82567 2002-10-29 02:03 /164 rader/ <security@caldera.com> Importerad: 2002-10-29 02:03 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.co Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <2138> Ärende: Security Update: [CSSA-2002-040.0] Linux: uudecode performs inadequate checks on user-specified output files ------------------------------------------------------------ To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com full-disclosure@lists.netsys.co ______________________________________________________________________________ SCO Security Advisory Subject: Linux: uudecode performs inadequate checks on user-specified output files Advisory number: CSSA-2002-040.0 Issue date: 2002 October 28 Cross reference: ______________________________________________________________________________ 1. Problem Description The uudecode utility would create an output file without checking to see if it was about to write to a symlink or a pipe. If a user uses uudecode to extract data into open shared directories, such as /tmp, this vulnerability could be used by a local attacker to overwrite files or lead to privilege escalation. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to sharutils-4.2.1-7MR.1.i386.rpm OpenLinux 3.1.1 Workstation prior to sharutils-4.2.1-7MR.1.i386.rpm OpenLinux 3.1 Server prior to sharutils-4.2.1-7MR.1.i386.rpm OpenLinux 3.1 Workstation prior to sharutils-4.2.1-7MR.1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/RPMS 4.2 Packages 98a9348513f981d0c919de67c7a3fd44 sharutils-4.2.1-7MR.1.i386.rpm 4.3 Installation rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/SRPMS 4.5 Source Packages 9c89a0b5d4527def4cb2764bcd87f972 sharutils-4.2.1-7MR.1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/RPMS 5.2 Packages d790a48715269c624d347556e4e84253 sharutils-4.2.1-7MR.1.i386.rpm 5.3 Installation rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/SRPMS 5.5 Source Packages 521eb3dbd3aabb1e76a5db895f46e0bf sharutils-4.2.1-7MR.1.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/RPMS 6.2 Packages 87cd6250715583afa9905785853e546b sharutils-4.2.1-7MR.1.i386.rpm 6.3 Installation rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm 6.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/SRPMS 6.5 Source Packages ce9daba62eb424024a37b1d0288384db sharutils-4.2.1-7MR.1.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/RPMS 7.2 Packages 03b5f44ec89f04f36500e9ce909459ad sharutils-4.2.1-7MR.1.i386.rpm 7.3 Installation rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm 7.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/SRPMS 7.5 Source Packages cc2636f8152aced9d77fa310c65f0b8c sharutils-4.2.1-7MR.1.src.rpm 8. References Specific references for this advisory: http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178 http://www.kb.cert.org/vuls/id/336083 SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr864863, fz521051, erg712053. 9. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 10. Acknowledgements AERAsec discovered and researched this vulnerability. ______________________________________________________________________________ (82567) / <security@caldera.com>/---------(Ombruten) Bilaga (application/pgp-signature) i text 82568 82568 2002-10-29 02:03 /9 rader/ <security@caldera.com> Importerad: 2002-10-29 02:03 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Extern mottagare: full-disclosure@lists.netsys.co Externa svar till: please_reply_to_security@caldera.com Mottagare: Bugtraq (import) <2139> Bilaga (text/plain) till text 82567 Ärende: Bilaga till: Security Update: [CSSA-2002-040.0] Linux: uudecode performs inadequate checks on user-specified output files ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (SCO_SV) Comment: For info see http://www.gnupg.org iEYEARECAAYFAj29nZwACgkQbluZssSXDTEuxQCfW3QpP/o9FTZTSBbuPz3C1Qse LXcAoKp6t8vBfLEM4ijb8ksI+wN2Rt2X =mYaL -----END PGP SIGNATURE----- (82568) / <security@caldera.com>/-------------------