SuSE Linux Advisory: glibc

SuSE Security Announcement

Content of this advisory:

1. security vulnerability resolved: integer overflow in XDR code
   problem description, discussion, solution and upgrade
   information
2. pending vulnerabilities, solutions, workarounds:
   • ethereal
   • XFree4
   • vnc
   • bitchx
   • lv
3. standard appendix (further information)

1. problem description, brief discussion, solution, upgrade
   information

Another integer overflow was found in glibc’ XDR code. This bug
is equal to the one described in advisory SuSE-SA:2002:031. The
overflow occurs in the function xdrmem_getbytes() and can be used
by external attackers to execute arbitrary code.

There is no temporary workaround for this security problem other
than disabling all RPC based server and client programs. The
permanent solution is to update the glibc packages with the update
packages listed below.

Notes, Special installation instructions:

• PRECAUTIONS The shared libraries package of the glibc is the
  most sensitive part of a running Linux system, and modifications to
  it should be handled with special care. During the update of the
  shlibs/glibc package, runtime-linking the shared libraries is
  likely to fail for processes that execute a new binary with the
  execve(2) system call. Therefore, we recommend to bring a system to
  single user mode (“init S”) to perform the package update. If this
  is not applicable for operational reasons, a system receiving the
  update should be kept as quiet as possible (no shell scripts of any
  kind, no cron jobs, no incoming email).
• After performing the update, you should run the following
  command on your system:

  /sbin/ldconfig ldconfig will rebuild the runtime linker cache.
  If you use YOU (Yast2 Online Update), the ldconfig command will be
  executed automatically at the end of the update.

The shared libraries that were installed on the system before
the update have been removed from the filesystem, but they are
still in use by the running applications. Therefore, the disk-space
as well as the memory will not be freed until the last process that
uses these files exits. We recommend to reboot the system to
workaround this problem.

Listed below you find the URLs for the update packages for the
SuSE Linux products. We only list the packages that are relevant
for the security update. Our maintenance customers are being
notified individually. The packages are being offered to install
from the maintenance web.

Intel i386 Platform:

SuSE-8.1:

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.rpm
1cf549fa52427710c7dc3316fc5df4a6
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.patch.rpm
f87601fd71edf54928104581684dae8f

SuSE-8.0:

ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.rpm
da51402d30c37dd5dc6d5444c37f4dc3
patch rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.patch.rpm
0b5ea57d89c31d923cfb56cb1f951bac
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/glibc-2.2.5-177.src.rpm
6fecec2ed42fb792b6e9cb2a5602fe23

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/i386/update/7.3/a1/glibc-2.2.4-78.i386.rpm
11cc1ceb173b18fc82d8500b1528663e
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/glibc-2.2.4-78.src.rpm
38527e5f75d94c016659c71028c37c52

SuSE-7.2:

ftp://ftp.suse.com/pub/suse/i386/update/7.2/a1/glibc-2.2.2-68.i386.rpm
82f4c3ee8ba0cf3feef5e0ba7321a230
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/glibc-2.2.2-68.src.rpm
34114134cb51d706989c45306f4fdde3

SuSE-7.1:

ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/glibc-2.2-26.i386.rpm
ffe7c422727ee98b8191facbbf40b9d7
source rpm(s):

ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/glibc-2.2-26.src.rpm
1c5b778ff60a82f03e412239b907671b

Sparc Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/a1/glibc-2.2.4-46.sparc.rpm
dc577491e13344411462603b6fe83d3f
source rpm(s):

ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/glibc-2.2.4-46.src.rpm
0a0a5dd6ee76e6b0ef866b500d6537b2

AXP Alpha Platform:

SuSE-7.1:

ftp://ftp.suse.com/pub/suse/axp/update/7.1/a1/glibc-2.2-34.alpha.rpm
d250c254668e02b9f23341903f2f3a5e
source rpm(s):

ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/glibc-2.2-34.src.rpm
d89b4a1ff27227a085e516b48ccdb1cf

PPC Power PC Platform:

SuSE-7.3:

ftp://ftp.suse.com/pub/suse/ppc/update/7.3/a1/glibc-2.2.4-69.ppc.rpm
5bf4edf432c996b3e38ef085122e1e8

