Skip to navigation

Security Advisory slocate security update

Advisory: RHSA-2005:346-19
Type: Security Advisory
Severity: Low
Issued on: 2005-10-05
Last updated on: 2005-10-05
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2005-2499

Details

An updated slocate package that fixes a denial of service and various bugs
is available.

This update has been rated as having low security impact by the Red Hat
Security Response Team.

Slocate is a security-enhanced version of locate. Like locate, slocate
searches through a central database (updated nightly) for files that match
a given pattern. Slocate allows you to quickly find files anywhere on your
system.

A bug was found in the way slocate scans the local filesystem. A carefully
prepared directory structure could cause updatedb's file system scan to
fail silently, resulting in an incomplete slocate database. The Common
Vulnerabilities and Exposures project has assigned the name CAN-2005-2499
to this issue.

Additionally this update addresses the following issues:

- File system type exclusions were processed only when starting updatedb
and did not reflect file systems mounted while updatedb was running
(for example, automounted file systems.)

- File system type exclusions were ignored for file systems that were
mounted to a path containing a symbolic link.

- Databases created by slocate were owned by the slocate group even if they
were created by regular users.

- The default configuration excluded /mnt/floppy, but not /media.

- The default configuration did not exclude nfs4 file systems.

Users of slocate are advised to upgrade to this updated package, which
contains backported patches and is not affected by these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 4)

SRPMS:
slocate-2.7-13.el4.6.src.rpm
File outdated by:  RHBA-2007:0869
    MD5: c7c0214f195ee403dac138a588bc3e8e
 
IA-32:
slocate-2.7-13.el4.6.i386.rpm
File outdated by:  RHBA-2007:0869
    MD5: 631c577185c94d9eb435ad0a792b04a4
 
x86_64:
slocate-2.7-13.el4.6.x86_64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 76d6a19aafbca5f63e04fd28bceea094
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
slocate-2.7-13.el4.6.src.rpm
File outdated by:  RHBA-2007:0869
    MD5: c7c0214f195ee403dac138a588bc3e8e
 
IA-32:
slocate-2.7-13.el4.6.i386.rpm
File outdated by:  RHBA-2007:0869
    MD5: 631c577185c94d9eb435ad0a792b04a4
 
IA-64:
slocate-2.7-13.el4.6.ia64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 637f060239a27fc84e57f0c0877840be
 
PPC:
slocate-2.7-13.el4.6.ppc.rpm
File outdated by:  RHBA-2007:0869
    MD5: 790b0129014db4f62fb735cc6da16773
 
s390:
slocate-2.7-13.el4.6.s390.rpm
File outdated by:  RHBA-2007:0869
    MD5: d990745ab56de4211e3912c915d8f8ef
 
s390x:
slocate-2.7-13.el4.6.s390x.rpm
File outdated by:  RHBA-2007:0869
    MD5: 441e2ccafcd7f1aed2a17b26d310eaf4
 
x86_64:
slocate-2.7-13.el4.6.x86_64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 76d6a19aafbca5f63e04fd28bceea094
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
slocate-2.7-13.el4.6.src.rpm
File outdated by:  RHBA-2007:0869
    MD5: c7c0214f195ee403dac138a588bc3e8e
 
IA-32:
slocate-2.7-13.el4.6.i386.rpm
File outdated by:  RHBA-2007:0869
    MD5: 631c577185c94d9eb435ad0a792b04a4
 
IA-64:
slocate-2.7-13.el4.6.ia64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 637f060239a27fc84e57f0c0877840be
 
x86_64:
slocate-2.7-13.el4.6.x86_64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 76d6a19aafbca5f63e04fd28bceea094
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
slocate-2.7-13.el4.6.src.rpm
File outdated by:  RHBA-2007:0869
    MD5: c7c0214f195ee403dac138a588bc3e8e
 
IA-32:
slocate-2.7-13.el4.6.i386.rpm
File outdated by:  RHBA-2007:0869
    MD5: 631c577185c94d9eb435ad0a792b04a4
 
IA-64:
slocate-2.7-13.el4.6.ia64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 637f060239a27fc84e57f0c0877840be
 
x86_64:
slocate-2.7-13.el4.6.x86_64.rpm
File outdated by:  RHBA-2007:0869
    MD5: 76d6a19aafbca5f63e04fd28bceea094
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

139950 - slocate collects .automount files over nfs
152253 - Incorrect path in /etc/updatedb.conf
156091 - updatedb indexes nfs4 filesystems
165430 - CAN-2005-2499 slocate DOS


References


Keywords

automount, updatedb


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/