Date: Thu, 24 Aug 2000 16:50:26 -0600 From: Technical Support - [email protected] To: [email protected] Subject: Security Update: ld.so unsetenv problem
Caldera Systems, Inc. Security Advisory Subject: ld.so unsetenv problem Advisory number: CSSA-2000-028.0 Issue date: 2000 August, 24 Cross reference:
1. Problem Description A bug has been discovered in ld.so that could allow local users to obtain super user privilege. The dynamic loader ld.so is responsible for making shared libraries available within a program at run-time. Normally, a user is allowed to load additional shared libraries when executing a program; they can be specified with environment variables like LD_PRELOAD. Since this is not acceptable for applications that run setuid root, ld.so normally removes these environment variables for these. The bug causes these environment variables to not be removed completely under some circumstances. While setuid programs themselves are not vulnerable, external programs they execute can be affected by this problem. So far, no exploit has been published. However, we nevertheless recommend to update glibc (which contains ld.so) because of the potential risks. 2. Vulnerable Versions System Package ----------------------------------------------------------- OpenLinux Desktop 2.3 All packages previous to glibc-2.1.1-2 OpenLinux eServer 2.3 All packages previous to and OpenLinux eBuilder glibc-2.1.3-3S OpenLinux eDesktop 2.4 All packages previous to glibc-2.1.2-4 3. Solution Workaround: none We recommend our users to upgrade to the new packages. 4. OpenLinux Desktop 2.3 4.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS 4.2 Verification c157fd6b875d5823200984fbfeb10dea RPMS/glibc-2.1.1-2.i386.rpm feb9215b56eb4c715dff9c3f6a890a2e RPMS/glibc-devel-2.1.1-2.i386.rpm 9291761b0c03d7f54ca252fc22af8bdc RPMS/glibc-devel-static-2.1.1-2.i386.rpm 2584a2a494b7009342324bf2391b17dc RPMS/glibc-localedata-2.1.1-2.i386.rpm de9d14020a0b4283656e9a01ca7f0bd8 SRPMS/glibc-2.1.1-2.src.rpm 4.3 Installing Fixed Packages Upgrade the affected packages with the following commands: rpm -Fhv glibc-*i386.rpm 5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0 5.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS 5.2 Verification c8f5ee3e789cdcc7544fd215e8aa9824 RPMS/glibc-2.1.3-3S.i386.rpm bec5b2aa1cc780dbdc1fd68ed7400256 RPMS/glibc-devel-2.1.3-3S.i386.rpm 90e708d06f598e2eca9609f7a2329682 RPMS/glibc-devel-static-2.1.3-3S.i386.rpm e1e255eb10ad693a26d695d1db04b7fd RPMS/glibc-localedata-2.1.3-3S.i386.rpm d5c3de3b296496f2c1f08b53f10d6bb6 SRPMS/glibc-2.1.3-3S.src.rpm 5.3 Installing Fixed Packages Upgrade the affected packages with the following commands: rpm -Fhv glibc-*i386.rpm 6. OpenLinux eDesktop 2.4 6.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS 6.2 Verification 734787918b8d5f85c2c4564bf8470ee3 RPMS/glibc-2.1.2-4.i386.rpm 73976743de20e3883aff47274d56e00e RPMS/glibc-devel-2.1.2-4.i386.rpm 0baea7c2c3fc4cd127b0904a76d4125f RPMS/glibc-devel-static-2.1.2-4.i386.rpm 1d253bc28eabc199d5c9aec734ffef4a RPMS/glibc-localedata-2.1.2-4.i386.rpm b0ac7210766f0e48a8a6726f62c18381 SRPMS/glibc-2.1.2-4.src.rpm 6.3 Installing Fixed Packages Upgrade the affected packages with the following commands: rpm -Fhv glibc-*i386.rpm 7. References This and other Caldera security resources are located at: http://www.calderasystems.com/support/security/index.html This security fix closes Caldera's internal Problem Report 7512. 8. Disclaimer Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.