January 28, 2002

YDL: 'groff' Security update

Author: JT Smith

Yellow Dog: "Groff is a document formatting system. The groff preprocessor contains an exploitable buffer overflow. If groff can be invoked within the LPRng printing system, an attacker can gain rights as the "lp" user. Remote exploitation may be possible if lpd is running and is accessible remotely, and the attacker knows the name of the printer and spoolfile."

From:	 dburcaw@newhope.terraplex.com
To:	 yellowdog-updates@lists.yellowdoglinux.com
Subject: [yellowdog-updates] Yellow Dog Linux Security Update: YDU-20020127-11
Date:	 28 Jan 2002 02:10:00 -0000

Yellow Dog Linux Security Announcement
--------------------------------------

Package:	groff		
Issue Date: 	January 27, 2002	
Priority:	high		
Advisory ID: 	YDU-20020127-11


1. 	Topic:

	New groff packages have been made available that fix an overflow in groff.
	If the printing system running this is a security issue, it is recommended
	to update to the new, fixed packages.


2. 	Problem:

	Groff is a document formatting system. The groff preprocessor contains an
	exploitable buffer overflow. If groff can be invoked within the LPRng
	printing system, an attacker can gain rights as the "lp" user.

	Remote exploitation may be possible if lpd is running and is accessible
	remotely, and the attacker knows the name of the printer and spoolfile.

	The Common Vulnerabilities and Exposures project (cve.mitre.org) has
	assigned the name CAN-2002-0003 to this issue.

	Thanks to zen-parse for bringing this bug to our attention.
	(from Red Hat advisory)


3. 	Solution:

   	a) Updating via yup...
   	We suggest that you use the Yellow Dog Update Program (yup)
   	to keep your system up-to-date. The following command(s) will
   	automatically retrieve and install the fixed version of
   	this update onto your system:

   		yup update groff groff-gxditview groff-perl 

   	b) Updating manually...
   	The update can also be retrieved manually from our ftp site
   	below along with the rpm command that should be used to install
   	the update.  (Please use a mirror site)

   		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
rpm -Fvh groff-1.17.2-7.0.2a.ppc.rpm 
		rpm -Fvh groff-gxditview-1.17.2-7.0.2a.ppc.rpm
		rpm -Fvh groff-perl-1.17.2-7.0.2a.ppc.rpm


4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
e5d92c7fc4df1919952b285474d0383b  ppc/groff-1.17.2-7.0.2a.ppc.rpm
4c8e1de148a57b4e2c05240fc7bbfa1b  ppc/groff-gxditview-1.17.2-7.0.2a.ppc.rpm
508550f96ed73bc80d916b68e436bbd9  ppc/groff-perl-1.17.2-7.0.2a.ppc.rpm
e0a48ff4d69a2212923d7ea88e995c98  SRPMS/groff-1.17.2-7.0.2a.src.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml

Category:

  • Linux
Click Here!