-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
CONECTIVA LINUX SECURITY ANNOUNCEMENT 
- --------------------------------------------------------------------------

PACKAGE   : BitchX
SUMMARY   : Remote vulnerabilities
DATE      : 2003-05-26 14:29:00
ID        : CLA-2003:655
RELEVANT
RELEASES  : 6.0, 7.0, 8, 9

- -------------------------------------------------------------------------

DESCRIPTION
 BitchX is a text-mode IRC client.
 
 This update fixes two remote vulnerabilities in Bitchx:
 
 1. Buffer overflows
 In a message sent to the bugtraq mailing list, Timo Sirainen pointed
 out[1] several possible buffer overflow vulnerabilities in BitchX and
 other IRC clients. These vulnerabilities can be exploited by a remote
 attacker who is able to control the server to which the client is
 connected.
 
 2. Denial of Service on channel mode change
 A Denial of Service (DoS) vulnerability has been found[2] in BitchX.
 This vulnerability allows a remote attacker to crash BitchX by
 changing certains channel modes.
 
 Please note that BitchX is being upgraded to version 1.0c18 in all
 supported Conectiva Linux products, thus several new features and
 other bug fixes are being added as well.


SOLUTION
 All BitchX users should upgrade.
 
 
 REFERENCES:
 1.http://www.securityfocus.com/archive/1/315057
 2.http://www.securityfocus.com/archive/1/321093
 3.http://distro2.conectiva.com.br/bugzilla/show_bug.cgi?id=8197


UPDATED PACKAGES
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/BitchX-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/wserv-1.0c18-1U60_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/SRPMS/BitchX-1.0c18-1U60_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-doc-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/BitchX-help-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/wserv-1.0c18-1U70_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/SRPMS/BitchX-1.0c18-1U70_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-doc-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/BitchX-help-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/wserv-1.0c18-17U80_2cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/SRPMS/BitchX-1.0c18-17U80_2cl.src.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-doc-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/BitchX-help-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/RPMS/wserv-1.0c18-29203U90_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/9/SRPMS/BitchX-1.0c18-29203U90_1cl.src.rpm


ADDITIONAL INSTRUCTIONS
 The apt tool can be used to perform RPM packages upgrades:

 - run:                 apt-get update
 - after that, execute: apt-get upgrade

 Detailed instructions reagarding the use of apt and upgrade examples 
 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en

- -------------------------------------------------------------------------
All packages are signed with Conectiva's GPG key. The key and instructions
on how to import it can be found at 
http://distro.conectiva.com.br/seguranca/chave/?idioma=en
Instructions on how to check the signatures of the RPM packages can be
found at http://distro.conectiva.com.br/seguranca/politica/?idioma=en

- -------------------------------------------------------------------------
All our advisories and generic update instructions can be viewed at
http://distro.conectiva.com.br/atualizacoes/?idioma=en

- -------------------------------------------------------------------------
Copyright (c) 2003 Conectiva Inc.
http://www.conectiva.com

- -------------------------------------------------------------------------
subscribe: conectiva-updates-subscribe@papaleguas.conectiva.com.br
unsubscribe: conectiva-updates-unsubscribe@papaleguas.conectiva.com.br
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE+0lCZ42jd0JmAcZARAghkAKDDZGejR9McoSlFT1TcYyi3aFyBzgCeLPJ/
dDmhLIwxZVeVELmT3iAPrpM=
=UuyW
-----END PGP SIGNATURE-----