MDKSA-2007:004

Package name

geoip

Date

2007-01-08

Advisory ID

MDKSA-2007:004

Affected versions

CS4.0 x86_64 , CS4.0 i586

Problem description

Dean Gaudet discovered the geoipupdate utility fails to do sanity
checking on the filename returned by "GET
/app/update_getfilename?product_id=%s".

Updated packages are patched to address this issue.

Updated packages

CS4.0 x86_64

 fee7fd2c73be1c3a8b86c83e9b614192  corporate/4.0/x86_64/geoip-1.4.0-2.1.20060mlcs4.x86_64.rpm
 0232c0ff1b9463ccddb155de4095fd47  corporate/4.0/x86_64/lib64geoip1-1.4.0-2.1.20060mlcs4.x86_64.rpm
 a29ebe06132643a78ae9948fff1eb0bd  corporate/4.0/x86_64/lib64geoip1-devel-1.4.0-2.1.20060mlcs4.x86_64.rpm
 97ef3b059e9771b7c0783c66f0106f29  corporate/4.0/x86_64/lib64geoipupdate0-1.4.0-2.1.20060mlcs4.x86_64.rpm 
 2ebfd111dd8511dc3cec4ade7ce39f73  corporate/4.0/SRPMS/geoip-1.4.0-2.1.20060mlcs4.src.rpm

CS4.0 i586

 fa1f121647c2537c612bd06cb696bf45  corporate/4.0/i586/geoip-1.4.0-2.1.20060mlcs4.i586.rpm
 b7121479dd6061d651e1596d6d088742  corporate/4.0/i586/libgeoip1-1.4.0-2.1.20060mlcs4.i586.rpm
 4672680cd19c237b0972c31428b5643d  corporate/4.0/i586/libgeoip1-devel-1.4.0-2.1.20060mlcs4.i586.rpm
 e5df2bdfcdcf1da47ff30756fe6515cb  corporate/4.0/i586/libgeoipupdate0-1.4.0-2.1.20060mlcs4.i586.rpm 
 2ebfd111dd8511dc3cec4ade7ce39f73  corporate/4.0/SRPMS/geoip-1.4.0-2.1.20060mlcs4.src.rpm

References

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0159
• http://arctic.org/~dean/patches/GeoIP-1.4.0-update-vulnerability.patch