swat-3.0.33-3.36.el4.i686.rpm

  SRPMS :

    . samba-3.0.33-3.36.el4.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2063
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3069
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0719
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0547
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2694
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2522
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0787
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1678
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2724
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0870
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1182

openssl097 보안 업데이트

김정균 — Sun, 21 Oct 2012 00:32:01 +0900

openssl097 보안 업데이트


상세내용

openssl097a 패키지는 openssl 0.9.7 library 를 link 하도록 빌드된
바이너리나 openssl 0.9.7 을 요구하는 빌드환경을 위하여 제공되는
호환 라이브러리 입니다.

이 라이브러리를 이용하여 빌드를 할 경우에는 다음의 사항을 주의해야
합니다.

이 라이브러리는 RHEL 4 의 openssl 0.9.7a-43.18.el4 를 이용하여 작성이 되었
습니다.

1. header file include 시..
   #include <openssl/xxx.h> 를 #include <openssl097a/xxx.h> 로 수정해야
   합니다.

2. library 링크시..
   -lssl 이나 -lcrypto 의 경우 -lssl097a 나 -lcrypto097a 로 수정해서 빌드
   해야 합니다.

Security fix
- CVE-2009-3245
- CVE-2010-4180
- CVE-2011-4619
- CVE-2011-4576

. CVE-2009-3245
OpenSSL before 0.9.8m does not check for a NULL return value from
bn_wexpand function calls in (1) crypto/bn/bn_div.c,
(2) crypto/bn/bn_gf2m.c, (3) crypto/ec/ec2_smpl.c, and
(4) engines/e_ubsec.c, which has unspecified impact and
context-dependent attack vectors.

. CVE-2010-4180
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when
SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly
prevent modification of the ciphersuite in the session cache, which
allows remote attackers to force the downgrade to an unintended cipher
via vectors involving sniffing network traffic to discover a session
identifier.

. CVE-2011-4619
The Server Gated Cryptography (SGC) implementation in OpenSSL before
0.9.8s and 1.x before 1.0.0f does not properly handle handshake
restarts, which allows remote attackers to cause a denial of service
via unspecified vectors.

. CVE-2011-4576
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before
1.0.0f does not properly initialize data structures for block cipher
padding, which might allow remote attackers to obtain sensitive
information by decrypting the padding data sent by an SSL peer.


Autoupdates 지원 : 지원
  pkgsysupdate


update 패키지

  RPMS :

    . openssl097a-0.9.7a-43.18.el4.noarch.rpm
    . openssl097a-devel-0.9.7a-43.18.el4.noarch.rpm
    . openssl097a-doc-0.9.7a-43.18.el4.noarch.rpm


  SRPMS :

    . openssl097a-0.9.7a-43.18.el4.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4180
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4619
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4576

net-snmp 업데이트

김정균 — Sat, 20 Oct 2012 23:14:55 +0900

net-snmp 업데이트


상세내용

* 버그 수정
- fixed reading of mib files with empty /usr/share/snmp/mibs/.index file
- fixed snmptrapd showing "" instead of address of remote agent (#745431)
- fixed SELinux context of /usr/share/snmp/mibs/.index file (#663879)
- fix IF-MIB::ifSpeed of inactive interfaces (#487261)
- fix sending of linkUp and linkDown traps (#549724)
- fix responding to broadcast UDP requests (#521758)
- fix parsing of OIDs from configuration file (#598293)


Autoupdates 지원 : Packages System
    pkgadd -F net-snmp*
	pkgadd -F perl-SNMP


update 패키지

  RPMS :

    . net-snmp-5.1.2-22.el4.i686.rpm
    . net-snmp-devel-5.1.2-22.el4.i686.rpm
    . net-snmp-utils-5.1.2-22.el4.i686.rpm
    . perl-SNMP-5.1.2-22.el4.i686.rpm

  SRPMS :

    . net-snmp-5.1.2-22.el4.src.rpm

참고 :

libxml2 보안 업데이트

김정균 — Sat, 20 Oct 2012 22:53:54 +0900

libxml2 보안 업데이트


상세내용

- fix an XML namespace handling problem in XML parser
- security fix

. CVE-2011-3919
Heap-based buffer overflow in libxml2, as used in Google Chrome
before 16.0.912.75, allows remote attackers to cause a denial
of service or possibly have unspecified other impact via unknown
vectors.

