Yellow Dog Linux Security Announcement
--------------------------------------

Package:	usermode
Issue Date: 	September 13, 2000
Update Date: 	September 13, 2000
Priority:  	medium
Advisory ID: 	YDU-20000913-3


1. Topic:

   A new usermode package is available to fix several
   problems.


2. Problem:
   
   Usermode provides unprivileged users at the system console the ability
   to run the halt, poweroff, reboot, and shutdown commands without the
   super-user password. However, "shutdown now" allows the user to 
   bring the system into single-user mode which is a security problem.
   This update removes "shutdown" from the list of commands unprivileged
   users can run.


3. Solution:

   a) Updating via yup...
   We suggest that you use the Yellow Dog Update Program (yup)
   to keep your system up-to-date. The following command will
   automatically retrieve and install the fixed version of
   usermode onto your system:

   	yup update usermode

   b) Updating manually...
   The update can also be retrieved manually from our ftp site
   below along with the rpm command that should be used to install
   the update.

   ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/champion-1.2/ppc/RPMS/
   usermode-1.35-1.ppc.rpm

        rpm -Fvh usermode-1.35-1.ppc.rpm


4. Verification

MD5 checksum				Package
--------------------------------	----------------------------
523564bf043776e96e8916a6e8372637  	RPMS/usermode-1.35-1.ppc.rpm
2740debc16fd2078cb6412b7e3858b05	SRPMS/usermode-1.35-1.src.rpm


If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml