5263541 2000-07-10 10:03 /150 rader/ Postmaster
Mottagare: Bugtraq (import) <11658>
Ärende: Security Update: symlink attack on makewhatis script possible
------------------------------------------------------------
Approved-By: aleph1@SECURITYFOCUS.COM
Delivered-To: bugtraq@lists.securityfocus.com
Delivered-To: bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Message-ID: <20000707164219.A8180@phoenix.calderasystems.com>
Date: Fri, 7 Jul 2000 16:42:19 -0600
Reply-To: Technical Support <support@PHOENIX.CALDERASYSTEMS.COM>
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: Technical Support <support@PHOENIX.CALDERASYSTEMS.COM>
X-To: annouce@lists.calderasystems.com, linux-security@redhat.com
To: BUGTRAQ@SECURITYFOCUS.COM
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
Caldera Systems, Inc. Security Advisory
Subject: symlink attack on makewhatis script possible
Advisory number: CSSA-2000-021.0
Issue date: 2000 July, 6
Cross reference:
______________________________________________________________________________
1. Problem Description
There is a problem in the way the makewhatis script, which is run
daily to rebuild the database used by the whatis(1) command,
handles temporary files. This can be exploited by local users to
corrupt arbitrary files on the system.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux Desktop 2.3 All packages previous to
man-1.5f-6
OpenLinux eServer 2.3 All packages previous to
and OpenLinux eBuilder man-1.5f-6
OpenLinux eDesktop 2.4 All packages previous to
man-1.5g-2
3. Solution
Workaround:
Delete the cron job that runs the makewhatis script daily by
typing
rm -f /etc/cron.d/Daily/*makewhatis
The proper solution is to upgrade to the fixed packages.
4. OpenLinux Desktop 2.3
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS
4.2 Verification
41b80d7c8c54d34da28675d1c278ee45 RPMS/man-1.5f-6.i386.rpm
3845595f1bcbdff4e50aa96b43e244e3 SRPMS/man-1.5f-6.src.rpm
4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -F man-1.5f-6.i386.rpm
5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
257782369c23c8b64858d0110447453f RPMS/man-1.5f-6.i386.rpm
3845595f1bcbdff4e50aa96b43e244e3 SRPMS/man-1.5f-6.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -F man-1.5f-6.i386.rpm
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
a3937cd965cc422ba2ca03071958b046 RPMS/man-1.5g-2.i386.rpm
d64f3e0b7d85e57f5be81272e1c6ae3b SRPMS/man-1.5g-2.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -F man-1.5g-2.i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 7127.
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any of
the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE5ZKyE18sy83A/qfwRAsI9AJ9ko+qJnoteLsqAYKx+/6iFbGTvqwCffdwW
eDp1zSyqpnw83qc2uJvSYG4=
=SDw8
-----END PGP SIGNATURE-----
(5263541) ------------------------------------------(Ombruten)