SuSE Security Announcement: shlibs/glibcJan 26, 2001, 20:41 (0 Talkback[s])
(Other stories by Roman Drahtmueller)
Date: Fri, 26 Jan 2001 15:55:17 +0100
SuSE Security Announcement Package: glibc (shlibs) Announcement-ID: SuSE-SA:2001:01 Date: Friday, January 26th, 2001 15:40 MET Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 6 SuSE default package: yes Other affected systems: most Linux/glibc based systems Content of this advisory: 1) security vulnerability resolved: glibc problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information)
1) problem description, brief discussion, solution, upgrade information
ld-linux.so.2, the dynamical linker, adds shared libraries to the memoryspace of a program to be started. Its flexibility allows for some environment variables to influence the linking process such as preloading shared libraries as well as defining the path in which the linker will search for the shared libraries. Special care must be exercised when runtime-linking setuid- or setgid-binaries: The runtime-linker must not link against user-specified libraries since the code therein would then run with the elevated privileges of the suid binary.
The runtime-linker as used in the SuSE distributions ignores the content of the critical environment variables if the specified path begins with a slash ("/"), or if the library file name is not cached (eg it is contained in a path from /etc/ld.so.conf). However, Solar Designer has found out that even preloading glibc- native shared libraries can be dangerous: The code in the user-linked library is not aware of the fact that the binary runs with suid or sgid privileges. Using debugging features of the glibc (and possibly other features) it is possible for a local attacker to overwrite arbitrary files with the elevated privileges of the suid/sgid binary executed. This may lead to a local root compromise.
To eliminate these problems, we provide update packages that completely disregard the LD_* variables upon runtime-linking of a binary that has an effective uid different from the caller's userid.
Download the update package from locations desribed below and
install the package with the command `rpm -Uhv file.rpm'. The
md5sum for each file is in the line below. You can verify the
integrity of the rpm files using the command
SPECIAL INSTALL INSTRUCTIONS:
The glibc (the shlibs package) is an intrinsic part of the GNU/Linux operating system since most binary executables are dependent on the shared libraries from that package. For this reason, special care must be taken while updating the shlibs package. After downloading the binary rpm files, make sure that your system is idle by bringing it down to Single User Mode (`init 1´). If this is not applicable for operational reasons, then keep your machine as calm as possible while you perform the update. In particular, make sure that no shell scripts are running during the update.
Install the package using the command rpm -Uhv package-rpm-file Do _NOT_ interrupt the operation of the rpm command! After the installation, execute the commands ldconfig # alternatively, use SuSEconfig /sbin/init u # will restart initAt this point, the update is done. On low-memory machines a reboot is advisable to free the memory that is used by the old memory-mapped libraries.
The rpm packages are being produced as this announcement is written. The md5sums for these rpm packages will be provided on the ftp-server, signed with the firstname.lastname@example.org pgp key below.
AXP Alpha Platform:
PPC Power PC Platform:
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
This announcement is followed by a sequence of more announcements to address the ongoing security problems as discussed in public security forums. In particular, there are temporary file races in multiple packages (we collect and address them in a single announcement to keep the noise low), format string bugs, as well as a man-in-the-middle attack in the kdesu program and a single-byte buffer overflow. The next announcenemts will contain more information on these topics. Please stay tuned.
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may subscribe:
SuSE's security contact is email@example.com.
- - | Roman Drahtmüller firstname.lastname@example.org // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -