Trustix Secure Linux

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- --------------------------------------------------------------------------
Trustix Secure Linux Bugfix Advisory #2004-0019

Package name:      ppp, squid
Summary:           Package bug
Date:              2004-04-16
Affected versions: Trustix Secure Linux 1.5
                   Trustix Secure Linux 2.0
                   Trustix Secure Linux 2.1
                   Trustix Secure Enterprise Linux 2

- --------------------------------------------------------------------------
Package description:
  ppp:
  The ppp package contains the PPP (Point-to-Point Protocol) daemon
  and documentation for PPP support.  The PPP protocol provides a
  method for transmitting datagrams over serial point-to-point links.

  squid:
  Squid is a high-performance proxy caching server for Web clients,
  supporting FTP, gopher, and HTTP data objects. Unlike traditional
  caching software, Squid handles all requests in a single,
  non-blocking, I/O-driven process. Squid keeps meta data and especially
  hot objects cached in RAM, caches DNS lookups, supports non-blocking
  DNS lookups, and implements negative caching of failed requests.


Problem description:
  ppp:
  The file /etc/ppp/resolv.conf was missing from the package.  This left
  /etc/ppp/resolv.conf (and combined with rp-pppoe also /etc/resolv.conf)
  unreadable for users.  This affected the ppp versions in TSL 2.0 and
  2.1 as well as TSEL 2.

  squid:
  There was an error in the rfc1738_unescape() function which could
  allow a bypass of url_regexp based ACLs.  This affected the Squid
  versions in TSL 1.5 and 2.0.

Action:
  We recommend that all systems with this package installed be upgraded.
  Please note that if you do not need the functionality provided by this
  package, you may want to remove it from your system.


Location:
  All Trustix updates are available from
  <URI:http://http.trustix.org/pub/trustix/updates/>
  <URI:ftp://ftp.trustix.org/pub/trustix/updates/>


About Trustix Secure Linux:
  Trustix Secure Linux is a small Linux distribution for servers. With focus
  on security and stability, the system is painlessly kept safe and up to
  date from day one using swup, the automated software updater.


Automatic updates:
  Users of the SWUP tool can enjoy having updates automatically
  installed using 'swup --upgrade'.


Public testing:
  Most updates for Trustix Secure Linux are made available for public
  testing some time before release.
  If you want to contribute by testing the various packages in the
  testing tree, please feel free to share your findings on the
  tsl-discuss mailinglist.
  The testing tree is located at
  <URI:http://tsldev.trustix.org/horizon/>

  You may also use swup for public testing of updates:
  
  site {
      class = 0
      location = "http://tsldev.trustix.org/horizon/rdfs/latest.rdf"
      regexp = ".*"
  }
  

Questions?
  Check out our mailing lists:
  <URI:http://www.trustix.org/support/>


Verification:
  This advisory along with all Trustix packages are signed with the
  TSL sign key.
  This key is available from:
  <URI:http://www.trustix.org/TSL-SIGN-KEY>

  The advisory itself is available from the errata pages at
  <URI:http://www.trustix.org/errata/trustix-2.0/> and
  <URI:http://www.trustix.org/errata/trustix-2.1/>
  or directly at
  <URI:http://www.trustix.org/errata/misc/2004/TSL-2004-0019-multi.asc.txt>


MD5sums of the packages:
- --------------------------------------------------------------------------
752ac280318f7f54e8cc52cfdbcc0e40  2.0/rpms/ppp-2.4.1-8tr.i586.rpm
e9632c64cd312a01764dbfa8a06b8432  2.1/rpms/ppp-2.4.1-12tr.i586.rpm
7c68399554362d246a51fd870e68e687  TSEL-2/ppp-2.4.1-12tr.i586.rpm
04e60853196742cc73e4b2775737038d  1.5/rpms/squid-2.4.STABLE7-2tr.i586.rpm
b89f870943e2bd860dcc35fac1e7c204  2.0/rpms/squid-2.5.STABLE5-0.1tr.i586.rpm
- --------------------------------------------------------------------------


Trustix Security Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)

iD8DBQFAf8jEi8CEzsK9IksRAoQEAKCef8dEP3tMx3TAHax/Co1pJzPFfACgrBk9
ptP+bfsVN40LRBqKWvgSCbQ=
=squt
-----END PGP SIGNATURE-----
_______________________________________________
tsl-announce mailing list
tsl-announce@lists.trustix.org
http://lists.trustix.org/mailman/listinfo/tsl-announce