-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



- -----------------------------------------------------------------------

CONECTIVA LINUX SECURITY ANNOUNCEMENT

- -----------------------------------------------------------------------



PACKAGE   : stunnel

SUMMARY   : Remote exploit and other bug fixes

DATE      : 2000-12-20 12:18:00

ID        : CLA-2000:363

RELEVANT

RELEASES  : 4.0, 4.0es, 4.1, 4.2, 5.0, 5.1, 6.0



- ----------------------------------------------------------------------



DESCRIPTION

 "stunnel" is a package which offers wrapped SSL connections for

 generic TCP services, such as pop3, ldap and others.

 Versions prior do 3.9 have a format string vulnerability in a

 syslog() call which could be exploited remotely. The package

 distributed with Conectiva Linux 5.1 and 6.0 has the daemon running

 as the "stunnel" user, and not root, which diminishes the effect of

 this vulnerability somewhat.

 Also, versions prior to 3.8 created the PID file in an insecure

 manner, possibly making it vulnerable to symlink attacks depending on

 where the user chose to put the PID file.

 Other bugs were also fixed in the 3.10 release, please refer to the

 Changelog for a full description.





SOLUTION

 All stunnel users should upgrade immediatelly.





DIRECT DOWNLOAD LINKS TO THE UPDATED PACKAGES

http://atualizacoes.conectiva.com.br/4.0/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/4.0/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/4.0es/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/4.0es/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/4.1/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/4.1/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/4.2/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/4.2/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/5.0/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/5.0/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/5.1/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/5.1/i386/stunnel-3.10-1cl.i386.rpm

http://atualizacoes.conectiva.com.br/6.0/SRPMS/stunnel-3.10-1cl.src.rpm

http://atualizacoes.conectiva.com.br/6.0/RPMS/stunnel-3.10-1cl.i386.rpm





ADDITIONAL INSTRUCTIONS

 Users of Conectiva Linux version 6.0 or higher may use apt to perform

 upgrades:

 - add the following line to /etc/apt/sources.list if it is not there yet

   (you may also use linuxconf to do this):



 rpm [cncbr] http://atualizacoes.conectiva.com.br 6.0/conectiva updates



 - run:                 apt-get update

 - after that, execute: apt-get upgrade



 Detailed instructions reagarding the use of apt and upgrade examples

 can be found at http://distro.conectiva.com.br/atualizacoes/#apt?idioma=en





- ----------------------------------------------------------------------

All packages are signed with Conectiva's GPG key. The key can be

obtained at http://www.conectiva.com.br/contato



- -----------------------------------------------------------------------

All our advisories and generic update instructions can be viewed at

http://www.conectiva.com.br/suporte/atualizacoes



- ----------------------------------------------------------------------

subscribe: atualizacoes-anuncio-subscribe@papaleguas.conectiva.com.br

unsubscribe: atualizacoes-anuncio-unsubscribe@papaleguas.conectiva.com.br

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.4 (GNU/Linux)

Comment: For info see http://www.gnupg.org



iD8DBQE6QMFt42jd0JmAcZARAu+JAKD0SBX0PH8n6duNv5rPTr03d0oGyQCgo4JM

HDrUjBvUt8KMV33JvpMhfHo=

=Vbfs

-----END PGP SIGNATURE-----