Home > Security > Advisories


Mandriva Advisories

Package name stunnel
Date November 25th, 2003
Advisory ID MDKSA-2003:108
Affected versions 9.0, CS2.1
Synopsis Updated stunnel packagess fix vulnerabilities

Problem Description

A vulnerability was discovered in stunnel versions 3.24 and earlier,
as well as 4.00, by Steve Grubb. It was found that stunnel leaks a
critical file descriptor that can be used to hijack stunnel's services.

All users are encouraged to upgrade to these packages. Note that the
version of stunnel provided with Mandrake Linux 9.1 and above is not
vulnerable to this problem.

Updated Packages

Mandrakelinux 9.0

 6b3eec02f63aa0d7aa64fe79b62e3020  9.0/RPMS/stunnel-3.26-1.1.90mdk.i586.rpm
14afcc8f0257338107bc60e33919a465  9.0/SRPMS/stunnel-3.26-1.1.90mdk.src.rpm

Corporate Server 2.1

 77c752f98e0685dd677656e56b6a931c  corporate/2.1/RPMS/stunnel-3.26-1.1.C21mdk.i586.rpm
45596e6e50ed995cf4b18f9bd7366828  corporate/2.1/SRPMS/stunnel-3.26-1.1.C21mdk.src.rpm

Corporate Server 2.1/X86_64

 f080fa4956c146a3e40dc05ae6dbefe8  x86_64/corporate/2.1/RPMS/stunnel-3.26-1.1.C21mdk.x86_64.rpm
45596e6e50ed995cf4b18f9bd7366828  x86_64/corporate/2.1/SRPMS/stunnel-3.26-1.1.C21mdk.src.rpm




To upgrade automatically, use MandrivaUpdate.


Please verify the update prior to upgrading to ensure the integrity of the downloaded package. You can do this with the command :

                rpm --checksig package.rpm

You can get the GPG public key of the Mandriva Security Team to verify the GPG signature of each RPM.

If you use MandrivaUpdate, the verification of md5 checksum and GPG signature is performed automatically for you.