SuSE Security Announcement: esoundOct 11, 2000, 20:13 (0 Talkback[s])
(Other stories by Roman Drahtmueller)
Date: Wed, 11 Oct 2000 19:08:04 +0200 (MEST)
SuSE Security Announcement Package: esound Date: Wednesday, October 11th, 2000 19:00 MEST Affected SuSE versions: 6.3, 6.4, 7.0 Vulnerability Type: local user compromise Severity (1-10): 3 SuSE default package: yes Other affected systems: Linux systems using esound with unix domain socket support Content of this advisory: 1) security vulnerability resolved: esound problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information)
esound, a daemon program for the Gnome desktop, is used for sound replay by various programs such as windowmanagers and other applications. The esound daemon creates a directory /tmp/.esd to host a unix domain socket. Upon startup, the daemon changes the modes of the socket, but a race condition allows an attacker to place a symlink into the directory to point to an arbitrary file belonging to the victim. By consequence, an attacker may be able to change the permissions of any file belonging to the victim. If the victim's userid is root, the attacker may be able to change the modes of any file in the system.
SuSE distributions before SuSE-6.3 were not vulnerable to this attack because unix domain sockets were not supported by the esound daemon as shipped with these distributions.
The only efficient solution for the problem is to store the unix domain socket in a directory where only the user has write access to. The user's home directory is such a location.
Update packages that fix the race conditions by placing the sockets into the user's home directory are available for download. It is recommended to apply the fix on systems where multiple users can access the local filesystem.
Note: Not all filesystems support unix domain sockets. The fix might not work if the user's home directory is on such a filesystem (such as AFS, eg.). In such rare cases, administrators are usually aware of such limitations. SuSE default installations do not have this limitation.
Download the update package from locations desribed below and
install the package with the command `rpm -Fhv file.rpm'. The
md5sum for each file is in the line below. You can verify the
integrity of the rpm files using the command
i386 Intel Platform:
AXP Alpha Platform:
PPC Power PC Platform:
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
A race condition has been found in the gnorpm program, a GUI for the rpm system. The issue will be addressed in a following announcement.
The ncurses library contains buffer overflows that are exploitable when user-supplied terminfo databases are processed. This imposes a security risk on programs/binaries that are linked against libncurses and run with special privileges. Both workaround and clean solution is to remove the suid bit from all executable files with setuid bit set. The issue will be addressed in a following security announcement.
- apache mod_rewrite
A bug has been discovered in the apache package that allows attackers to read arbitrary files on a system that runs apache. The responsible apache module named "mod_rewrite" is not used by default on SuSE installations of the apache package. The issue will be addressed in a following security announcement.
A format string parsing bug causes the cfengine package to be vulnerable to a remote root attack. Update packages are available, the security announcement is pending.
userhelper is a suid helper program designed to let the user who is logged on to the console execute some programs with root privileges. SuSE distributions do not contain the usermode package and therefore are not vulnerable to the security problems recently discovered in the usermode package.
The tmpwatch packages as shipped with SuSE distributions are not vulnerable to the attacks as discussed on security forums because we ship an older version that does not provide the functionality that can be exploited.
The versions of the lprNG package that come with SuSE distributions are not vulnerable to the format string parsing errors as discussed in security forums.
The traceroute program has been found vulnerable to a bug (`traceroute -g 1 -g 1') in many distributions. Newer SuSE distributions have a different implementation of the traceroute program and are not vulnerable to the bug found by Pekka Savola . The vulnerability could not be verified in older SuSE distributions.
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may subscribe:
SuSE's security contact is firstname.lastname@example.org.
- - | Roman Drahtmüller email@example.com // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -