[Subject Prev][Subject Next][Thread Prev][Thread Next][Subject Index][Thread Index]
(fwd) [RHSA-2000:054-01] New Netscape packages fix Java security hole
[ALL versions of Netscape, upto and including 4.74, on ALL
distributions are vulnerable. Please upgrade fast! -- Raju]
This is an RFC 1153 digest.
(1 message)
----------------------------------------------------------------------
Approved-By: aleph1@xxxxxxxxxxxxxxxxx
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxxxxxxxx
Received: from securityfocus.com (mail.securityfocus.com [207.126.127.78]) by
lists.securityfocus.com (Postfix) with SMTP id 8E7DE1F49C for
<bugtraq@xxxxxxxxxxxxxxxxxxxxxxx>; Fri, 18 Aug 2000 16:19:40 -0700
(PDT)
Received: (qmail 10075 invoked by alias); 18 Aug 2000 23:17:45 -0000
Delivered-To: bugtraq@xxxxxxxxxxxxxxxxx
Received: (qmail 6917 invoked from network); 18 Aug 2000 23:12:21 -0000
Received: from lacrosse.corp.redhat.com (207.175.42.154) by
mail.securityfocus.com with SMTP; 18 Aug 2000 23:12:21 -0000
Received: from localhost (porkchop.redhat.com [207.175.42.68]) by
lacrosse.corp.redhat.com (8.9.3/8.9.3) with SMTP id TAA08810; Fri, 18
Aug 2000 19:11:29 -0400
Content-type: text/plain; charset="iso-8859-1"
Mime-version: 1.0
Message-ID: <200008182311.TAA08810@xxxxxxxxxxxxxxxxxxxxxxxx>
Reply-To: bugzilla@xxxxxxxxxx
X-To: redhat-watch-list@xxxxxxxxxx
X-cc: linux-security@xxxxxxxxxx
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by biznetindia.com id AAA01527
From: bugzilla@xxxxxxxxxx
Sender: Bugtraq List <BUGTRAQ@xxxxxxxxxxxxxxxxx>
To: BUGTRAQ@xxxxxxxxxxxxxxxxx
Subject: [RHSA-2000:054-01] New Netscape packages fix Java security hole
Date: Fri, 18 Aug 2000 19:11:00 -0400
---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: New Netscape packages fix Java security hole
Advisory ID: RHSA-2000:054-01
Issue date: 2000-08-18
Updated on: 2000-08-18
Product: Red Hat Linux
Keywords: Brown Orifice netscape java
Cross references: N/A
---------------------------------------------------------------------
1. Topic:
New Netscape packages are available to fix a serious security
problem with Java. It is recommended that all netscape users
update to the new packages. Users of Red Hat Linux 6.0 and 6.1
should use the packages for Red Hat Linux 6.2.
Packages will be made available for Red Hat Linux 5.2 when
fixed binaries are available from Netscape.
2. Relevant releases/architectures:
Red Hat Linux 6.2 - i386, alpha
3. Problem description:
Due to a problem in the Java environment shipped with Netscape,
it would be possible for a java applet on a remote site to
view files on a local machine, and then provide access to those
files for other machines.
For more information, please see:
http://www.brumleve.com/BrownOrifice/
4. Solution:
For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
N/A
6. RPMs required:
Red Hat Linux 6.2:
alpha:
ftp://updates.redhat.com/6.2/alpha/netscape-common-4.75-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-communicator-4.75-0.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/netscape-navigator-4.75-0.6.2.alpha.rpm
i386:
ftp://updates.redhat.com/6.2/i386/netscape-common-4.75-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-communicator-4.75-0.6.2.i386.rpm
ftp://updates.redhat.com/6.2/i386/netscape-navigator-4.75-0.6.2.i386.rpm
sources:
ftp://updates.redhat.com/6.2/SRPMS/netscape-4.75-0.6.2.src.rpm
ftp://updates.redhat.com/6.2/SRPMS/netscape-alpha-4.75-0.6.2.src.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
e4901ef360fdf89bc26cb9511210e25e 6.2/SRPMS/netscape-4.75-0.6.2.src.rpm
7868b53573252f231b627b20f11501fd 6.2/SRPMS/netscape-alpha-4.75-0.6.2.src.rpm
2db1ac1eefd26ef37b5e938077fc0a86 6.2/alpha/netscape-common-4.75-0.6.2.alpha.rpm
470b471c4d3575ecfa18bdabdb459389 6.2/alpha/netscape-communicator-4.75-0.6.2.alpha.rpm
981b62eb767ebd405dda3864bbb35d54 6.2/alpha/netscape-navigator-4.75-0.6.2.alpha.rpm
138e80104c7054d2b894fd3a064ab28f 6.2/i386/netscape-common-4.75-0.6.2.i386.rpm
887e48c496d386d82a6d66ce31f6a6cb 6.2/i386/netscape-communicator-4.75-0.6.2.i386.rpm
3e8c1094bbccb8d7783febea6e430549 6.2/i386/netscape-navigator-4.75-0.6.2.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
N/A
Copyright(c) 2000 Red Hat, Inc.
------------------------------
End of this Digest
******************