Date: Tue, 5 Sep 2000 09:07:28 -0600
From: Technical Support support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: serious vulnerability in glibc NLS
code
Caldera Systems, Inc. Security Advisory
Subject: serious vulnerability in glibc NLS code
Advisory number: CSSA-2000-030.0
Issue date: 2000 September, 1
Cross reference:
1. Problem Description
The GNU C library, glibc, allows users to specify their
so-called locale through environment variables such as LANG. The
locale determines what language, monetary signs etc to use when
communicating with the user.
A bug in the parsing of these locale names allows an attacker to
trick glibc into using locale information files provided by the
attacker, which can make an application crash.
This bug can be used by local users to obtain root privilege
through various setuid root applications.
2. Vulnerable Versions
System Package
OpenLinux Desktop 2.3 All packages previous to
glibc-2.1.1-3
OpenLinux eServer 2.3 All packages previous to
and OpenLinux eBuilder glibc-2.1.3-4S
OpenLinux eDesktop 2.4 All packages previous to
glibc-2.1.2-7
3. Solution
Workaround:
None known.
4. OpenLinux Desktop 2.3
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS
4.2 Verification
9509340276c43bdcbeee2d95e82b9d03 RPMS/glibc-2.1.1-3.i386.rpm
e7d4b0f9db9b92af32b224d7e1b83511 RPMS/glibc-devel-2.1.1-3.i386.rpm
b2fac2bcf6e961d7fc5f4071be2cd934 RPMS/glibc-devel-static-2.1.1-3.i386.rpm
3883f85e36804e8a25f5c8f1d5644a18 RPMS/glibc-localedata-2.1.1-3.i386.rpm
8c155c6564b725d09c9c2b4109212774 SRPMS/glibc-2.1.1-3.src.rpm
4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*.i386.rpm
5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential
3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
083a50ef11461be5925c139ab1754e78 RPMS/glibc-2.1.3-4S.i386.rpm
d47e1eef4448514d3d6163acf6752a33 RPMS/glibc-devel-2.1.3-4S.i386.rpm
c2534552c30464f4d7a5b35a909dd2da RPMS/glibc-devel-static-2.1.3-4S.i386.rpm
87e72a76353c38dd856e48199d03a965 RPMS/glibc-localedata-2.1.3-4S.i386.rpm
24dc7d444ed055987af0fdf86ac43e6e SRPMS/glibc-2.1.3-4S.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*i386.rpm
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera’s FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
d8729cd44a58ee64b1e771bee3cbafb2 RPMS/glibc-2.1.2-7.i386.rpm
e9138f01f763a454598cf5832ef43327 RPMS/glibc-devel-2.1.2-7.i386.rpm
c0a617bf52890fdae7351bcc293540b2 RPMS/glibc-devel-static-2.1.2-7.i386.rpm
704b41eab208e9991f0248ff0c54db54 RPMS/glibc-localedata-2.1.2-7.i386.rpm
29820d97b016f0143528f49eb85ef405 SRPMS/glibc-2.1.2-7.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fhv glibc-*i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera’s internal Problem Report
7602.
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any
of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.
9. Acknowledgements
Caldera Systems wishes to thank Jouko Pynnönen jouko@solutions.fi for finding and
reporting this problem.