Date: Mon, 16 Oct 2000 16:16:07 +0200 (MEST)
From: Roman Drahtmueller draht@suse.de
To: suse-security-announce@suse.de
Subject: [suse-security-announce] SuSE Security Announcement:
traceroute (SuSE-SA:2000:041)
SuSE Security Announcement
Package: traceroute
Announcement-ID: SuSE-SA:2000:041
Date: Monday, October 16th, 2000 16:10 MEST
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 6
SuSE default package: yes
Other affected systems: Linux systems using the NANOG traceroute
Content of this advisory:
1) security vulnerability resolved: traceroute
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
1) problem description, brief discussion, solution, upgrade
information
The security problem in the traceroute program as shipped with
SuSE Linux distributions is completely different from the one
reported on security mailing lists a few days ago (`traceroute -g 1
-g 1′) by Pekka Savola . SuSE distributions do not contain this
particular traceroute implementation. The problem in our traceroute
was discovered independently and reported to us by H D Moore
hdm@secureaustin.com. The
problem in the implementation of traceroute that we ship is a
format string parsing bug in a routine that can be used to
terminate a line in traceroute’s output to easily embed the program
in cgi scripts as used for web frontends for traceroute. Using a
specially crafted sequence of characters on the commandline, it is
possile to trick the traceroute program into running arbitrary code
as root.
If you want to temporarily work around this security
vulnerability, you can disable traceroute for normal users by
clearing the suid bit on the file /usr/sbin/traceroute: chmod -s
/usr/sbin/traceroute . Do not forget to change the respective line
in /etc/permissions to read:
/usr/sbin/traceroute root.root 755
We have prepared update packages on our ftp server that eliminate
the vulnerability in the traceroute program. Note that the
traceroute program is contained in the nkita or the nkitb package,
depending on the distribution version.
Download the update package from locations described below and
install the package with the command `rpm -Fhv file.rpm’. The
md5sum for each file is in the line below. You can verify the
integrity of the rpm files using the command
`rpm –checksig –nogpg file.rpm’,
independently from the md5 signatures below.
i386 Intel Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2000.10.4-0.i386.rpm
6c8f713a071a96c287942f880cd5919c
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
c01db9ee70a9ac01cba1bace93cfdd16
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.7.11-0.i386.rpm
118075b7fc295be86b3659bf9b3fa778
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
61aa9e2e4272606d2bd70828a72c957c
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/nkita-2000.10.4-0.i386.rpm
6c5932e4083de6f499e4c77fcadbffc1
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
9debb8804293384057d69254614a1496
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm
49269283c6d39a234f61303b2e918413
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkita-2000.10.4-0.src.rpm
1cc00eb9b37b37a51fc249db3b51f6e1
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/nkita-2000.10.4-0.i386.rpm
2fe1c6d70fcf1272da95f33ad7ad1010
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkita-2000.10.4-0.src.rpm
74d6f2e623b7fcac1b0881b1bfbe0880
SuSE-6.0
Please use the update packages from the 6.1 distribution.
Sparc Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2000.10.4-0.sparc.rpm
e9bc3512b6182f540e74308c02d81f65
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
8fba03e9cef63ae076b10fb61c800e39
AXP Alpha Platform:
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2000.10.4-0.alpha.rpm
7850969c7b3beaf3fd1ce8b2a9246be0
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
6e5a964177b6cf87524119c747f0220b
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/nkita-2000.10.4-0.alpha.rpm
6440a6a7da903829cff57a5f8c7cda91
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
53bf05462378c384e8a46f3c6c368c67
PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2000.10.5-0.ppc.rpm
407d1c6731228f5d3e9addd108d31224
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2000.10.5-0.src.rpm
8fba03e9cef63ae076b10fb61c800e39
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2000.10.4-0.ppc.rpm
c432a5b8d37640be6e325ef9603f9cba
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
edf24c1989c85616d1caf53872e61f17
2) Pending vulnerabilities in SuSE Distributions and
Workarounds:
A set of security announcements is following this advisory.
3) standard appendix:
SuSE runs two security mailing lists to which any interested
party may subscribe:
suse-security@suse.com
– general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list. To
subscribe, send an email to suse-security-subscribe@suse.com.
suse-security-announce@suse.com
– SuSE’s announce-only mailing list.
Only SuSE’s security annoucements are sent to this list. To
subscribe, send an email to suse-security-announce-subscribe@suse.com.
For general information or the frequently asked questions (faq)
send mail to:
suse-security-info@suse.com
or
suse-security-faq@suse.com
respectively.
SuSE’s security contact is security@suse.com.
Regards,
Roman Drahtmüller.
– – —
- -
| Roman Drahtmüller draht@suse.de // "Caution: Cape does |
SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
- -