-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : slocate
SUMMARY   : Buffer overflow vulnerability
DATE      : 2003-05-08 12:45:00
ID        : CLA-2003:643
RELEVANT
RELEASES  : 6.0, 7.0, 8

- -------------------------------------------------------------------------

DESCRIPTION
 "slocate"[1] is a program which catalogues existing files and allows
 for a quick lookup later.
 
 It has been reported[2] that slocate contains a buffer overflow
 vulnerability which could be used by a local attacker to obtain the
 privileges of the slocate user.
 
 With these privileges, the attacker could read and alter the slocate
 database, insert false data or find out paths to files which he/she
 would otherwise not know due to filesystem restrictions.
 
 The author released version 2.7 which is not vulnerable to this
 issue.


SOLUTION
 It is recommended that all slocate users upgrade their packages.
 
 
 REFERENCES
 1. http://www.geekreview.org/slocate/
 2. http://marc.theaimsgroup.com/?l=bugtraq&m=104342864418213&w=2
 3. http://cve.mitre.org/cgi-bin/cvename.cgi?name=can-2003-0056


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/slocate-2.7-1U60_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/slocate-2.7-1U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/slocate-2.7-1U70_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/slocate-2.7-1U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/slocate-2.7-1U80_1cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/slocate-2.7-1U80_1cl.i386.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+unwp42jd0JmAcZARAnWNAJ0ZBU4N/ChhGmu+YAIAkPSzh9hSOQCdGRcv
XWl8t7GbakmA1MNsQuuad6A=
=IxEr
-----END PGP SIGNATURE-----