| Summary: | openslp new security issue CVE-2016-7567 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | davidwhodgins, lewyssmith, mageia, mhrambo3501, sysadmin-bugs |
| Version: | 5 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://lwn.net/Vulnerabilities/704249/ | ||
| Whiteboard: | advisory MGA5-64-OK MGA5-32-OK | ||
| Source RPM: | openslp-2.0.0-5.1.mga5.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2016-09-28 13:59:51 CEST
Lewis Smith
2016-10-10 21:02:33 CEST
CC:
(none) =>
davidwhodgins, lewyssmith Dave (W Hodgins) As with a previous bug https://bugs.mageia.org/show_bug.cgi?id=18600#c2, you seem our sole competent person on openslp, and seemed to be able to test it relatively easily. Are you able to try this update? As before, I added you to the CC list in hope. TIA
Nicolas Lécureuil
2016-10-12 11:21:23 CEST
CC:
(none) =>
mageia Using the process at https://bugs.mageia.org/show_bug.cgi?id=18600#c2 on mga5 x86_64 and cauldron x86_64 machines. [mrambo@rambobox ~]$ sudo urpmi openslp [mrambo@rambobox ~]$ rpm -qa | grep openslp openslp-2.0.0-5.1.mga5 [mrambo@rambobox ~]$ sudo systemctl start slpd [mrambo@rambobox ~]$ slptool findsrvs service:service-agent service:service-agent://192.168.3.23,65535 service:service-agent://192.168.3.83,65535 [mrambo@rambobox ~]$ sudo systemctl stop slpd Enabled updates-testing repo. [mrambo@rambobox ~]$ sudo urpmi openslp [mrambo@rambobox ~]$ rpm -qa | grep openslp openslp-2.0.0-5.2.mga5 [mrambo@rambobox ~]$ slptool findsrvs service:service-agent service:service-agent://192.168.3.23,65535 service:service-agent://192.168.3.83,65535 Results are the same with the update installed and were similar from the other end on the cauldron machine. This only validates mga5 x86_64 as I don't have a 32 bit installation available at present but x86_64 looks good to me. CC:
(none) =>
mrambo Mike, you have to be careful with testing updates like this with multiple subpackages and especially libraries. It looks like you only updated openslp, but not lib64slp1. Rather than using urpmi (which will mess up orphan tracking if you manually urpmi the libs), if you edit /etc/urpmi/urpmi.cfg and mark updates_testing as an update medium, you can use MageiaUpdate to install updated packages from updates_testing, so you can be sure you've selected the right ones without messing up orphan tracking. Re-ran the test using the process at https://bugs.mageia.org/show_bug.cgi?id=18600#c2 on mga5 x86_64 and cauldron x86_64 machines. [mrambo@rambobox ~]$ sudo urpmi openslp [mrambo@rambobox ~]$ rpm -qa | grep slp openslp-2.0.0-5.1.mga5 lib64slp1-2.0.0-5.1.mga5 [mrambo@rambobox ~]$ sudo systemctl start slpd [mrambo@rambobox ~]$ slptool findsrvs service:service-agent service:service-agent://192.168.3.23,65535 service:service-agent://192.168.3.83,65535 [mrambo@rambobox ~]$ sudo systemctl stop slpd Enabled updates-testing repo and specifically installed both parts since there are only two. [mrambo@rambobox ~]$ sudo urpmi openslp lib64slp1 [mrambo@rambobox ~]$ rpm -qa | grep openslp openslp-2.0.0-5.2.mga5 lib64slp1-2.0.0-5.2.mga5 [mrambo@rambobox ~]$ slptool findsrvs service:service-agent service:service-agent://192.168.3.23,65535 service:service-agent://192.168.3.83,65535 Found that the results were the same. The package and the library both look good on mga5 x86_64. Sorry for the mistake. Repeated tests from https://bugs.mageia.org/show_bug.cgi?id=18600#c2 with same good results. Validating the update. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2016-0348.html Status:
NEW =>
RESOLVED
David Walser
2016-10-21 18:17:19 CEST
URL:
(none) =>
http://lwn.net/Vulnerabilities/704249/ |