dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Caldera Systems Security Advisory: ld.so unsetenv problem

Aug 25, 2000, 06:08 (0 Talkback[s])

Date: Thu, 24 Aug 2000 16:50:26 -0600
From: Technical Support support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: ld.so unsetenv problem


                   Caldera Systems, Inc.  Security Advisory

Subject:                ld.so unsetenv problem
Advisory number:        CSSA-2000-028.0
Issue date:             2000 August, 24
Cross reference:

1. Problem Description

A bug has been discovered in ld.so that could allow local users to obtain super user privilege.

The dynamic loader ld.so is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be specified with environment variables like LD_PRELOAD.

Since this is not acceptable for applications that run setuid root, ld.so normally removes these environment variables for these.

The bug causes these environment variables to not be removed completely under some circumstances. While setuid programs themselves are not vulnerable, external programs they execute can be affected by this problem.

So far, no exploit has been published. However, we nevertheless recommend to update glibc (which contains
ld.so) because of the potential risks.

2. Vulnerable Versions

   System                       Package

   OpenLinux Desktop 2.3        All packages previous to
                                glibc-2.1.1-2

   OpenLinux eServer 2.3        All packages previous to
   and OpenLinux eBuilder       glibc-2.1.3-3S

   OpenLinux eDesktop 2.4       All packages previous to
                                glibc-2.1.2-4
3. Solution

Workaround:

none

We recommend our users to upgrade to the new packages.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

4.2 Verification

c157fd6b875d5823200984fbfeb10dea RPMS/glibc-2.1.1-2.i386.rpm
feb9215b56eb4c715dff9c3f6a890a2e RPMS/glibc-devel-2.1.1-2.i386.rpm
9291761b0c03d7f54ca252fc22af8bdc RPMS/glibc-devel-static-2.1.1-2.i386.rpm
2584a2a494b7009342324bf2391b17dc RPMS/glibc-localedata-2.1.1-2.i386.rpm
de9d14020a0b4283656e9a01ca7f0bd8 SRPMS/glibc-2.1.1-2.src.rpm
4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

5.2 Verification

c8f5ee3e789cdcc7544fd215e8aa9824 RPMS/glibc-2.1.3-3S.i386.rpm
bec5b2aa1cc780dbdc1fd68ed7400256 RPMS/glibc-devel-2.1.3-3S.i386.rpm
90e708d06f598e2eca9609f7a2329682 RPMS/glibc-devel-static-2.1.3-3S.i386.rpm
e1e255eb10ad693a26d695d1db04b7fd RPMS/glibc-localedata-2.1.3-3S.i386.rpm
d5c3de3b296496f2c1f08b53f10d6bb6 SRPMS/glibc-2.1.3-3S.src.rpm
5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*i386.rpm

6. OpenLinux eDesktop 2.4

6.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

6.2 Verification

734787918b8d5f85c2c4564bf8470ee3 RPMS/glibc-2.1.2-4.i386.rpm
73976743de20e3883aff47274d56e00e RPMS/glibc-devel-2.1.2-4.i386.rpm
0baea7c2c3fc4cd127b0904a76d4125f RPMS/glibc-devel-static-2.1.2-4.i386.rpm
1d253bc28eabc199d5c9aec734ffef4a RPMS/glibc-localedata-2.1.2-4.i386.rpm
b0ac7210766f0e48a8a6726f62c18381 SRPMS/glibc-2.1.2-4.src.rpm
6.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*i386.rpm

7. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

This security fix closes Caldera's internal Problem Report 7512.

8. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.