Bug 127974
Summary: | CAN-2004-0494 extfs vfs vulnerability in mc | ||||||
---|---|---|---|---|---|---|---|
Product: | Red Hat Enterprise Linux 2.1 | Reporter: | Josh Bressers <bressers> | ||||
Component: | mc | Assignee: | Jindrich Novy <jnovy> | ||||
Status: | CLOSED ERRATA | QA Contact: | Jay Turner <jturner> | ||||
Severity: | medium | Docs Contact: | |||||
Priority: | medium | ||||||
Version: | 2.1 | CC: | leonard-rh-bugzilla, pknirsch, security-response-team, srevivo | ||||
Target Milestone: | --- | Keywords: | Security | ||||
Target Release: | --- | ||||||
Hardware: | All | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2005-06-17 07:08:38 UTC | Type: | --- | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Josh Bressers
2004-07-15 21:06:32 UTC
This issue also affects RHEL 2.1 Fedora Core is covered by bug 127973 This issue ONLY affects RHEL 2.1 Aug 04 1200UTC - removing embargo Is mc not available for RHEL 3? Why is this? Yes, mc was not part of RHEL 3. Erratum for Fedora Core has been released. When will there be one for RHEL 2.1? It's in QA right now, as soon as they're done with it, we'll issue the errata. This will be RHSA-2004:464 An errata has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2004-464.html SUSE's security team has also audited the extfs shell scripts and came up with some extra fixes. See attachment #104496 [details] from bug #127973. Cumulative patch: Attachment #104498 [details] to Bug #127973. Attachment #104795 [details] to bug #127973 should fix these shell scripts. Please check trpm for correctness. Bug 127973 has ongoing discussion and work to resolve these and some additional issues. I updated the extfs scripts in RHEL 2.1, version of patched mc is mc-4.5.51-36.5 The patch for RHEL 2.1 misses fixes for "a". Also the patch should not touch extfs.ini. Some more remarks and questions (about the introduction of functional changes besides fixing quoting issues) have been mailed to Jindrich. Created attachment 108895 [details] Updated CAN-2004-0494 patch An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2004-464.html Still a few issues to fix. Will be done soon, but not yet ;) What is the status of this issue? Have we completely fixed it in our recent errata? Yes, partial fix for this CAN was included also in the previous errata and it's complete now with releasing the latest mc security errata. |