RHBA-2007:0565 - Bug Fix Advisory

Topic

Updated tcp_wrappers packages that fix several bugs are now available.

Description

The tcp_wrappers package provides small daemon programs which can monitor
and filter incoming requests for systat, finger, FTP, telnet, rlogin, rsh,
exec, tftp, talk and other network services. It also contains the libwrap
library that adds the same filtering capabilities to programs linked
against it, like sshd and more.

This update brings the following changes:

• localhost and localhost.localdomain are treated as being equivalent when

comparing the client hostname and the list of allowed/denied hostnames.

• the hosts_ctl function uses the address parameter to get the ip address

and resolve it to symbolic hostname, if not given.

• the behavior of signal handling when the "spawn" option is used has been

changed to be transparent to the application using the library.

These fixes correct the behavior of certain applications, including
net-snmp and vsftpd.

Users should upgrade to this updated package, which resolves these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 241357 - allowed vsftp session hangs when tcp wrappers spawn is used
• BZ - 246216 - IPv6: bad interaction between tcp_wrappers and DNS, vsftpd

CVEs

• CVE-2009-0786

References

(none)