-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                     ESB-2004.0768 -- RHSA-2004:536-01
          Updated ncompress package fixes security issue and bug.
                             14 December 2004

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           ncompress
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux AS/ES/WS 2.1
                   Red Hat Linux Advanced Workstation 2.1
                   Linux variants
                   UNIX variants
Impact:            Execute Arbitrary Code/Commands
Access:            Remote/Unauthenticated
CVE Names:         CAN-2001-1413

Original Bulletin: https://rhn.redhat.com/errata/RHSA-2004-536.html

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Updated ncompress package fixes security issue and bug.
Advisory ID:       RHSA-2004:536-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2004-536.html
Issue date:        2004-12-13
Updated on:        2004-12-13
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2001-1413
- - ---------------------------------------------------------------------

1. Summary:

An updated ncompress package that fixes a buffer overflow and problem in
the handling of files larger than 2 GB is now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386

3. Problem description:

The ncompress package contains the compress and uncompress file compression
and decompression utilities, which are compatible with the original UNIX
compress utility (.Z file extensions).

A bug in the way ncompress handles long filenames has been discovered. 
ncompress versions 4.2.4 and earlier contain a stack based buffer overflow
when handling very long filenames.  It is possible that an attacker could
execute arbitrary code on a victims machine by tricking the user into
decompressing a carefully crafted filename.  The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2001-1413 to
this issue.

This updated ncompress package also fixes a problem in the handling of
files larger than 2 GB.

All users of ncompress should upgrade to this updated package, which
contains fixes for these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):

126776 - [RHEL2.1] compress does not work if the file size is greater than 2GB
136661 - CAN-2001-1413 Stack-based buffer overflow in the comprexx function

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61  ncompress-4.2.4-37.src.rpm

i386:
b3cd3462d6a09d8d7d14c4e7b2744923  ncompress-4.2.4-37.i386.rpm

ia64:
36338acd3f00f119ed4b50fe2c67663d  ncompress-4.2.4-37.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61  ncompress-4.2.4-37.src.rpm

ia64:
36338acd3f00f119ed4b50fe2c67663d  ncompress-4.2.4-37.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61  ncompress-4.2.4-37.src.rpm

i386:
b3cd3462d6a09d8d7d14c4e7b2744923  ncompress-4.2.4-37.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/ncompress-4.2.4-37.src.rpm
514bcc89bdd8d5a71fc5d01ce2f2ac61  ncompress-4.2.4-37.src.rpm

i386:
b3cd3462d6a09d8d7d14c4e7b2744923  ncompress-4.2.4-37.i386.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package

7. References:

http://www.kb.cert.org/vuls/id/176363
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1413

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact.html

Copyright 2004 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBve9LXlSAg2UNWIIRAjTvAJ4jkOcSKA97x6QmELt2npgNnn7OngCfbCvB
/dwDYUQ9skpi2ucNZEN7CCk=
=OFNx
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBQb40Lyh9+71yA2DNAQLU8wP/QdJhrELSfqJgSoyk6bOSEXj0A6J/qaAC
EWPL8CDJkdf1ko/b6vIst6aOomBiBBp7KxL/EWApRlBrnri3KsAYOmQLfuIy4dMR
ou3yV+ucsj2bbioplU6koVqBhxbnObc1/OhQb7dxvFMFCHWYP62ksL42Pe9yDIu5
NOrsK9SKC50=
=5LTt
-----END PGP SIGNATURE-----