Date: Fri, 26 Jan 2001 15:55:17 +0100
From: Roman Drahtmueller draht@SUSE.DE
To: BUGTRAQ@SECURITYFOCUS.COM
Subject: SuSE Security Announcement: shlibs/glibc
(SuSE-SA:2001:01)
SuSE Security Announcement
Package: glibc (shlibs)
Announcement-ID: SuSE-SA:2001:01
Date: Friday, January 26th, 2001 15:40 MET
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 6
SuSE default package: yes
Other affected systems: most Linux/glibc based systems
Content of this advisory:
1) security vulnerability resolved: glibc
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
1) problem description, brief discussion, solution, upgrade
information
ld-linux.so.2, the dynamical linker, adds shared libraries to
the memoryspace of a program to be started. Its flexibility allows
for some environment variables to influence the linking process
such as preloading shared libraries as well as defining the path in
which the linker will search for the shared libraries. Special care
must be exercised when runtime-linking setuid- or setgid-binaries:
The runtime-linker must not link against user-specified libraries
since the code therein would then run with the elevated privileges
of the suid binary.
The runtime-linker as used in the SuSE distributions ignores the
content of the critical environment variables if the specified path
begins with a slash (“/”), or if the library file name is not
cached (eg it is contained in a path from /etc/ld.so.conf).
However, Solar Designer has found out that even preloading glibc-
native shared libraries can be dangerous: The code in the
user-linked library is not aware of the fact that the binary runs
with suid or sgid privileges. Using debugging features of the glibc
(and possibly other features) it is possible for a local attacker
to overwrite arbitrary files with the elevated privileges of the
suid/sgid binary executed. This may lead to a local root
compromise.
To eliminate these problems, we provide update packages that
completely disregard the LD_* variables upon runtime-linking of a
binary that has an effective uid different from the caller’s
userid.
Download the update package from locations desribed below and
install the package with the command `rpm -Uhv file.rpm’. The
md5sum for each file is in the line below. You can verify the
integrity of the rpm files using the command
`rpm –checksig –nogpg file.rpm’,
independently from the md5 signatures below.
SPECIAL INSTALL INSTRUCTIONS:
The glibc (the shlibs package) is an intrinsic part of the
GNU/Linux operating system since most binary executables are
dependent on the shared libraries from that package. For this
reason, special care must be taken while updating the shlibs
package. After downloading the binary rpm files, make sure that
your system is idle by bringing it down to Single User Mode (`init
1´). If this is not applicable for operational reasons, then
keep your machine as calm as possible while you perform the update.
In particular, make sure that no shell scripts are running during
the update.
Install the package using the command
rpm -Uhv package-rpm-file
Do _NOT_ interrupt the operation of the rpm command!
After the installation, execute the commands
ldconfig # alternatively, use SuSEconfig
/sbin/init u # will restart init
At this point, the update is done. On low-memory machines a reboot
is advisable to free the memory that is used by the old
memory-mapped libraries.
Note 1:
The upcoming SuSE-7.1 distribution is based on glibc-2.2. This
distribution is not affected by the security problems in glibc as
discussed in security forums.
Note 2:
The source rpm for the shlibs package is called “libc*.rpm”.
Multiple binary rpm packages are being generated from this source
rpm package. These include: localedb, nssv1, shlibs, timezone. To
get a fix for the runtime-linker related security issue (topic of
this announcement), it is only necessary to update the shlibs
binary rpm package.
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm
94ccbb80d2841f08f2b7322671d6e7f3
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm
3d15b6ffff534f0bf705882dbd8a2551
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm
bc03f1a6f32a66958128e9450e355698
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm
e8f2aa8d32122edfbe3c436a52abb847
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm
8d572332c67b488e5d64a8d4d3274e90
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm
8e1f861112f4a921ea4c7b5631304ee6
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm
b6b4cfe73e46c5b3bd5b626d68dfa584
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm
67fcd70b40f145b5f40b86f7254e35be
SuSE-6.1
SuSE-6.0
The rpm packages are being produced as this announcement is
written. The md5sums for these rpm packages will be provided on the
ftp-server, signed with the security@suse.de pgp key below.
Sparc Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm
6b000a6278366c6da4b719d2f62ad7a4
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm
e845606be9c9aca72213e4c5f1f32290
AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm
2df813e3c08b52e3f914c591efc742d4
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm
9cb7a6e5981112da6d702916d453b419
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm
0636c2cddf131e76c19e154619a65bd8
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm
39fd3b8e7e4054bc7a333a831e99e6fd
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm
f9713bc945bf7f98527d2fdfbe756dfb
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm
af2eb3df9d83f8f8ca13526046a3a539
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm
4a0033c4ec32ef0e79fc1b7a83692738
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm
11871baa8279f8c0c79f6c9d95ca531c
PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm
8d9d27a8fba22de4df5cd4700a541ad9
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm
89946b9a2bb7c545a1761a84ebd979ab
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm
383bb49a2f6a3e83a9c2ed3eea30dc99
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm
91ed7087165b74383cddb556abc07402
2) Pending vulnerabilities in SuSE Distributions and
Workarounds:
This announcement is followed by a sequence of more
announcements to address the ongoing security problems as discussed
in public security forums. In particular, there are temporary file
races in multiple packages (we collect and address them in a single
announcement to keep the noise low), format string bugs, as well as
a man-in-the-middle attack in the kdesu program and a single-byte
buffer overflow. The next announcenemts will contain more
information on these topics. Please stay tuned.
3) standard appendix:
SuSE runs two security mailing lists to which any interested
party may subscribe:
suse-security@suse.com
– general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list. To
subscribe, send an email to suse-security-subscribe@suse.com.
suse-security-announce@suse.com
– SuSE’s announce-only mailing list.
Only SuSE’s security annoucements are sent to this list. To
subscribe, send an email to suse-security-announce-subscribe@suse.com.
For general information or the frequently asked questions (faq)
send mail to:
suse-security-info@suse.com
or
suse-security-faq@suse.com
respectively.
SuSE’s security contact is security@suse.com.
Regards,
Roman Drahtmüller.
– – —
- - | Roman Drahtmüller draht@suse.de // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - -