8224876 2002-03-29 15:21 -0800 /149 rader/ <security@caldera.com>
Sänt av: joel@lysator.liu.se
Importerad: 2002-04-01 21:00 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: announce@lists.caldera.com
Extern mottagare: security-alerts@linuxsecurity.com
Mottagare: Bugtraq (import) <21658>
Ärende: Security Update: [CSSA-2002-005.0] Linux - LD_LIBRARY_PATH problem in KDE sessions
------------------------------------------------------------
From: security@caldera.com
To: bugtraq@securityfocus.com, announce@lists.caldera.com,
security-alerts@linuxsecurity.com
Message-ID: <20020329152117.B17155@caldera.com>
To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux - LD_LIBRARY_PATH problem in KDE sessions
Advisory number: CSSA-2002-005.0
Issue date: 2002, February 05
Cross reference:
______________________________________________________________________________
1. Problem Description
In OpenLinux 3.1.1, the startkde script will set the
LD_LIBRARY_PATH environment variable to " /opt/kde2/lib:" which
includes the current working directory in the library search
path. This exposes users to shared library attacks.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux 2.3 not vulnerable
OpenLinux eServer 2.3.1 not vulnerable
and OpenLinux eBuilder
OpenLinux eDesktop 2.4 not vulnerable
OpenLinux Server 3.1 not vulnerable
OpenLinux Workstation 3.1 not vulnerable
OpenLinux 3.1 IA64 not vulnerable
OpenLinux Server 3.1.1 All packages previous to
kdeconfig-20011203-2
OpenLinux Workstation All packages previous to
3.1.1 kdeconfig-20011203-2
3. Solution
Workaround
none
The proper solution is to upgrade to the latest packages.
4. OpenLinux 2.3
not vulnerable
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
not vulnerable
6. OpenLinux eDesktop 2.4
not vulnerable
7. OpenLinux 3.1 Server
not vulnerable
8. OpenLinux 3.1 Workstation
not vulnerable
9. OpenLinux 3.1 IA64
not vulnerable
10. OpenLinux 3.1.1 Server
10.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS
The corresponding source code package can be found at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS
10.2 Verification
080998dc9e5fc03b7b20f3644ae8b31b RPMS/kdeconfig-20011203-2.i386.rpm
c7c9874846b6ca77678274c759ffce77 SRPMS/kdeconfig-20011203-2.src.rpm
10.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh kdeconfig-20011203-2.i386.rpm
11. OpenLinux 3.1.1 Workstation
11.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS
The corresponding source code package can be found at:
ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS
11.2 Verification
080998dc9e5fc03b7b20f3644ae8b31b RPMS/kdeconfig-20011203-2.i386.rpm
c7c9874846b6ca77678274c759ffce77 SRPMS/kdeconfig-20011203-2.src.rpm
11.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh kdeconfig-20011203-2.i386.rpm
12. References
This and other Caldera security resources are located at:
http://www.caldera.com/support/security/index.html
13. Disclaimer
Caldera International, Inc. is not responsible for the misuse of
any of the information we provide on this website and/or through
our security advisories. Our advisories are a service to our
customers
intended to promote secure installation and use of Caldera
OpenLinux.
______________________________________________________________________________
(8224876) / <security@caldera.com>/-------(Ombruten)
Bilaga (application/pgp-signature) i text 8224877
8224877 2002-03-29 15:21 -0800 /10 rader/ <security@caldera.com>
Importerad: 2002-04-01 21:00 av Brevbäraren
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: announce@lists.caldera.com
Extern mottagare: security-alerts@linuxsecurity.com
Mottagare: Bugtraq (import) <21659>
Bilaga (text/plain) till text 8224876
Ärende: Bilaga till: Security Update: [CSSA-2002-005.0] Linux - LD_LIBRARY_PATH problem in KDE sessions
------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAjyk9uwACgkQbluZssSXDTGuDgCg+XKYk9PD7pfsYnxbXLoEMjLS
9YgAoPYYd1OfnCjaX19cAjHNcT90tIh4
=RrqS
-----END PGP SIGNATURE-----
(8224877) / <security@caldera.com>/-----------------