Date: Thu, 24 Aug 2000 16:50:26 -0600
From: Technical Support support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: ld.so unsetenv problem
Caldera Systems, Inc. Security Advisory
Subject: ld.so unsetenv problem
Advisory number: CSSA-2000-028.0
Issue date: 2000 August, 24
Cross reference:
1. Problem Description
A bug has been discovered in ld.so that could allow local users
to obtain super user privilege.
The dynamic loader ld.so is responsible for making shared
libraries available within a program at run-time. Normally, a user
is allowed to load additional shared libraries when executing a
program; they can be specified with environment variables like
LD_PRELOAD.
Since this is not acceptable for applications that run setuid
root, ld.so normally removes these environment variables for
these.
The bug causes these environment variables to not be removed
completely under some circumstances. While setuid programs
themselves are not vulnerable, external programs they execute can
be affected by this problem.
So far, no exploit has been published. However, we nevertheless
recommend to update glibc (which contains
ld.so) because of the potential risks.
2. Vulnerable Versions
System Package
OpenLinux Desktop 2.3 All packages previous to
glibc-2.1.1-2
OpenLinux eServer 2.3 All packages previous to
and OpenLinux eBuilder glibc-2.1.3-3S
OpenLinux eDesktop 2.4 All packages previous to
glibc-2.1.2-4
3. Solution
Workaround:
none
We recommend our users to upgrade to the new packages.
4. OpenLinux Desktop 2.3
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS
4.2 Verification
c157fd6b875d5823200984fbfeb10dea RPMS/glibc-2.1.1-2.i386.rpm
feb9215b56eb4c715dff9c3f6a890a2e RPMS/glibc-devel-2.1.1-2.i386.rpm
9291761b0c03d7f54ca252fc22af8bdc RPMS/glibc-devel-static-2.1.1-2.i386.rpm
2584a2a494b7009342324bf2391b17dc RPMS/glibc-localedata-2.1.1-2.i386.rpm
de9d14020a0b4283656e9a01ca7f0bd8 SRPMS/glibc-2.1.1-2.src.rpm
4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*i386.rpm
5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential
3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
c8f5ee3e789cdcc7544fd215e8aa9824 RPMS/glibc-2.1.3-3S.i386.rpm
bec5b2aa1cc780dbdc1fd68ed7400256 RPMS/glibc-devel-2.1.3-3S.i386.rpm
90e708d06f598e2eca9609f7a2329682 RPMS/glibc-devel-static-2.1.3-3S.i386.rpm
e1e255eb10ad693a26d695d1db04b7fd RPMS/glibc-localedata-2.1.3-3S.i386.rpm
d5c3de3b296496f2c1f08b53f10d6bb6 SRPMS/glibc-2.1.3-3S.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*i386.rpm
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
734787918b8d5f85c2c4564bf8470ee3 RPMS/glibc-2.1.2-4.i386.rpm
73976743de20e3883aff47274d56e00e RPMS/glibc-devel-2.1.2-4.i386.rpm
0baea7c2c3fc4cd127b0904a76d4125f RPMS/glibc-devel-static-2.1.2-4.i386.rpm
1d253bc28eabc199d5c9aec734ffef4a RPMS/glibc-localedata-2.1.2-4.i386.rpm
b0ac7210766f0e48a8a6726f62c18381 SRPMS/glibc-2.1.2-4.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera’s internal Problem Report
7512.
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any
of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.