Caldera Systems Security Update: DoS on gpm

Date: Thu, 20 Jul 2000 10:27:35 -0600
From: Technical Support
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: Security Update: DoS on gpm

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

---

                   Caldera Systems, Inc.  Security Advisory

Subject:                DoS on gpm
Advisory number:        CSSA-2000-024.0
Issue date:             2000 July, 6
Cross reference:

---

1. Problem Description

There are security problems within gpm (General Purpose Mouse
support daemon) which allow removal of system files and also
exhibit a local denial of service attack.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
                                gpm-1.17.8-5

   OpenLinux eServer 2.3        All packages previous to
   and OpenLinux eBuilder       gpm-1.17.8-5

   OpenLinux eDesktop 2.4       All packages previous to
                                gpm-1.19.2-4

3. Solution

Workaround:

none

We recommend our users to upgrade to the new packages.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera’s FTP site at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

4.2 Verification

       bdcc5caf3e4cf4abb3081ef6e2049a61  RPMS/gpm-1.17.8-5.i386.rpm
       7436e49533e64d7a737c920bbc874299  RPMS/gpm-devel-1.17.8-5.i386.rpm
       f9c19f994238fa507d4e5505ebd78b59  RPMS/gpm-devel-static-1.17.8-5.i386.rpm
       c0c839fb697c10f5520bda679366135f  SRPMS/gpm-1.17.8-5.src.rpm

4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:
rpm -F gpm-*.i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential
3.0

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera’s FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

5.2 Verification

       061e6d50414c0c024547e29c3e1a0737  RPMS/gpm-1.17.8-5.i386.rpm
       79633f3258b8bcbdff2fdd733e262e10  RPMS/gpm-devel-1.17.8-5.i386.rpm
       0fa3527333421bf90f844376ff692d9d  RPMS/gpm-devel-static-1.17.8-5.i386.rpm
       c0c839fb697c10f5520bda679366135f  SRPMS/gpm-1.17.8-5.src.rpm

5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:
rpm -F gpm-*.i386.rpm

6. OpenLinux eDesktop 2.4

6.1 Location of Fixed Packages

The upgrade packages can be found on Caldera’s FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

6.2 Verification

       3f83840592100ea6a770070e11f4d9d9  RPMS/gpm-1.19.2-4.i386.rpm
       f223771658eef771a5f93b09dc50c281  RPMS/gpm-devel-1.19.2-4.i386.rpm
       7a50dd9a854ed30365cf535850d39420  RPMS/gpm-devel-static-1.19.2-4.i386.rpm
       c43abbdd533ac0d9a247eb13dfbb5bb4  SRPMS/gpm-1.19.2-4.src.rpm

6.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:
rpm -F gpm-*.i386.rpm

7. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

This security fix closes Caldera’s internal Problem Report
7297.

8. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any
of the information we provide on this website and/or through our
security advisories. Our advisories are a service to our customers
intended to promote secure installation and use of Caldera
OpenLinux.

9. Acknowledgement

Caldera Systems wishes to thank Ian Zimmermann for providing the
fix.

---

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5dp+V18sy83A/qfwRAhCfAJ934cwOj+vi8taarVCA1w8jqf33CwCcDss6
I0IGl8DR0aWD4MIRqQsUcaM=
=hoSC
-----END PGP SIGNATURE-----