Date: Thu, 22 Mar 2001 19:50:23 +0100 (CET)
From: Thomas Biege thomas@suse.de
To: suse-security-announce@suse.com
Subject: [suse-security-announce] SuSE Security Announcement:
nkitb/nkitserv
SuSE Security Announcement
Package: nkitb/nkitserv
Announcement-ID: SuSE-SA:2001:07
Date: Thursday, March 22th, 2001 19.06 MEST
Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
Vulnerability Type: remote denial-of-service
Severity (1-10): 4
SuSE default package: yes: in.ftpd, no: timed
Other affected systems: all system using in.ftpd (OpenBSD port) or timed
Content of this advisory:
1) security vulnerability resolved: timed, in.ftpd
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
1) problem description, brief discussion, solution, upgrade
information
Two parts of the nkitb/nkitserv package are vulnerable to
security related bugs.
in.ftpd(8):
A one-byte bufferoverflow was discovered in the OpenBSD port of the
FTP daemon in.ftpd(8) several weeks ago. This bug could just be
triggered by authenticated users, which have write access. This bug
is believed to not be exploitable under Linux. However, we prefer
to provide a fixed update package to make sure that the daemon is
on the safe side.
in.ftpd(8) will be invoked by inetd(8) and is activated by
default.
timed(8):
The time server daemon timed(8), which is started at boot time,
tries to synchronize the local host time with the time of other
machines on the local area network.
A bug in timed(8) was reported by the FreeBSD Security Officer,
that could be triggered remotely to crash the time server
daemon.
For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb.
Users of SuSE 7.0 need to download the nkitserv package for both
in.ftpd and timed.
The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1
just includes a new version of timed(8).
Download the update package from locations desribed below and
install the package with the command `rpm -Uhv file.rpm'. The
md5sum for each file is in the line below. You can verify the
integrity of the rpm files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
2) Pending vulnerabilities in SuSE Distributions and
Workarounds:
- joe (configuration file vulnerability): The problem has been
reported on multiple security-related mailing lists. We are about
to provide fixed packages.
- The game spaceboom (SVGA shoot'em up) has been found
vulnerable to multiple vulnerabilities. As a reaction to these
bugs, the spaceboom game has been dropped from the distribution. We
recommend to deinstall the game from our 6.x and 7.x distribution
by using the command `rpm -e space´, or to remove the suid
bit from the file /usr/games/SpaceBoom/SpaceBoom using the
command
`chmod -s /usr/games/SpaceBoom/SpaceBoom´.
(Note: removing the suid bit prevents the game from being used by
non-root users and from being reinstalled after removal.)
- We are in the process of preparing update packages for the man
package which has been found vulnerable to a commandline format
string bug. The man command is installed suid man on SuSE systems.
When exploited, the bug can be used to install a different man
binary to introduce a trojan into the system. As an interim
workaround, we recommend to `chmod -s /usr/bin/man´ and
ignore the warnings and errors when viewing manpages.
- The file browser MidnightCommander (mc) is vulnerable to
unwanted program execution. Updates are currently being built.
- New RPMs, that fix' a vulnerbility in the eperl package for
SuSE 6.1-7.1 are currently being built.
3) standard appendix:
SuSE runs two security mailing lists to which any interested
party may subscribe:
suse-security@suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
suse-security-subscribe@suse.com.
suse-security-announce@suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
suse-security-announce-subscribe@suse.com.
For general information or the frequently asked questions (faq)
send mail to:
suse-security-info@suse.com or
suse-security-faq@suse.com respectively.
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way. SuSE GmbH
makes no warranties of any kind whatsoever with respect to the
information contained in this security advisory.
