__________________________________________________________ The U.S. Department of Energy Computer Incident Advisory Capability ___ __ __ _ ___ / | /_\ / \___ __|__ / \ \___ __________________________________________________________ INFORMATION BULLETIN Red Hat Updated SSL Certificate for access to 'up2date' [Red Hat Advisory RHSA-2003:267-10] August 29, 2003 19:00 GMT Number N-139 ______________________________________________________________________________ PROBLEM: Red Hat has released new packages for the up2date and rhn_register clients and are required for continued access to the Red Hat Network. These packages contain the SSL certificate necessary to continue accessing the Red Hat Network after August 28, 2003. PLATFORM: Red Hat Linux 7.1, 7.2, 7.3, 8.0, and 9 DAMAGE: Without the new CA certificate starting August 29, 2003, users will see SSL Connection Errors reported by up2date or rhn_register. This includes both interactive use of up2date, as well as actions scheduled by the RHN website. SOLUTION: Update to Red Hat's new erratum packages as described in their advisory. ______________________________________________________________________________ VULNERABILITY The risk is LOW. New packages or patches still may be obtained ASSESSMENT: online by using the links on Red Hat's individual advisories. ______________________________________________________________________________ LINKS: CIAC BULLETIN: http://www.ciac.org/ciac/bulletins/n-139.shtml ORIGINAL BULLETIN: https://rhn.redhat.com/errata/RHSA-2003-267.html ______________________________________________________________________________ [***** Start Red Hat Advisory RHSA-2003:267-10 *****] New up2date available with updated SSL certificate authority file Advisory: RHSA-2003:267-10 Last updated on: 2003-08-29 Affected Products: Red Hat Linux 7.1 Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 Red Hat Linux 9 Security Advisory Details: New versions of the up2date and rhn_register clients are available and are required for continued access to Red Hat Network. The rhn_register and up2date packages contain the software necessary to take advantage of Red Hat Network functionality. This erratum includes an updated RHNS-CA-CERT file, which contains a new CA certificate. This new certificate is needed so that up2date can continue to communicate with Red Hat Network after 28 August 2003. Without this updated certificate, users will see SSL Connection Errors reported by up2date or rhn_register. All users must upgrade to these erratum packages in order to continue to use Red Hat Network. This includes both interactive use of up2date, as well as actions scheduled by the RHN website. Updated packages: Red Hat Linux 7.1 -------------------------------------------------------------------------------- SRPMS: up2date-2.8.40-1.7.1.src.rpm [ via FTP ] [ via HTTP ] b67ea5065c3115d523e17561aac5cb7c i386: up2date-2.8.40-1.7.1.i386.rpm [ via FTP ] [ via HTTP ] 71f2f6e4bfcdee8f4f46ef037c7a1c8d up2date-gnome-2.8.40-1.7.1.i386.rpm [ via FTP ] [ via HTTP ] 2205d1e5832dbb67d60103104eb59fec Red Hat Linux 7.2 ----------------------------------------------------------------------------- SRPMS: up2date-2.8.40-2.7.2.src.rpm [ via FTP ] [ via HTTP ] 3deea256b106e71ee6d5890639d872b3 i386: up2date-2.8.40-2.7.2.i386.rpm [ via FTP ] [ via HTTP ] 21bc8e1f03e9f28590d46df60a9458b5 up2date-gnome-2.8.40-2.7.2.i386.rpm [ via FTP ] [ via HTTP ] 3d3d7c6dca73d521a0f541b859f13eb3 ia64: up2date-2.8.40-2.7.2.ia64.rpm [ via FTP ] [ via HTTP ] ac5161a5bbe122896eccbc312bef9273 up2date-gnome-2.8.40-2.7.2.ia64.rpm [ via FTP ] [ via HTTP ] c789fbf88d7faf82504eb4189b767f90 Red Hat Linux 7.3 -------------------------------------------------------------------------------- SRPMS: up2date-2.8.40-3.7.3.src.rpm [ via FTP ] [ via HTTP ] 23d8868920cb7df21925669f04fb2ad2 i386: up2date-2.8.40-3.7.3.i386.rpm [ via FTP ] [ via HTTP ] 3643d7774d7e60a1aeb79c8fecbf624c up2date-gnome-2.8.40-3.7.3.i386.rpm [ via FTP ] [ via HTTP ] 89977334ec0d3a2a720c3303602fc8dd Red Hat Linux 8.0 ----------------------------------------------------------------------------- SRPMS: up2date-3.0.7.2-1.src.rpm [ via FTP ] [ via HTTP ] 17ad92db4579d046d84c84a16784ba98 i386: up2date-3.0.7.2-1.i386.rpm [ via FTP ] [ via HTTP ] 15bc5dc918916bca3a5c29148979716e up2date-gnome-3.0.7.2-1.i386.rpm [ via FTP ] [ via HTTP ] 1ae89cf79880f3bc5de7b86eb1d47a2b Red Hat Linux 9 ----------------------------------------------------------------------------- SRPMS: up2date-3.1.23.2-1.src.rpm [ via FTP ] [ via HTTP ] b8a5b2d548869a846cbaf373f3637555 i386: up2date-3.1.23.2-1.i386.rpm [ via FTP ] [ via HTTP ] 3faabcb9cc610627fe378b88d0b2b928 up2date-gnome-3.1.23.2-1.i386.rpm [ via FTP ] [ via HTTP ] 733d0aca17c15af0b1fa709ba86337dc Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Because the previous Certificate Authority has expired, up2date will present 'SSL Certificate Errors' if you attempt to use it to apply this errata. Therefore, this update cannot be applied directly with up2date and instead must be applied as indicated above. In addition to the Red Hat FTP site, the latest versions of up2date and rhn_register are also available at https://rhn.redhat.com/help/latest-up2date.pxt For users who would prefer to install the new certificate directly, it is available at: https://rhn.redhat.com/help/ssl_cert.pxt Keywords: Hat, Network, Red, rhn_register, up2date ----------------------------------------------------------------------------- The listed packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/solutions/security/news/publickey/#key You can verify each package and see who signed it with the following command: rpm --checksig -v filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: md5sum filename The Red Hat security contact is security@redhat.com. More contact details at http://www.redhat.com/solutions/security/news/contact.html Copyright © 2002 Red Hat, Inc. All rights reserved. Search by Google Careers at Red Hat : Legal statement : Privacy statement : Your Account : Credits : Contact Red Hat [***** End Red Hat Advisory RHSA-2003:267-10 *****] _______________________________________________________________________________ CIAC wishes to acknowledge the contributions of Red Hat, Inc. for the information contained in this bulletin. _______________________________________________________________________________ CIAC, the Computer Incident Advisory Capability, is the computer security incident response team for the U.S. Department of Energy (DOE) and the emergency backup response team for the National Institutes of Health (NIH). CIAC is located at the Lawrence Livermore National Laboratory in Livermore, California. CIAC is also a founding member of FIRST, the Forum of Incident Response and Security Teams, a global organization established to foster cooperation and coordination among computer security teams worldwide. CIAC services are available to DOE, DOE contractors, and the NIH. CIAC can be contacted at: Voice: +1 925-422-8193 (7x24) FAX: +1 925-423-8002 STU-III: +1 925-423-2604 E-mail: ciac@ciac.org Previous CIAC notices, anti-virus software, and other information are available from the CIAC Computer Security Archive. World Wide Web: http://www.ciac.org/ Anonymous FTP: ftp.ciac.org PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing communities receive CIAC bulletins. If you are not part of these communities, please contact your agency's response team to report incidents. Your agency's team will coordinate with CIAC. The Forum of Incident Response and Security Teams (FIRST) is a world-wide organization. A list of FIRST member organizations and their constituencies can be obtained via WWW at http://www.first.org/. This document was prepared as an account of work sponsored by an agency of the United States Government. Neither the United States Government nor the University of California nor any of their employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, completeness, or usefulness of any information, apparatus, product, or process disclosed, or represents that its use would not infringe privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by the United States Government or the University of California. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or the University of California, and shall not be used for advertising or product endorsement purposes. LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC) N-129: Oracle Unauthorized Disclosure of Information in E-Business Suite N-130: SGI IRIX nsd Server AUTH_UNIX gid list Vulnerability N-131: Sun Solaris Runtime Linker ld.so.1(1) Vulnerability N-132: Red Hat wu-ftpd Buffer Overflow Vulnerability N-133: Blaster Worm (aka: W32.Blaster, MSBlast, Lovsan, Win32.Poza) N-134: Sun cachefs Patches May Overwrite inetd.conf File N-135: Microsoft Cumulative Patch for Internet Explorer N-136: Microsoft Unchecked Buffer in MDAC Function Vulnerability N-137: Red Hat Updated pam_smb packages fix remote buffer overflow N-138: Red Hat Updated Sendmail packages fix vulnerability