dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Caldera Security Advisory: Security problem (setuid) with dump

Mar 14, 2000, 20:52 (0 Talkback[s])

Caldera Systems, Inc. Security Advisory

Subject: Security problem (setuid) with dump
Advisory number: CSSA-2000-004.0
Issue date: 2000 March, 6
Cross reference:


1. Problem Description

OpenLinux contains a pair of utilities called dump and restore, intended to support backup and recovery of files.

There is a buffer overflow in the way the dump command handles certain arguments. This bug can be exploited to obtain group tty privilege.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
                                dump-0.4b4-8

   OpenLinux eServer 2.3        All packages previous to
                                dump-0.4b4-8
3. Solution

Workaround:

If you do not use dump and restore, remove the RPM:

rpm -e dump
Alternatively, remove the setuid and setgid bit from these commands:
chmod 555 /sbin/dump /sbin/restore:
The upgrade RPMs provided by Caldera do just this (i.e. removing the s bits from both binaries).

The proper solution is to upgrade to the fixed packages.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/openlinux/updates/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderaystems.com/pub/openlinux/updates/2.3/current/SRPMS

4.2 Verification

       96136401e7edca0eb43a226ce5adea98  RPMS/dump-0.4b4-8.i386.rpm
       39210c6a3b91cff761e438026379e308  SRPMS/dump-0.4b4-8.src.rpm
4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F dump-0.4b4-8.i386.rpm
5. OpenLinux eServer 2.3

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/eServer/updates/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderaystems.com/pub/eServer/updates/2.3/current/SRPMS

5.2 Verification

       41e4fe9629bf461123e319f3e4c6abf3  RPMS/dump-0.4b4-8.i386.rpm
       7a8eb6e8254c40d7dcd7f9fe0b5a4890  SRPMS/dump-0.4b4-8.src.rpm
5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F dump-0.4b4-8.i386.rpm
6. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

7. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.