Yellow Dog Linux Security Announcement
--------------------------------------

Package:	ucd-snmp	
Issue Date: 	February 11, 2002	
Priority:	high		
Advisory ID: 	YDU-20020211-1


1. 	Topic:

	The ucd-snmp packages have been updated to
	prevent denial of service attacks and other
	security flaws recently discovered.


2. 	Problem:

	"The Simple Network Management Protocol (SNMP) enables
	monitoring and configuration of network nodes.

	The Oulu University Secure Programming Group performed
	a vulnerability assessment of various SNMP implementations
	through syntax testing and test-suite creation.

	The test-suite showed several failures in the ucd-snmp tools
	in version 4.2.2 and earlier. These vulnerabilities can cause
	denial-of-service conditions, service interruptions, and in
	some cases could result in a remote security breach.

	Updated ucd-snmp packages are provided that are not susceptible
	to these vulnerabilities and which pass all tests of the test-suite
	sucessfully.

	The Common Vulnerabilities and Exposures project (cve.mitre.org)
	has assigned the names CAN-2002-0012 and CAN-2002-0013 to these
	issues.

	All users of ucd-snmp should upgrade to these errata packages."
	(from Red Hat advisory)
	

3. 	Solution:

   	a) Updating via yup...
   	We suggest that you use the Yellow Dog Update Program (yup)
   	to keep your system up-to-date. The following command(s) will
   	automatically retrieve and install the fixed version of
   	this update onto your system:

   		yup update ucd-snmp 
		yup update ucd-snmp-devel
		yup update ucd-snmp-utils
 

   	b) Updating manually...
   	The update can also be retrieved manually from our ftp site
   	below along with the rpm command that should be used to install
   	the update.  (Please use a mirror site)

   		ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-2.1/ppc/
		rpm -Fvh ucd-snmp-4.2.3-1.7.0.3.ppc.rpm
		rpm -Fvh ucd-snmp-devel-4.2.3-1.7.0.3.ppc.rpm
		rpm -Fvh ucd-snmp-utils-4.2.3-1.7.0.3.ppc.rpm


4. Verification

MD5 checksum			  Package
--------------------------------  ----------------------------
734c0fef3672af49241325526bfd2125  ppc/ucd-snmp-4.2.3-1.7.0.3.ppc.rpm
08cf1e66f3673ae41e2fc5dcc14df2e7  ppc/ucd-snmp-devel-4.2.3-1.7.0.3.ppc.rpm
c220592385f2180905428985c234f3fd  ppc/ucd-snmp-utils-4.2.3-1.7.0.3.ppc.rpm
cc8f148b8089dfe0371a4b4312b10356  SRPMS/ucd-snmp-4.2.3-1.7.0.3.src.rpm

If you wish to verify that each package has not been corrupted or tampered with,
examine the md5sum with the following command: rpm --checksig --nogpg filename


5. Misc.

Terra Soft has setup a moderated mailing list where these security, bugfix, and package
enhancement announcements will be posted. See http://lists.yellowdoglinux.com/ for more
information.

For information regarding the usage of yup, the Yellow Dog Update Program, see 
http://http://www.yellowdoglinux.com/support/solutions/ydl_general/yup.shtml