Linux Today: Linux News On Internet Time.

More on LinuxToday

SuSE Security Announcement: esound

Oct 11, 2000, 20:13 (0 Talkback[s])
(Other stories by Roman Drahtmueller)

Date: Wed, 11 Oct 2000 19:08:04 +0200 (MEST)
From: Roman Drahtmueller
To: suse-security-announce@suse.de
Subject: [suse-security-announce] SuSE Security Announcement: esound

                        SuSE Security Announcement

        Package:                esound
        Date:                   Wednesday, October 11th, 2000 19:00 MEST
        Affected SuSE versions: 6.3, 6.4, 7.0
        Vulnerability Type:     local user compromise
        Severity (1-10):        3
        SuSE default package:   yes
        Other affected systems: Linux systems using esound with unix domain
                                socket support

    Content of this advisory:
        1) security vulnerability resolved: esound
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

1) problem description, brief discussion, solution, upgrade information

esound, a daemon program for the Gnome desktop, is used for sound replay by various programs such as windowmanagers and other applications. The esound daemon creates a directory /tmp/.esd to host a unix domain socket. Upon startup, the daemon changes the modes of the socket, but a race condition allows an attacker to place a symlink into the directory to point to an arbitrary file belonging to the victim. By consequence, an attacker may be able to change the permissions of any file belonging to the victim. If the victim's userid is root, the attacker may be able to change the modes of any file in the system.

SuSE distributions before SuSE-6.3 were not vulnerable to this attack because unix domain sockets were not supported by the esound daemon as shipped with these distributions.

The only efficient solution for the problem is to store the unix domain socket in a directory where only the user has write access to. The user's home directory is such a location.

Update packages that fix the race conditions by placing the sockets into the user's home directory are available for download. It is recommended to apply the fix on systems where multiple users can access the local filesystem.

Note: Not all filesystems support unix domain sockets. The fix might not work if the user's home directory is on such a filesystem (such as AFS, eg.). In such rare cases, administrators are usually aware of such limitations. SuSE default installations do not have this limitation.

Download the update package from locations desribed below and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.

i386 Intel Platform:

source rpm:

source rpm:

source rpm:

Sparc Platform:

source rpm:

AXP Alpha Platform:

source rpm:

source rpm:

PPC Power PC Platform:

source rpm:

source rpm:

2) Pending vulnerabilities in SuSE Distributions and Workarounds:

- gnorpm

A race condition has been found in the gnorpm program, a GUI for the rpm system. The issue will be addressed in a following announcement.

- ncurses

The ncurses library contains buffer overflows that are exploitable when user-supplied terminfo databases are processed. This imposes a security risk on programs/binaries that are linked against libncurses and run with special privileges. Both workaround and clean solution is to remove the suid bit from all executable files with setuid bit set. The issue will be addressed in a following security announcement.

- apache mod_rewrite

A bug has been discovered in the apache package that allows attackers to read arbitrary files on a system that runs apache. The responsible apache module named "mod_rewrite" is not used by default on SuSE installations of the apache package. The issue will be addressed in a following security announcement.

- cfengine

A format string parsing bug causes the cfengine package to be vulnerable to a remote root attack. Update packages are available, the security announcement is pending.

- usermode/userhelper

userhelper is a suid helper program designed to let the user who is logged on to the console execute some programs with root privileges. SuSE distributions do not contain the usermode package and therefore are not vulnerable to the security problems recently discovered in the usermode package.

- tmpwatch

The tmpwatch packages as shipped with SuSE distributions are not vulnerable to the attacks as discussed on security forums because we ship an older version that does not provide the functionality that can be exploited.

- lprNG

The versions of the lprNG package that come with SuSE distributions are not vulnerable to the format string parsing errors as discussed in security forums.

- traceroute

The traceroute program has been found vulnerable to a bug (`traceroute -g 1 -g 1') in many distributions. Newer SuSE distributions have a different implementation of the traceroute program and are not vulnerable to the bug found by Pekka Savola . The vulnerability could not be verified in older SuSE distributions.

3) standard appendix:

SuSE runs two security mailing lists to which any interested party may subscribe:

- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list. To subscribe, send an email to suse-security-subscribe@suse.com.

- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list. To subscribe, send an email to suse-security-announce-subscribe@suse.com.

For general information or the frequently asked questions (faq) send mail to:
suse-security-info@suse.com or
suse-security-faq@suse.com respectively.

SuSE's security contact is security@suse.com.

Roman Drahtmüller.
- - --

 -                                                                      -
| Roman Drahtmüller        draht@suse.de //          "Caution: Cape does |
  SuSE GmbH - Security           Phone: //       not enable user to fly."
| Nürnberg, Germany     +49-911-740530 // (Batman Costume warning label) |
 -                                                                      -