Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

http://www.samba.org/samba/security/CVE-2010-2063.html

How can I check to see if the Redhat (CentOS) repositories have backported a fix?

share|improve this question
    
Related question (which I believe would answer yours): Does CentOS / RHEL have a web-based package list and search site, like packages.ubuntu.com ? That is a very handy site for me. –  Luke has no name Jun 18 '10 at 19:01
    
Nope it doesn't! serverfault.com/questions/239205/… –  Coops Mar 8 '11 at 7:49
add comment

2 Answers

up vote 3 down vote accepted

It's a combination of RedHat Bugzilla, RedHat Errata, and CentOS mirrors.
First, using the CVE-2010-XXXX visit https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-XXXX. When you see that the issue has been addressed follow that link to the RedHat errata.
Grab the rpm version and head to a CentOS mirror.

For example the latest sudo vulnerability (CVE-2010-1646):

bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-1646 (last comment->) rhn.redhat.com/errata/RHSA-2010-0475.html (copy sudo-1.7.2p1-7.el5_5.x86_64.rpm) mirror.cs.vt.edu/pub/CentOS/5/updates/x86_64/RPMS/ (it matches RedHat's errrata)

The samba vuln hasn't been packaged for CentOS and sent upstream as far as I can tell.

share|improve this answer
    
Link to redhat's offical CVE database: redhat.com/security/data/cve which gives a CVE orientated view, rather than a bug orientated one. –  Coops Mar 8 '11 at 7:49
add comment

rpm -q --changelog <package name> will show the package changelog, where vulnerabilities that have been patched in a package are enumerated. Additionally, the CentOS package announcement mailing list also gives the added portions of the changelog when the package is released.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.