Caldera Systems Security Advisory: symlink attack on makewhatis script possible

Date: Fri, 7 Jul 2000 16:42:19 -0600
From: Technical Support support@PHOENIX.CALDERASYSTEMS.COM
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: symlink attack on makewhatis script possible

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
                   Caldera Systems, Inc.  Security Advisory

Subject:                symlink attack on makewhatis script possible
Advisory number:        CSSA-2000-021.0
Issue date:             2000 July, 6
Cross reference:
______________________________________________________________________________


1. Problem Description

   There is a problem in the way the makewhatis script, which is run
   daily to rebuild the database used by the whatis(1) command, handles
   temporary files.  This can be exploited by local users to corrupt
   arbitrary files on the system.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
                                man-1.5f-6

   OpenLinux eServer 2.3        All packages previous to
   and OpenLinux eBuilder       man-1.5f-6

   OpenLinux eDesktop 2.4       All packages previous to
                                man-1.5g-2

3. Solution

   Workaround:

   Delete the cron job that runs the makewhatis script daily by
   typing

        rm -f /etc/cron.d/Daily/*makewhatis

   The proper solution is to upgrade to the fixed packages.

4. OpenLinux Desktop 2.3

   4.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

   4.2 Verification

       41b80d7c8c54d34da28675d1c278ee45  RPMS/man-1.5f-6.i386.rpm
       3845595f1bcbdff4e50aa96b43e244e3  SRPMS/man-1.5f-6.src.rpm

   4.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -F man-1.5f-6.i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

       257782369c23c8b64858d0110447453f  RPMS/man-1.5f-6.i386.rpm
       3845595f1bcbdff4e50aa96b43e244e3  SRPMS/man-1.5f-6.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -F man-1.5f-6.i386.rpm

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

       a3937cd965cc422ba2ca03071958b046  RPMS/man-1.5g-2.i386.rpm
       d64f3e0b7d85e57f5be81272e1c6ae3b  SRPMS/man-1.5g-2.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

          rpm -F man-1.5g-2.i386.rpm

7. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 7127.

8. Disclaimer

   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5ZKyE18sy83A/qfwRAsI9AJ9ko+qJnoteLsqAYKx+/6iFbGTvqwCffdwW
eDp1zSyqpnw83qc2uJvSYG4=
=SDw8
-----END PGP SIGNATURE-----