2. Pending vulnerabilities in SuSE Distributions and
   Workarounds:

• ethereal
  Several one-byte buffer overflows and integer overflows are fixed.
  These bugs lead to remote denial-of-service or even remote code
  execution. New packages are available on our FTP servers.
• XFree4
  A buffer overflow in the Xlib code can be triggered while handling
  the environment variable XLOCALEDIR. The X version affected is
  4.2.0 (SuSE Linux 8.0 and 8.1). New packages are available on our
  FTP servers.
• vnc
  VNC (Virtual Network Computing) uses a weak cookie generation
  process which can be exploited by an attacker to bypass
  authentication. New packages are available on our FTP servers.
• bitchx
  Several buffer overflows got fixed that can be exploited remotely
  by a malicious IRC servers. New packages are available on our FTP
  servers.
• lv
  lv reads config files from the current directory without verifying
  the ownership. If lv is called in world-writeable directories like
  /tmp it can be tricked into executing commands by putting a
  malicious config file there. New packages are available on our FTP
  servers.

3. standard appendix: authenticity verification, additional
   information

• Package authenticity verification:

SuSE update packages are available on many mirror ftp servers
all over the world. While this service is being considered valuable
and important to the free and open source software community, many
users wish to be sure about the origin of the package and its
content before installing the package. There are two verification
methods that can be used independently from each other to prove the
authenticity of a downloaded file or rpm package:

1. md5sums as provided in the (cryptographically signed)
   announcement.
2. using the internal gpg signatures of the rpm package.

1. execute the command
   md5sum <name-of-the-file.rpm>
   after you downloaded the file from a SuSE ftp server or its
   mirrors.
   Then, compare the resulting md5sum with the one that is listed in
   the announcement. Since the announcement containing the checksums
   is cryptographically signed (usually using the key security@suse.de), the checksums show
   proof of the authenticity of the package.
   We disrecommend to subscribe to security lists which cause the
   email message containing the announcement to be modified so that
   the signature does not match after transport through the mailing
   list software. Downsides: You must be able to verify the
   authenticity of the announcement in the first place. If RPM
   packages are being rebuilt and a new version of a package is
   published on the ftp server, all md5 sums for the files are
   useless.
2. rpm package signatures provide an easy way to verify the
   authenticity of an rpm package. Use the command
   rpm -v –checksig <file.rpm> to verify the signature of the
   package, where <file.rpm> is the filename of the rpm package
   that you have downloaded.
   Of course, package authenticity verification can only target an
   un-installed rpm package file. Prerequisites:
   1. gpg is installed
   2. The package is signed using a certain key. The public part of
      this key must be installed by the gpg program in the directory
      ~/.gnupg/ under the user’s home directory who performs the
      signature verification (usually root). You can import the key that
      is used by SuSE in rpm packages for SuSE Linux by saving this
      announcement to a file (“announcement.txt”) and running the command
      (do “su -” to be root): gpg –batch; gpg < announcement.txt |
      gpg –import SuSE Linux distributions version 7.1 and thereafter
      install the key “build@suse.de”
      upon installation or upgrade, provided that the package gpg is
      installed. The file containing the public key is placed at the
      top-level directory of the first CD (pubring.gpg) and at ftp://ftp.suse.com/pub/suse/pubring.gpg-build.suse.de
      .

SuSE runs two security mailing lists to which any interested
party may subscribe:

• suse-security@suse.com
  general/linux/SuSE security discussion. All SuSE security
  announcements are sent to this list. To subscribe, send an email
  to
  <suse-security-subscribe@suse.com>.
• suse-security-announce@suse.com

  SuSE’s announce-only mailing list. Only SuSE’s security
  announcements are sent to this list. To subscribe, send an email
  to
  <suse-security-announce-subscribe@suse.com>.

For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info@suse.com>
or <suse-security-faq@suse.com>
respectively.

SuSE’s security contact is <security@suse.com> or
<security@suse.de>. The
<security@suse.de>
public key is listed below.

The information in this advisory may be distributed or
reproduced, provided that the advisory is not modified in any way.
In particular, it is desired that the clear-text signature shows
proof of the authenticity of the text.
SuSE Linux AG makes no warranties of any kind whatsoever with
respect to the information contained in this security advisory.

Bye,

Thomas

Thomas Biege <thomas@suse.de>
SuSE Linux AG,Deutschherrnstr. 15-19,90429 Nuernberg Function:
Security Support & Auditing “lynx -source http://www.suse.de/~thomas/contact/thomas.asc
| gpg –import” Key fingerprint = 7254 B15D B3C4 943F 485E 0BBD
8ECC D7CB C200 A213

Das erste Opfer einer Schlacht ist immer der Schlachtplan.