--------------------------------------------------------------------------
  Turbolinux Security Advisory TLSA-2002-77
  http://www/turbolinux.co.jp/security/
                                            security-team@turbolinux.co.jp
--------------------------------------------------------------------------

Analog

System stop by local user

   Release date : 2002-11-30

   Solution: package : analog-5.24-2

   Problematical point
    * Making use of vulnerability of the anlgform.pl, local user can cause system to stop

   Solution:
    Using turbopkg command, please do automatic operation update.
    When necessary, update is done automatically.

Use the following command to verify the version currently installed.

    # rpm -qa | grep package name

     When automatic operation update is used, all objects update.
    Select the package, and use the rpm command to select when you would like to update.

    Execution example
    ---------------------------------------------------------------------
    1. In super user modification
    $ su -

    2. Password of super user input
    Password:

    3. Starting the turbopkg
    # turbopkg

    4. Menu selection
    " Update "
    
    " FTP server "
    
    " Update sight "
    
    Optional sight selection

    5. In general user modification
    # exit
    ---------------------------------------------------------------------


    < Turbolinux 8 Server >
    < Turbolinux 8 Workstation >
    < Turbolinux 7 Server >
    < Turbolinux 7 Workstation >

    analog-5.24-2.i586.rpm

    < Turbolinux Advanced Server 6 >
    < Turbolinux Server 6.1 >

    analog-5.24-2.i386.rpm

    < Turbolinux Server 6.5 >
    < Turbolinux Workstation 6.0 >

    * Because the analog package is not recorded in the above-mentioned product, it is not necessary to update.


    * Upon the maintenance of our company FTP sight, we determined that update of the turbopkg is neccesary. Details the below-mentioned URL reference.
http://www.turbolinux.co.jp/download/zabom.html

Package updates: http://www.turbolinux.co.jp/update/