dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Caldera Security Update: ld.so unsetenv problem

Aug 29, 2000, 12:50 (0 Talkback[s])
Date: Thu, 24 Aug 2000 16:50:26 -0600
From: Technical Support - support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: ld.so unsetenv problem


                   Caldera Systems, Inc.  Security Advisory

Subject:                ld.so unsetenv problem
Advisory number:        CSSA-2000-028.0
Issue date:             2000 August, 24
Cross reference:



1. Problem Description

   A bug has been discovered in ld.so that could allow local
   users to obtain super user privilege.

   The dynamic loader ld.so is responsible for making shared
   libraries available within a program at run-time. Normally,
   a user is allowed to load additional shared libraries when
   executing a program; they can be specified with environment
   variables like LD_PRELOAD.

   Since this is not acceptable for applications that run setuid
   root, ld.so normally removes these environment variables for
   these.

   The bug causes these environment variables to not be removed
   completely under some circumstances.  While setuid programs
   themselves are not vulnerable, external programs they execute
   can be affected by this problem.

   So far, no exploit has been published.  However, we
   nevertheless recommend to update glibc (which contains
   ld.so) because of the potential risks.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
                                glibc-2.1.1-2

   OpenLinux eServer 2.3        All packages previous to
   and OpenLinux eBuilder       glibc-2.1.3-3S

   OpenLinux eDesktop 2.4       All packages previous to
                                glibc-2.1.2-4

3. Solution

   Workaround:

   none

   We recommend our users to upgrade to the new packages.

4. OpenLinux Desktop 2.3

   4.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

   4.2 Verification

   c157fd6b875d5823200984fbfeb10dea  RPMS/glibc-2.1.1-2.i386.rpm
   feb9215b56eb4c715dff9c3f6a890a2e  RPMS/glibc-devel-2.1.1-2.i386.rpm
   9291761b0c03d7f54ca252fc22af8bdc  RPMS/glibc-devel-static-2.1.1-2.i386.rpm
   2584a2a494b7009342324bf2391b17dc  RPMS/glibc-localedata-2.1.1-2.i386.rpm
   de9d14020a0b4283656e9a01ca7f0bd8  SRPMS/glibc-2.1.1-2.src.rpm
   4.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -Fhv glibc-*i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

   c8f5ee3e789cdcc7544fd215e8aa9824  RPMS/glibc-2.1.3-3S.i386.rpm
   bec5b2aa1cc780dbdc1fd68ed7400256  RPMS/glibc-devel-2.1.3-3S.i386.rpm
   90e708d06f598e2eca9609f7a2329682  RPMS/glibc-devel-static-2.1.3-3S.i386.rpm
   e1e255eb10ad693a26d695d1db04b7fd  RPMS/glibc-localedata-2.1.3-3S.i386.rpm
   d5c3de3b296496f2c1f08b53f10d6bb6  SRPMS/glibc-2.1.3-3S.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -Fhv glibc-*i386.rpm

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

   734787918b8d5f85c2c4564bf8470ee3  RPMS/glibc-2.1.2-4.i386.rpm
   73976743de20e3883aff47274d56e00e  RPMS/glibc-devel-2.1.2-4.i386.rpm
   0baea7c2c3fc4cd127b0904a76d4125f  RPMS/glibc-devel-static-2.1.2-4.i386.rpm
   1d253bc28eabc199d5c9aec734ffef4a  RPMS/glibc-localedata-2.1.2-4.i386.rpm
   b0ac7210766f0e48a8a6726f62c18381  SRPMS/glibc-2.1.2-4.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -Fhv glibc-*i386.rpm

7. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 7512.

8. Disclaimer

   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.