SCO Linux Advisory: uudecode

____________________________________________________________________________

                        SCO Security Advisory

Subject:                Linux: uudecode performs inadequate checks on user-specified output files
Advisory number:        CSSA-2002-040.0
Issue date:             2002 October 28
Cross reference:
____________________________________________________________________________


1. Problem Description

        The uudecode utility would create an output file without checking
        to see if it was about to write to a symlink or a pipe. If a
        user uses uudecode to extract data into open shared directories,
        such as /tmp, this vulnerability could be used by a local attacker
        to overwrite files or lead to privilege escalation.


2. Vulnerable Supported Versions

        System                          Package
        ----------------------------------------------------------------------

        OpenLinux 3.1.1 Server          prior to sharutils-4.2.1-7MR.1.i386.rpm

        OpenLinux 3.1.1 Workstation     prior to sharutils-4.2.1-7MR.1.i386.rpm

        OpenLinux 3.1 Server            prior to sharutils-4.2.1-7MR.1.i386.rpm

        OpenLinux 3.1 Workstation       prior to sharutils-4.2.1-7MR.1.i386.rpm


3. Solution

        The proper solution is to install the latest packages. Many
        customers find it easier to use the Caldera System Updater, called
        cupdate (or kcupdate under the KDE environment), to update these
        packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

        4.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/RPMS

        4.2 Packages

        98a9348513f981d0c919de67c7a3fd44        sharutils-4.2.1-7MR.1.i386.rpm

        4.3 Installation

        rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

        4.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/SRPMS

        4.5 Source Packages

        9c89a0b5d4527def4cb2764bcd87f972        sharutils-4.2.1-7MR.1.src.rpm


5. OpenLinux 3.1.1 Workstation

        5.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/RPMS

        5.2 Packages

        d790a48715269c624d347556e4e84253        sharutils-4.2.1-7MR.1.i386.rpm

        5.3 Installation

        rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

        5.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/SRPMS

        5.5 Source Packages

        521eb3dbd3aabb1e76a5db895f46e0bf        sharutils-4.2.1-7MR.1.src.rpm


6. OpenLinux 3.1 Server

        6.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/RPMS

        6.2 Packages

        87cd6250715583afa9905785853e546b       sharutils-4.2.1-7MR.1.i386.rpm

        6.3 Installation

        rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

        6.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/SRPMS

        6.5 Source Packages

        ce9daba62eb424024a37b1d0288384db        sharutils-4.2.1-7MR.1.src.rpm/


7. OpenLinux 3.1 Workstation

        7.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/RPMS

        7.2 Packages

        03b5f44ec89f04f36500e9ce909459ad        sharutils-4.2.1-7MR.1.i386.rpm

        7.3 Installation

        rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

        7.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/SRPMS

        7.5 Source Packages

        cc2636f8152aced9d77fa310c65f0b8c        sharutils-4.2.1-7MR.1.src.rpm


8. References

        Specific references for this advisory:
                http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178
                http://www.kb.cert.org/vuls/id/336083

        SCO security resources:
                http://www.sco.com/support/security/index.html

        This security fix closes SCO incidents sr864863, fz521051,
        erg712053.


9. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers intended
        to promote secure installation and use of SCO products.


10. Acknowledgements

        AERAsec discovered and researched this vulnerability.