---

Caldera Security Advisory: Security problem (setuid) with dump

Caldera Systems, Inc. Security Advisory

Subject: Security problem (setuid) with dump
Advisory number: CSSA-2000-004.0
Issue date: 2000 March, 6
Cross reference:


1. Problem Description

OpenLinux contains a pair of utilities called dump and restore,
intended to support backup and recovery of files.

There is a buffer overflow in the way the dump command handles
certain arguments. This bug can be exploited to obtain group tty
privilege.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
                                dump-0.4b4-8

   OpenLinux eServer 2.3        All packages previous to
                                dump-0.4b4-8

3. Solution

Workaround:

If you do not use dump and restore, remove the RPM:

rpm -e dump

Alternatively, remove the setuid and setgid bit from these
commands:

chmod 555 /sbin/dump /sbin/restore:

The upgrade RPMs provided by Caldera do just this (i.e. removing
the s bits from both binaries).

The proper solution is to upgrade to the fixed packages.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera’s FTP site at:


ftp://ftp.calderasystems.com/pub/openlinux/updates/2.3/current/RPMS/

The corresponding source code package can be found at:


ftp://ftp.calderaystems.com/pub/openlinux/updates/2.3/current/SRPMS

4.2 Verification

       96136401e7edca0eb43a226ce5adea98  RPMS/dump-0.4b4-8.i386.rpm
       39210c6a3b91cff761e438026379e308  SRPMS/dump-0.4b4-8.src.rpm

4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F dump-0.4b4-8.i386.rpm

5. OpenLinux eServer 2.3

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera’s FTP site at:


ftp://ftp.calderasystems.com/pub/eServer/updates/2.3/current/RPMS/

The corresponding source code package can be found at:


ftp://ftp.calderaystems.com/pub/eServer/updates/2.3/current/SRPMS

5.2 Verification

       41e4fe9629bf461123e319f3e4c6abf3  RPMS/dump-0.4b4-8.i386.rpm
       7a8eb6e8254c40d7dcd7f9fe0b5a4890  SRPMS/dump-0.4b4-8.src.rpm

5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F dump-0.4b4-8.i386.rpm

6. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

7. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any
of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.