RHBA-2008:0917 - Bug Fix Advisory

Topic

Updated inn packages that resolve several issues are now available.

Description

The inn package contains complete system for serving Usenet news and/or
private newsfeeds. INN includes innd, an NNTP (NetNews Transport Protocol)
server, and nnrpd, a newsreader that is spawned for each client. Both innd
and nnrpd vary slightly from the NNTP protocol, but not in ways that are
easily noticed.

These updated inn packages provide fixes for the following bugs:

• several directories under and including the /usr/lib/news/ directory were

not owned by inn, which could lead to the mislabeling (wrong context) of
those directories under SELinux. In these updated packages, these
directories are owned by the "news" user and the "news" group, thus
resolving this issue.

• when installing Red Hat Enterprise Linux 5.2 with the "everything"

option, inn failed to install with a "could not open session" error due to
the absence of a required Pluggable Authentication Module (PAM). The
attempt to initialize session has instead been moved to the innd init
script, where it is now established the first time that inn is run.

• the init script for the innd daemon would sometimes exit with incorrect

or invalid return codes, thus causing the 'status' command to return an
incorrect value. This has been fixed so that the init script is compliant
with Linux Standard Base (LSB) guidelines, which resolves these issues.

• the rnews job, set in /etc/cron.hourly/inn-cron-rnews, ran as the user

"news" and the group "news", but was unable to write messages to the
/var/spool/incoming directory. In these updated packages, this directory,
as well as the /var/spool/incoming/bad directory, are writable by the
"news" group, thus allowing rnews to write to it and resolving this issue.

All users of inn are advised to upgrade to these updated packages, which
resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 238133 - Wrong init script
• BZ - 448088 - inn should own /usr/lib/news/bin and /usr/lib/news/bin/auth/{resolv,passwd} directories

CVEs

(none)

References

(none)