dcsimg
Linux Today: Linux News On Internet Time.




More on LinuxToday


Caldera Systems Security Advisory: serious vulnerability in glibc NLS code

Sep 05, 2000, 18:16 (0 Talkback[s])

Date: Tue, 5 Sep 2000 09:07:28 -0600
From: Technical Support support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: serious vulnerability in glibc NLS code


                   Caldera Systems, Inc.  Security Advisory

Subject:                serious vulnerability in glibc NLS code
Advisory number:        CSSA-2000-030.0
Issue date:             2000 September, 1
Cross reference:

1. Problem Description

The GNU C library, glibc, allows users to specify their so-called locale through environment variables such as LANG. The locale determines what language, monetary signs etc to use when communicating with the user.

A bug in the parsing of these locale names allows an attacker to trick glibc into using locale information files provided by the attacker, which can make an application crash.

This bug can be used by local users to obtain root privilege through various setuid root applications.

2. Vulnerable Versions

   System                       Package


   OpenLinux Desktop 2.3        All packages previous to
                                glibc-2.1.1-3

OpenLinux eServer 2.3 All packages previous to and OpenLinux eBuilder glibc-2.1.3-4S
OpenLinux eDesktop 2.4 All packages previous to glibc-2.1.2-7
3. Solution

Workaround:

None known.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

4.2 Verification

9509340276c43bdcbeee2d95e82b9d03 RPMS/glibc-2.1.1-3.i386.rpm
e7d4b0f9db9b92af32b224d7e1b83511 RPMS/glibc-devel-2.1.1-3.i386.rpm
b2fac2bcf6e961d7fc5f4071be2cd934 RPMS/glibc-devel-static-2.1.1-3.i386.rpm
3883f85e36804e8a25f5c8f1d5644a18 RPMS/glibc-localedata-2.1.1-3.i386.rpm
8c155c6564b725d09c9c2b4109212774 SRPMS/glibc-2.1.1-3.src.rpm
4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*.i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

5.2 Verification

083a50ef11461be5925c139ab1754e78 RPMS/glibc-2.1.3-4S.i386.rpm
d47e1eef4448514d3d6163acf6752a33 RPMS/glibc-devel-2.1.3-4S.i386.rpm
c2534552c30464f4d7a5b35a909dd2da RPMS/glibc-devel-static-2.1.3-4S.i386.rpm
87e72a76353c38dd856e48199d03a965 RPMS/glibc-localedata-2.1.3-4S.i386.rpm
24dc7d444ed055987af0fdf86ac43e6e SRPMS/glibc-2.1.3-4S.src.rpm
5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*i386.rpm

6. OpenLinux eDesktop 2.4

6.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

6.2 Verification

d8729cd44a58ee64b1e771bee3cbafb2 RPMS/glibc-2.1.2-7.i386.rpm
e9138f01f763a454598cf5832ef43327 RPMS/glibc-devel-2.1.2-7.i386.rpm
c0a617bf52890fdae7351bcc293540b2 RPMS/glibc-devel-static-2.1.2-7.i386.rpm
704b41eab208e9991f0248ff0c54db54 RPMS/glibc-localedata-2.1.2-7.i386.rpm
29820d97b016f0143528f49eb85ef405 SRPMS/glibc-2.1.2-7.src.rpm
6.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -Fhv glibc-*i386.rpm

7. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

This security fix closes Caldera's internal Problem Report 7602.

8. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.

9. Acknowledgements

Caldera Systems wishes to thank Jouko Pynnönen jouko@solutions.fi for finding and reporting this problem.