. CVE-2011-3905
libxml2, as used in Google Chrome before 16.0.912.63, allows
remote attackers to cause a denial of service (out-of-bounds
read) via unspecified vectors.

. CVE-2011-2834
Double free vulnerability in libxml2, as used in Google Chrome
before 14.0.835.163, allows remote attackers to cause a denial
of service or possibly have unspecified other impact via vectors
related to XPath handling.

. CVE-2011-0216
Off-by-one error in libxml in Apple Safari before 5.0.6 allows
remote attackers to execute arbitrary code or cause a denial of
service (heap-based buffer overflow and application crash) via
a crafted web site.


Autoupdates 지원 : 지원
  pkgsysupdate
  pkgadd -F libxml2-phtyon


update 패키지

  RPMS :

    . libxml2-2.6.16-12.el4.9.i686.rpm
    . libxml2-devel-2.6.16-12.el4.9.i686.rpm
    . libxml2-python-2.6.16-12.el4.9.i686.rpm

  SRPMS :

    . libxml2-2.6.16-12.el4.9.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3919
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3905
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2834
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0216

krb5 보안 업데이트

김정균 — Sat, 20 Oct 2012 22:12:44 +0900

krb5 보안 업데이트


상세내용

1.3.4-65.el4 update

- fixed CVE-2010-1323
- fixed CVE-2011-4862

. CVE-2010-1323:
MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and
1.8.x through 1.8.3 does not properly determine the acceptability
of checksums, which might allow remote attackers to modify
user-visible prompt text, modify a response to a Key Distribution
Center (KDC), or forge a KRB-SAFE message via certain checksums
that (1) are unkeyed or (2) use RC4 keys.

. CVE-2011-4862:
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3
through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl)
1.0.2 and earlier, and Heimdal 1.5.1 and earlier allows remote
attackers to execute arbitrary code via a long encryption key,
as exploited in the wild in December 2011.


Autoupdates 지원 : Packages System
  pkgadd -F "krb5*"


update 패키지

  RPMS :

    . krb5-libs-1.3.4-65.el4.i686.rpm
    . krb5-server-1.3.4-65.el4.i686.rpm
    . krb5-workstation-1.3.4-65.el4.i686.rpm
    . krb5-devel-1.3.4-65.el4.i686.rpm

  SRPMS :

    . krb5-1.3.4-65.el4.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1323
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4862

sudo 보안 업데이트

김정균 — Sat, 20 Oct 2012 21:17:17 +0900

sudo 보안 업데이트


상세내용

- 1.7.4p5-13 update
- fixed rhbz#840872
- fixed rhbz#829756 (CVE-2012-2337)


- 보안버그 수정 사항

. CVE-2012-2337
sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not
properly support configurations that use a netmask syntax, which allows
local users to bypass intended command restrictions in opportunistic
circumstances by executing a command on a host that has an IPv4 address.


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . sudo-1.7.4p5-11.el6.i686.rpm
 

  SRPMS :

    . sudo-1.7.4p5-11.el6.src.rpm


참고 :

libkrisp-data 업데이트

김정균 — Sat, 20 Oct 2012 21:06:02 +0900

libkrisp-data 업데이트


상세내용

2012.10 data update


Autoupdates 지원 : 지원
  pkgsysupdate
  or
  pkgadd -F "libkrisp-data"


update 패키지

  RPMS :

    . libkrisp-data-20121020-1.noarch.rpm

  SRPMS :

