Subject: [yellowdog-updates] Yellow Dog Security Announcement: YDU-20020211-1
Date: 13 Feb 2002 01:30:40 -0000
Yellow Dog Linux Security Announcement
Issue Date: February 11, 2002
Advisory ID: YDU-20020211-1
The ucd-snmp packages have been updated to
prevent denial of service attacks and other
security flaws recently discovered.
"The Simple Network Management Protocol (SNMP) enables
monitoring and configuration of network nodes.
The Oulu University Secure Programming Group performed
a vulnerability assessment of various SNMP implementations
through syntax testing and test-suite creation.
The test-suite showed several failures in the ucd-snmp tools
in version 4.2.2 and earlier. These vulnerabilities can cause
denial-of-service conditions, service interruptions, and in
some cases could result in a remote security breach.
Updated ucd-snmp packages are provided that are not susceptible
to these vulnerabilities and which pass all tests of the test-suite
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the names CAN-2002-0012 and CAN-2002-0013 to these
All users of ucd-snmp should upgrade to these errata packages."
(from Red Hat advisory)
a) Updating via yup...
We suggest that you use the Yellow Dog Update Program (yup)
to keep your system up-to-date. The following command(s) will
automatically retrieve and install the fixed version of
this update onto your system:
yup update ucd-snmp
yup update ucd-snmp-devel
yup update ucd-snmp-utils
b) Updating manually...
The update can also be retrieved manually from our ftp site
below along with the rpm command that should be used to install
the update. (Please use a mirror site)
rpm -Fvh ucd-snmp-4.2.3-184.108.40.206.ppc.rpm
rpm -Fvh ucd-snmp-devel-4.2.3-220.127.116.11.ppc.rpm
rpm -Fvh ucd-snmp-utils-4.2.3-18.104.22.168.ppc.rpm
MD5 checksum Package
If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename
Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
For information regarding the usage of yup, the Yellow Dog Update Program, see
to post comments)