Turbolinux Security Announcement: pmake-2.1.35beta-2

Date: Fri, 25 May 2001 14:07:02 -0700 (PDT)
From: TurboLinux Security Team <security@www1.turbolinux.com>
Subject: [TL-Security-Announce] TLSA2001024 pmake-2.1.35beta-2

___________________________________________________________________________________________

                     Turbolinux Security Announcement

        Package:  pmake
        Vulnerable Packages: All Turbolinux versions previous to 2.1.35beta-2
        Date: 05/24/2001 5:00 PDT


        Affected Turbolinux platforms: TL 6.1 Workstation,
                                       All Turbolinux versions
                                       6.0.5 and earlier

        Turbolinux Advisory ID#:  TLSA2001024

       
___________________________________________________________________________________________

A security hole has been discovered in the package pmake.  Please update
the packages in your installation as soon as possible.
___________________________________________________________________________________________

1. Problem Summary
   
   In the Turbolinux platforms referenced above, the pmake binary is installed
   setuid root.

2. Impact

   A local user could run pmake with root privileges.  This could lead to a possibility
   of an attacker exploiting vulnerabilities in other programs that pmake uses.

3. Solution
     
   Update the packages from our ftp server by running the following
   command:

   rpm -Uvh ftp_path_to_filename

   Where ftp_path_to_filename is the following:

ftp://ftp.turbolinux.com/pub/updates/6.0/security/pmake-2.1.35beta-2.i386.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/pmake-customs-2.1.35beta-2.i386.rpm 

   The source RPM can be downloaded here:

ftp://ftp.turbolinux.com/pub/updates/6.0/SRPMS/pmake-2.1.35beta-2.src.rpm

   **Note: You must rebuild and install the RPM if you choose to download
   and install the SRPM.  Simply installing the SRPM alone WILL NOT CLOSE
   THE SECURITY HOLE.


************************************IMPORTANT******************************************

    In order for pmake to run properly, be sure to do the following:

      -Open up a terminal prompt and login as "root".
      -Go to /usr/lib/rpm and open the file called "macros".
      -Look for the directive called "%_mandir".  Its current setting is:

                        %{_prefix}/man

       Change it so that it reads:
           
                        %{_prefix}/share/man


*****************************************************************************************

  
 Please verify the MD5 checksums of the updates before you install:

  MD5 sum                               Package Name
___________________________________________________________________________________________
                                       
  06872bdb7868177cdf04169814a25f02        pmake-2.1.35beta-2.i386.rpm
  c583682c3f2b3bd3d7854580b0e758e5       pmake-customs-2.1.35beta-2.i386.rpm
  4cc72823376566879442057beb25cb33      pmake-2.1.35beta-2.src.rpm
___________________________________________________________________________________________

These packages are GPG signed by Turbolinux for security. Our key
is available here:

 http://www.turbolinux.com/security/tlgpgkey.asc

To verify a package, use the following command:

 rpm --checksig name_of_rpm

To examine only the md5sum, use the following command:

 md5sum name_of_rpm

**Note: Checking GPG keys requires RPM 3.0 or higher.

______________________________________________________________________________________________

You can find more updates on our ftp server:

   ftp://ftp.turbolinux.com/pub/updates/6.0/security/ 

for TL6.x Workstation and Server security updates

Our webpage for security announcements:

   http://www.turbolinux.com/security

If you want to report vulnerabilities, please contact:

   security@turbolinux.com
______________________________________________________________________________________________

Subscribe to the Turbolinux Security Mailing lists:

  TL-security - A moderated list for discussing security issues
                Turbolinux products.
  Subscribe at http://www.turbolinux.com/mailman/listinfo/tl-security

  TL-security-announce - An announce-only mailing list for security
                         updates and alerts.

  Subscribe at:

      http://www.turbolinux.com/mailman/listinfo/tl-security-announce