    . libkrisp-data-20121020-1.src.rpm


참고 :

cvs 업데이트

김정균 — Sun, 16 Sep 2012 03:18:08 +0900

cvs 업데이트


상세내용

- 1.11.23 update


Autoupdates 지원 : 지원
  pkgsysupdate


update 패키지

  RPMS :

    . cvs-1.11.23-11.i686.rpm

  SRPMS :

    . cvs-1.11.23-11.src.rpm


참고 :

pdnsd 업데이트

김정균 — Sun, 16 Sep 2012 02:12:52 +0900

pdnsd 업데이트


상세내용

- 1.2.9a update


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . pdnsd-1.2.9a-1.i686.rpm
    . pdnsd-doc-1.2.9a-1.i686.rpm
 

  SRPMS :

    . pdnsd-1.2.9a-1.src.rpm


참고 :

sh-utils 업데이트

김정균 — Sun, 16 Sep 2012 01:22:35 +0900

sh-utils 업데이트


상세내용

- USER_LANG support


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . sh-utils-2.0.12-5.i686.rpm
 

  SRPMS :

    . sh-utils-2.0.12-5.src.rpm


참고 :

sudo 업데이트

김정균 — Sun, 16 Sep 2012 01:19:10 +0900

sudo 업데이트


상세내용

- 1.7.4p5 update
- /etc/sudoers.d support
- USER_LANG support


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . sudo-1.7.4p5-11.el6.i686.rpm
 

  SRPMS :

    . sudo-1.7.4p5-11.el6.src.rpm


참고 :

m4 업데이트

김정균 — Sat, 15 Sep 2012 23:10:52 +0900

m4 업데이트


상세내용

- 1.4.13 update


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . m4-1.4.13-5.el6.i686.rpm
 

  SRPMS :

    . m4-1.4.13-5.el6.src.rpm


참고 :

initscript 업데이트

김정균 — Sat, 15 Sep 2012 21:26:28 +0900

initscript 업데이트


상세내용

* USER_LANG 지원
  SSH client에서 USER_LANG 환경 변수를 전송하면, LANG 환경 변수에 반영하도록 지원


Autoupdates 지원 : 지원
  pkgsysupdate -v


update 패키지

  RPMS :

    . initscripts-6.67-17.i686.rpm


  SRPMS :

    . initscripts-6.67-17.src.rpm


참고 :

openssh 업데이트

김정균 — Sat, 15 Sep 2012 21:09:52 +0900

openssh 업데이트


상세내용

- 6.1p1 update

* openssh 안녕 버전의 추가 사항

  . -H 옵션으로 host key check를 하지 않을 수 있습니다. 스크립트를
    돌릴 경우 key 등록이 되어 있지 않아서 block이 되는 경우 유용하게
    사용할 수 있습니다.
  . ssh 한글.com과 같이 multibyte 도메인을 직접 사용하실 수 있습니다.
  . 5.5p1 부터 sftp readline patch가 제거 되었습니다.


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . openssh-6.1p1-1.i686.rpm
    . openssh-clients-6.1p1-1.i686.rpm
    . openssh-server-6.1p1-1.i686.rpm

  SRPMS :

    . openssh-6.1p1-1.src.rpm


참고 : 
http://openssh.org/txt/release-6.1

imap 업데이트

김정균 — Sat, 15 Sep 2012 20:30:30 +0900

imap 업데이트


상세내용

imap package 는 pop3 와 imap daemon 을 포함하고 있다.

변경사항

. 2007f 업데이트


Autoupdates 지원 : Packages System
  pkgadd -F imap*


update 패키지

  RPMS :

    . imap-2007f-1.i686.rpm
    . imap-devel-2007f-1.i686.rpm


  SRPMS :

    . imap-2007f-1.src.rpm


참고 :
- imap, imaps, ipop3, pop3s 의 xinetd 구동 설정 파일은 imap-init-@servicename@
  으로 분리되어 있습니다.

sendmail 업데이트

김정균 — Sat, 15 Sep 2012 20:22:48 +0900

sendmail 업데이트


상세내용

8.14.5 update

* 주의

sendmail update 후에, 기존의 sendmail.cf 는 sendmail.cf.rpmsave 로
백업이 됩니다. 그러므로 이전의 설정을 새 sendmail.cf 에 적용해 주셔야
합니다. 설치된 기본값으로 사용하신 다면 신경쓰지 않아도 상관 없습니다.


