Date: Thu, 17 Feb 2000 17:46:59 -0800
From: Katie Moussouris k8e@turbolinux.com
To: tl-security-announce@turbolinux.com
Subject: [TL-Security-Announce] make-3.77-44 and earlier
TLSA2000002-01
TurboLinux Security Announcement
Package: make-3.77-44 and earlier
Date: Thu Feb 17 17:41:42 PST 2000
Affected TurboLinux versions: 6.0 and earlier
Vulnerability Type: local root compromise
TurboLinux Advisory ID#: TLSA2000002-01
BugTraq ID#: 981
Credits: SuSE-038:Security hole in make-3.77-44 (Advisory)
A security hole was discovered in the package mentioned above.
Please update the package in your installation as soon as possible
or disable the service.
1. Problem Summary
GNU make creates temporary files in /tmp without checking for
links if it is fed a Makefile via stdin.
2. Impact
A malicious user can execute commands with the privileges of the
user executing make. This security hole could lead to local root
compromise if root passes Makefiles to make through stdin.
3. Solution
Update the package from our ftp server by running the following
command:
rpm -Uv ftp_path_to_filename
Where ftp_path_to_filename is the following:
ftp://ftp.turbolinux.com/pub/updates/6.0/security/make-3.78.1-3.i386.rpm
You can find more updates on our ftp server:
ftp://ftp.turbolinux.com/pub/updates/6.0/security/
for TL6.0 Workstation and Server security updates
ftp://ftp.turbolinux.com/pub/updates/4.0/security/
for TL4.0 Workstation and Server security updates
Our webpage for security announcements:
http://www.turbolinux.com/security
If you want to report vulnerabilities, please contact: