5790946 2000-11-27 14:46 -0500 /144 rader/ <bugzilla@redhat.com>
Sänt av: mail@mail.nation.liu.se
Importerad: 2000-11-28 19:27 av Brevbäraren (som är implementerad i) Python
Extern mottagare: redhat-watch-list@redhat.com
Extern kopiemottagare: security-alert@linuxsecurity.com
Extern kopiemottagare: bugtraq@securityfocus.com
Extern kopiemottagare: linux-security@redhat.com
Mottagare: Root (@) Nationernas Hus <13684>
Mottagare: Red Hat Announce (import) <1694>
Sänt: 2000-11-28 19:37
Ärende: [RHSA-2000:115-02] New ncurses packages fixing buffer overrun available
------------------------------------------------------------
From: bugzilla@redhat.com
To: redhat-watch-list@redhat.com
Cc: security-alert@linuxsecurity.com, bugtraq@securityfocus.com,
linux-security@redhat.com
Message-ID: <200011271947.eARJl0u03890@porkchop.redhat.com>
---------------------------------------------------------------------
Red Hat, Inc. Security Advisory
Synopsis: New ncurses packages fixing buffer overrun available
Advisory ID: RHSA-2000:115-02
Issue date: 2000-11-23
Updated on: 2000-11-26
Product: Red Hat Linux
Keywords: ncurses buffer overrun exploit setuid
Cross references: N/A
---------------------------------------------------------------------
1. Topic:
If you are any setuid applications that use ncurses and its cursor
movement
functionality, local users may gain access to the program's
privileges.
2000-11-27: Added packages for Red Hat Linux 7 for Alpha
2. Relevant releases/architectures:
Red Hat Linux 6.2 - i386, alpha, sparc
Red Hat Linux 6.2EE - i386, alpha, sparc
Red Hat Linux 7.0 - i386, alpha
3. Problem description:
There used to be an overflowable buffer in the part of the ncurses
library
handling cursor movement.
Attackers can force a privileged application to use their own termcap
file
containing a special terminal entry which will trigger the ncurses
vulnerability, allowing them to execute arbitrary code with the
privileges
of the exploited binary.
4. Solution:
For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):
20809 - ncurses allows local privilege escalation
6. RPMs required:
Red Hat Linux 6.2:
alpha:
ftp://updates.redhat.com/6.2/alpha/ncurses-5.0-12.alpha.rpm
ftp://updates.redhat.com/6.2/alpha/ncurses-devel-5.0-12.alpha.rpm
sparc:
ftp://updates.redhat.com/6.2/sparc/ncurses-5.0-12.sparc.rpm
ftp://updates.redhat.com/6.2/sparc/ncurses-devel-5.0-12.sparc.rpm
i386:
ftp://updates.redhat.com/6.2/i386/ncurses-5.0-12.i386.rpm
ftp://updates.redhat.com/6.2/i386/ncurses-devel-5.0-12.i386.rpm
sources:
ftp://updates.redhat.com/6.2/SRPMS/ncurses-5.0-12.src.rpm
Red Hat Linux 7.0:
alpha:
ftp://updates.redhat.com/7.0/alpha/ncurses-5.2-2.alpha.rpm
ftp://updates.redhat.com/7.0/alpha/ncurses-devel-5.2-2.alpha.rpm
i386:
ftp://updates.redhat.com/7.0/i386/ncurses-5.2-2.i386.rpm
ftp://updates.redhat.com/7.0/i386/ncurses-devel-5.2-2.i386.rpm
sources:
ftp://updates.redhat.com/7.0/SRPMS/ncurses-5.2-2.src.rpm
7. Verification:
MD5 sum Package Name
--------------------------------------------------------------------------
268df5613b61b146b8cae1c59369c0b7 6.2/SRPMS/ncurses-5.0-12.src.rpm
1decbd07374fd9fb7ae5a12641d2667b 6.2/alpha/ncurses-5.0-12.alpha.rpm
ed52d2bad06cee2cec081bb889a5e363 6.2/alpha/ncurses-devel-5.0-12.alpha.rpm
d401a0317132c114a75dfeefb881f66c 6.2/i386/ncurses-5.0-12.i386.rpm
bc84ee23b1b8f960a0911a5388c52d24 6.2/i386/ncurses-devel-5.0-12.i386.rpm
654eca10b3b44afef783c39da3b254dc 6.2/sparc/ncurses-5.0-12.sparc.rpm
e273dd6e88899781bcc7441e7505de5c 6.2/sparc/ncurses-devel-5.0-12.sparc.rpm
4444a46c15c28db246b191daf4f3dfde 7.0/SRPMS/ncurses-5.2-2.src.rpm
64d008bc67646bc54c3b94b84a0c63fe 7.0/alpha/ncurses-5.2-2.alpha.rpm
b2b05f687584244fd0a33583d7684b25 7.0/alpha/ncurses-devel-5.2-2.alpha.rpm
9affe6c75ae33d616ea695766c10e44e 7.0/i386/ncurses-5.2-2.i386.rpm
a555ec460de5650c4a2c42abc5de838c 7.0/i386/ncurses-devel-5.2-2.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key
is available at:
http://www.redhat.com/corp/contact.html
You can verify each package with the following command:
rpm --checksig <filename>
If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
rpm --checksig --nogpg <filename>
8. References:
N/A
Copyright(c) 2000 Red Hat, Inc.
_______________________________________________ Redhat-watch-list
mailing list To unsubscribe, visit:
https://listman.redhat.com/mailman/listinfo/redhat-watch-list
_______________________________________________
Redhat-announce-list mailing list
Redhat-announce-list@redhat.com
https://listman.redhat.com/mailman/listinfo/redhat-announce-list
(5790946) --------------------------------(Ombruten)
Kommentar i text 5791053