Autoupdates 지원 : Packages System
  pkgadd -F "sendmail*"


update 패키지

  RPMS :

    . sendmail-8.14.5-1.i686.rpm
    . sendmail-devel-8.14.5-1.i686.rpm
    . sendmail-cf-8.14.5-1.i686.rpm

  SRPMS :

    . sendmail-8.14.5-1.src.rpm


참고 :

kernel 보안 업데이트

김정균 — Tue, 24 Apr 2012 00:23:59 +0900

kernel 보안 업데이트


상세내용

2.4.37-11 update

  - update 2.4.37.11
  - 2.4 커널 마지막 업데이트 버전


security issue

  - CVE-2010-3848

    Stack-based buffer overflow in the econet_sendmsg function
    in net/econet/af_econet.c in the Linux kernel before 2.6.36.2,
    when an econet address is configured, allows local users to
    gain privileges by providing a large number of iovec structures.

  - CVE-2010-3849

    The econet_sendmsg function in net/econet/af_econet.c in the Linux
    kernel before 2.6.36.2, when an econet address is configured, allows
    local users to cause a denial of service (NULL pointer dereference
    and OOPS) via a sendmsg call that specifies a NULL value for the
    remote address field.

  - CVE-2010-3850

    The ec_dev_ioctl function in net/econet/af_econet.c in the Linux
    kernel before 2.6.36.2 does not require the CAP_NET_ADMIN capability,
    which allows local users to bypass intended access restrictions and
    configure econet addresses via an SIOCSIFADDR ioctl call.


Autoupdates 지원 : Pakcages System
  pkgkernel 이용
  http://annyung.oops.org/?m=pkgadm&p=pkgkernel 참조


update 패키지

  RPMS :

    . kernel-2.4.37-11.i686.rpm
    . kernel-bigmem-2.4.37-11.i686.rpm
    . kernel-PIII-2.4.37-11.i686.rpm
    . kernel-PIV-2.4.37-11.i686.rpm
    . kernel-source-2.4.37-11.i386.rpm
    . kernel-header-2.4.37-11.i386.rpm


  SRPMS :

    . kernel-2.4.37-11.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3848
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3849
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3850

libkrisp-data 업데이트

김정균 — Wed, 11 Apr 2012 21:16:20 +0900

libkrisp-data 업데이트


상세내용

2012.03 data update


Autoupdates 지원 : 지원
  pkgsysupdate
  or
  pkgadd -F "libkrisp-data"


update 패키지

  RPMS :

    . libkrisp-data-20120411-1.noarch.rpm

  SRPMS :

    . libkrisp-data-20120411-1.src.rpm


참고 :

libkrisp-data 업데이트

김정균 — Fri, 09 Mar 2012 01:50:03 +0900

libkrisp-data 업데이트


상세내용

2012.03 data update


Autoupdates 지원 : 지원
  pkgsysupdate
  or
  pkgadd -F "libkrisp-data"


update 패키지

  RPMS :

    . libkrisp-data-20120309-1.noarch.rpm

  SRPMS :

    . libkrisp-data-20120309-1.src.rpm


참고 :

libkrisp-data 업데이트

김정균 — Fri, 10 Feb 2012 04:04:47 +0900

libkrisp-data 업데이트


상세내용

2012.02 data update


Autoupdates 지원 : 지원
  pkgsysupdate
  or
  pkgadd -F "libkrisp-data"


update 패키지

  RPMS :

    . libkrisp-data-20120210-1.noarch.rpm

  SRPMS :

    . libkrisp-data-20120210-1.src.rpm


참고 :