To: bugtraqat_private announceat_private security-alertsat_private full-disclosureat_private ______________________________________________________________________________ SCO Security Advisory Subject: Linux: chfn (util-linux) temp file race vulnerability Advisory number: CSSA-2002-043.0 Issue date: 2002 October 29 Cross reference: ______________________________________________________________________________ 1. Problem Description The util-linux package vulnerable to privilege escalation when the "ptmptmp" file is not removed properly when using "chfn" utility. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to util-linux-2.11l-5.1.i386.rpm OpenLinux 3.1.1 Workstation prior to util-linux-2.11l-5.1.i386.rpm OpenLinux 3.1 Server prior to util-linux-2.11l-5.1.i386.rpm OpenLinux 3.1 Workstation prior to util-linux-2.11l-5.1.i386.rpm 3. Solution The proper solution is to install the latest packages. Many customers find it easier to use the Caldera System Updater, called cupdate (or kcupdate under the KDE environment), to update these packages rather than downloading and installing them by hand. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-043.0/RPMS 4.2 Packages 98e88787d222b51faabb2e070938f042 util-linux-2.11l-5.1.i386.rpm 4.3 Installation rpm -Fvh util-linux-2.11l-5.1.i386.rpm 4.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-043.0/SRPMS 4.5 Source Packages ad191ca704a7ce42122be237bd130130 util-linux-2.11l-5.1.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-043.0/RPMS 5.2 Packages 41a6998cc6a49350c92e6b39c7fd313b util-linux-2.11l-5.1.i386.rpm 5.3 Installation rpm -Fvh util-linux-2.11l-5.1.i386.rpm 5.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-043.0/SRPMS 5.5 Source Packages a94ff2530db09700bcc8ccb245f4c084 util-linux-2.11l-5.1.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-043.0/RPMS 6.2 Packages bea4d3169f518c9ce5453befdc6c2372 util-linux-2.11l-5.1.i386.rpm 6.3 Installation rpm -Fvh util-linux-2.11l-5.1.i386.rpm 6.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-043.0/SRPMS 6.5 Source Packages 8eda88f37ed5d3ed98a0e6a2e260fe25 util-linux-2.11l-5.1.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043.0/RPMS 7.2 Packages 4bdca72dec95ca197a2e623aa940b14e util-linux-2.11l-5.1.i386.rpm 7.3 Installation rpm -Fvh util-linux-2.11l-5.1.i386.rpm 7.4 Source Package Location ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043.0/SRPMS 7.5 Source Packages 4bef4047eed39cd905dc20efb8a1a9d7 util-linux-2.11l-5.1.src.rpm 8. References Specific references for this advisory: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0638 http://www.kb.cert.org/vuls/id/405955 http://razor.bindview.com/publish/advisories/adv_chfn.html SCO security resources: http://www.sco.com/support/security/index.html This security fix closes SCO incidents sr866639, fz521517, erg501629. 9. Disclaimer SCO is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of SCO products. 10. Acknowledgements The BindView RAZOR Team discovered and researched this vulnerability. ______________________________________________________________________________
This archive was generated by hypermail 2b30 : Thu Oct 31 2002 - 14:14:16 PST