The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2006:142
http://www.mandriva.com/security/
_______________________________________________________________________
Package : heartbeat
Date : August 14, 2006
Affected: 2006.0, Corporate 3.0
_______________________________________________________________________
Problem Description:
Two vulnerabilities in heartbeat prior to 2.0.6 was discovered by Yan
Rong Ge. The first is that heartbeat would set insecure permissions in
an shmget call for shared memory, allowing a local attacker to cause an
unspecified denial of service via unknown vectors (CVE-2006-3815).
The second is a remote vulnerability that could allow allow the master
control process to read invalid memory due to a specially crafted
heartbeat message and die of a SEGV, all prior to any authentication
(CVE-2006-3121).
Updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3121
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3815
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2006.0:
7797a304e73645cb0dd518936b6a0d59 2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.i586.rpm
9024d2ddeabed550864f4087f5d1203a 2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.i586.rpm
0cc86c13aa345167fc28732ad8d4c488 2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.i586.rpm
32ae04a5e100527f28005cc95d58bab3 2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.i586.rpm
0b0c39c8f6bc55a1742346c2ab74d476 2006.0/RPMS/libheartbeat0-1.2.3-5.2.20060mdk.i586.rpm
a4306e4730d23f7c44cde38148d2fbf0 2006.0/RPMS/libheartbeat0-devel-1.2.3-5.2.20060mdk.i586.rpm
d9ed984f7044b1fd895bf48a17646149 2006.0/RPMS/libheartbeat-pils0-1.2.3-5.2.20060mdk.i586.rpm
893136133c78f81f45c5a46b90bd56f6 2006.0/RPMS/libheartbeat-pils0-devel-1.2.3-5.2.20060mdk.i586.rpm
fc48ae914852b91d25e204df5013ea88 2006.0/RPMS/libheartbeat-stonith0-1.2.3-5.2.20060mdk.i586.rpm
27dba06cd918f4e44e7316f37c0728e1 2006.0/RPMS/libheartbeat-stonith0-devel-1.2.3-5.2.20060mdk.i586.rpm
ec184261c2b75735f245058cc102875b 2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
ceefc3ca6b8bfd9e5342c7e57c9d22de x86_64/2006.0/RPMS/heartbeat-1.2.3-5.2.20060mdk.x86_64.rpm
056f0fc351514d5daf25e8b7c0dac268 x86_64/2006.0/RPMS/heartbeat-ldirectord-1.2.3-5.2.20060mdk.x86_64.rpm
511ed82622928343faa187cd4be07b23 x86_64/2006.0/RPMS/heartbeat-pils-1.2.3-5.2.20060mdk.x86_64.rpm
ccedb1fac9aa393d83b1e261b83ca32e x86_64/2006.0/RPMS/heartbeat-stonith-1.2.3-5.2.20060mdk.x86_64.rpm
bbb2d50dabbf3c782282403e185e3ed3 x86_64/2006.0/RPMS/lib64heartbeat0-1.2.3-5.2.20060mdk.x86_64.rpm
e960d1a0be192e27325e8080ff805d30 x86_64/2006.0/RPMS/lib64heartbeat0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
3806435d23c0d78c01f095349098ab32 x86_64/2006.0/RPMS/lib64heartbeat-pils0-1.2.3-5.2.20060mdk.x86_64.rpm
56f6f6748b15477595954cf62fb1be4f x86_64/2006.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
1b7ec3e3232f92f4798f1f27e791f5fa x86_64/2006.0/RPMS/lib64heartbeat-stonith0-1.2.3-5.2.20060mdk.x86_64.rpm
b4eba13e67ddb63f4e945fd3623b70dc x86_64/2006.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-5.2.20060mdk.x86_64.rpm
ec184261c2b75735f245058cc102875b x86_64/2006.0/SRPMS/heartbeat-1.2.3-5.2.20060mdk.src.rpm
Corporate 3.0:
cedaede52beb3d048afe667f26c38fde corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.i586.rpm
bc8a44f9c3bbc42ae092da7f738af2c4 corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.i586.rpm
a0f4b51b272f037c17fba097784d7177 corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.i586.rpm
cf113ac1f2847706f3a69c7b809f62ea corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.i586.rpm
93fd800765604254140a6f067d482c8b corporate/3.0/RPMS/libheartbeat0-1.2.3-2.3.C30mdk.i586.rpm
2dbb453665fcb6386734f5b9150b92e8 corporate/3.0/RPMS/libheartbeat0-devel-1.2.3-2.3.C30mdk.i586.rpm
718bf907afe2cee9677395082905cd77 corporate/3.0/RPMS/libheartbeat-pils0-1.2.3-2.3.C30mdk.i586.rpm
44b21aad591fe193b9e7236cbbfce967 corporate/3.0/RPMS/libheartbeat-pils0-devel-1.2.3-2.3.C30mdk.i586.rpm
3a421e29c6c74fe75d3b5a47a32a1003 corporate/3.0/RPMS/libheartbeat-stonith0-1.2.3-2.3.C30mdk.i586.rpm
44b30593b986755b6805474251c0b843 corporate/3.0/RPMS/libheartbeat-stonith0-devel-1.2.3-2.3.C30mdk.i586.rpm
362a30fb09bd24d2507a030d82e3d020 corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm
Corporate 3.0/X86_64:
b5c12159643089bfc87aeb4e08719467 x86_64/corporate/3.0/RPMS/heartbeat-1.2.3-2.3.C30mdk.x86_64.rpm
dec8e2ef290fb9fbcf0515478aab2a96 x86_64/corporate/3.0/RPMS/heartbeat-ldirectord-1.2.3-2.3.C30mdk.x86_64.rpm
4816a2dbc933099da9e6d8969fac9395 x86_64/corporate/3.0/RPMS/heartbeat-pils-1.2.3-2.3.C30mdk.x86_64.rpm
a5b482fe798f98eeb1cb702898807560 x86_64/corporate/3.0/RPMS/heartbeat-stonith-1.2.3-2.3.C30mdk.x86_64.rpm
1fb38b260833c55999be24fbf63a3aac x86_64/corporate/3.0/RPMS/lib64heartbeat0-1.2.3-2.3.C30mdk.x86_64.rpm
f3ebccf215e1e96cb35c252db87bcd80 x86_64/corporate/3.0/RPMS/lib64heartbeat0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
8ff7be0054b3a529facc33004f5f6d0f x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-1.2.3-2.3.C30mdk.x86_64.rpm
bc7419d6d959e8088c5c2a39c0adcc4d x86_64/corporate/3.0/RPMS/lib64heartbeat-pils0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
04716c3769327dc854ad8425cfe08233 x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-1.2.3-2.3.C30mdk.x86_64.rpm
16beaa0ad35f93a1e750d0e7f71a7e3c x86_64/corporate/3.0/RPMS/lib64heartbeat-stonith0-devel-1.2.3-2.3.C30mdk.x86_64.rpm
362a30fb09bd24d2507a030d82e3d020 x86_64/corporate/3.0/SRPMS/heartbeat-1.2.3-2.3.C30mdk.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFE4Md0mqjQ0CJFipgRArKMAJ47bA0Ei+FRD9gfIsaTaBnvMCokmACg09Xp
X7+Aj9VhwpZtOTiRJFwClSU=
=5nFb
-----END PGP SIGNATURE-----
