OpenLinux Advisory: slocate

SCO Security Advisory

Subject: OpenLinux: slocate local user buffer overflow
Advisory number: CSSA-2004-001.0
Issue date: 2004 February 10
Cross reference: sr886033 fz528414 erg712456

1. Problem Description

Heap-based buffer overflow in main.c of slocate 2.6,
and possibly other versions, may allow local users to gain
privileges via a modified slocate database that causes a negative
“pathlen” value to be used. The Common Vulnerabilities and
Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0848 to this issue.

2. Vulnerable Supported Versions

System	Package
OpenLinux 3.1.1 Server	prior to slocate-2.7-1.i386.rpm
OpenLinux 3.1.1 Workstation	prior to slocate-2.7-1.i386.rpm

3. Solution

The proper solution is to install the latest packages.
Many customers find it easier to use the Caldera System Updater,
called cupdate (or kcupdate under the KDE environment), to update
these packages rather than downloading and installing them by
hand.

4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/RPMS

4.2 Packages

fd4e0b81e27fd236fcf0e34c28dcca2c slocate-2.7-1.i386.rpm

4.3 Installation

rpm -Fvh slocate-2.7-1.i386.rpm

4.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/SRPMS

4.5 Source Packages

3a2adce6e30bdcba92fe6a7f70216461 slocate-2.7-1.src.rpm

5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/RPMS

5.2 Packages

44f7234c2a58efada5512157bc421d78 slocate-2.7-1.i386.rpm

5.3 Installation

rpm -Fvh slocate-2.7-1.i386.rpm

5.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/SRPMS

5.5 Source Packages

e2f70c80ae832d1267ce22e62ea90d15 slocate-2.7-1.src.rpm

6. References

Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848

http://marc.theaimsgroup.com/?l=bugtraq&m=106546447321274&w=2

http://marc.theaimsgroup.com/?l=bugtraq&m=106589631819348&w=2

http://www.ebitech.sk/patrik/SA/SA-20031006.txt

http://www.ebitech.sk/patrik/SA/SA-20031006-A.txt

SCO security resources:
http://www.sco.com/support/security/index.html

This security fix closes SCO incidents sr886033 fz528414
erg712456.

7. Disclaimer

SCO is not responsible for the misuse of any of the
information we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO
products.

8. Acknowledgements

SCO would like to thank Patrik Hornik