New slocate packages available to fix local group slocate compromise

New slocate packages are availble for Red Hat Linux 6.x and Red Hat
Linux 7. These fix a problem with the database parsing code in slocate.
(slocate was not shipped with Red Hat Linux prior to version 6.0, so
earlier versions are not affected.)

A problem existed in the slocate database parsing code. By using a
carefully
crafted database, a local user could overwrite some of slocate's internal
structures, leading to a local group slocate compromise.

The affect of this compromise is that users could read the entire slocate
database, and therefore learn the locations of files that they normally
would not have permissions to locate.

Thanks to Michel Kaempf, zorgon@linuxstart.com, and Michal Zalewski
for pointing out the vulnerability.

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0066
http://www.securityfocus.com/bid/2004

overflow