Red Hat ENTERPRISE 5.4 RELEASE NOTES, Manual

Page: 240 / 466

Chapter 1. Package Updates
222
A flaw was found in the way the Ruby POP module processed certain APOP authentication requests.
By sending certain responses when the Ruby APOP module attempted to authenticate using APOP
against a POP server, a remote attacker could, potentially, acquire certain portions of a user's
authentication credentials. (
CVE-2007-1558
1524
)
It was discovered that Ruby did not properly check the return value when verifying X.509 certificates.
This could, potentially, allow a remote attacker to present an invalid X.509 certificate, and have Ruby
treat it as valid. (
CVE-2009-0642
1525
)
A flaw was found in the way Ruby converted BigDecimal objects to Float numbers. If an attacker were
able to provide certain input for the BigDecimal object converter, they could crash an application using
this class. (
CVE-2009-1904
1526
)
All Ruby users should upgrade to these updated packages, which contain backported patches to
resolve these issues.
1.200. s390utils
1.200.1. RHBA-2009:1311: bug fix and enhancement update
An updated s390utils package that fixes multiple bugs and adds various enhancements is now
available.
The s390utils package contains utilities related to Linux for the IBM S/390 architecture.
This update fixes these bugs:
• the dasdfmt tool prevented devices with record 0 set in the Define Extent CCW from being
formatted, unless the channel program had initially changed the RO. This differed from the expected
functionality. The tool has been updated to allow ECKD DASD devices that do not contain a default
record 0 to be formatted. (
BZ#474157
1527
)
• the /etc/profile.d/s390x.chs profile script was causing tcsh -e scripts to fail because the /sbin/
consoletype was returning a non-zero value. The profile script has now been updated to supply a
stdout argument that forces consoletype to return 0 in all cases. (
BZ#505283
1528
)
• the ziomon tool contained an unsupported upstream patch from the blkiomon package. This resulted
in the tool aborting when blkiomon was called by ziomon. The ziomon utility is now updated to use
the new blkiomon_stat layout implemented by IBM. (
BZ#506966
1530 1529
)
• the lsluns tool was incorrectly displaying encrypted disks as unencrypted because the encryption
check was performed on the 0x8 bit instead of the 0x80 bit. The lsluns tool now correctly displays
the encryption status of the selected disk. (
BZ#510032
1531
)
And adds these enhancements:
• the zipl tool prevented customers using a menu configuration file from disabling the automenu
unless the -x option was specified. This caused confusion when using the tool, and forced
customers to specify an extra option when using the utility. Customers are now able to specify the
defaultmenu option, which displays the menu specified in the menu configuration file and disables
the automenu. (
BZ#486444
1532
)
1524
https://www.redhat.com/security/data/cve/CVE-2007-1558.html
1525
https://www.redhat.com/security/data/cve/CVE-2009-0642.html
1526
https://www.redhat.com/security/data/cve/CVE-2009-1904.html