Date: Mon, 15 Jan 2001 17:08:22 -0700
From: Caldera Support Info sup-info@LOCUTUS4.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Caldera Systems Security Advisory
Caldera Systems, Inc. Security Advisory
Subject: mgetty /tmp problems
Advisory number: CSSA-2001-002.0
Issue date: 2001 January, 12
Cross reference:
1. Problem Description
There is a /tmp/ file problem in the fax reception code of
mgetty which could allow determined attackers to overwrite system
files.
2. Vulnerable Versions
System Package
OpenLinux Desktop 2.3 All packages previous to
mgetty-1.1.22_Aug17-9
OpenLinux eServer 2.3.1 All packages previous to
and OpenLinux eBuilder mgetty-1.1.22_Aug17-9
OpenLinux eDesktop 2.4 All packages previous to
mgetty-1.1.22_Aug17-9
3. Solution
Workaround:
none
The proper solution is to upgrade to the fixed packages
4. OpenLinux Desktop 2.3
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS
4.2 Verification
ab0c2a2536d93e78da9e3dbad00358b4
RPMS/mgetty-1.1.22_Aug17-9.i386.rpm
eb3a13c3898303078d18f6d6cf5b8ad6
SRPMS/mgetty-1.1.22_Aug17-9.src.rpm
4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential
3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
e590735d575c46ab2035ff16dedafaa9
RPMS/mgetty-1.1.22_Aug17-9.i386.rpm
eb3a13c3898303078d18f6d6cf5b8ad6
SRPMS/mgetty-1.1.22_Aug17-9.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
8f229df2ee1cf6a95c632ed24750aab9
RPMS/mgetty-1.1.22_Aug17-9.i386.rpm
eb3a13c3898303078d18f6d6cf5b8ad6
SRPMS/mgetty-1.1.22_Aug17-9.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera’s internal Problem Report
8696.
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any
of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.
9. Acknowledgements
Caldera Systems, Inc. wishes to thank the Team at Immunix, Greg
KH at Wirex and Gert Doering for their cooperation.