6925470 2001-08-17 15:31 -0600 /125 rader/ Support Info <supinfo@caldera.com>
Sänt av: joel@lysator.liu.se
Importerad: 2001-08-18 03:21 av Brevbäraren
Extern mottagare: announce@lists.caldera.com
Extern mottagare: bugtraq@securityfocus.com
Extern mottagare: linux-security@redhat.com
Extern mottagare: linuxlist@securityportal.com
Mottagare: Bugtraq (import) <18826>
Ärende: Security Update: [CSSA-2001-031.0] Linux -security issues in ucd-snmp
------------------------------------------------------------
From: Support Info <supinfo@caldera.com>
To: announce@lists.caldera.com, bugtraq@securityfocus.com,
linux-security@redhat.com, linuxlist@securityportal.com
Message-ID: <20010817153117.A20425@phoenix.calderasystems.com>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
Caldera International, Inc. Security Advisory
Subject: Linux - security issues in ucd-snmp
Advisory number: CSSA-2001-031.0
Issue date: 2001, August 16
Cross reference:
______________________________________________________________________________
1. Problem Description
In a routine security audit of the ucd-snmp package we have found
several problems, including several potentially exploitable buffer
overflows, format string bugs, signedness issues and tempfile race
conditions. Some of these might allow remote attackers to gain
access to the UID under which snmpd is running. This update fixes
all known problems and also makes the snmpd run as user 'nobody',
reducing the impact of further problems.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux 2.3 not vulnerable
OpenLinux eServer 2.3.1 All packages previous to
and OpenLinux eBuilder ucd-snmp-4.2.1-6b
OpenLinux eDesktop 2.4 not vulnerable
OpenLinux Server 3.1 not vulnerable
OpenLinux Workstation 3.1 not vulnerable
3. Solution
Workaround
none
The proper solution is to upgrade to the latest packages.
4. OpenLinux 2.3
not vulnerable
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS
The corresponding source code package can be found at:
ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
cb200e856acac6bd14fec9eb67eabb14
RPMS/ucd-snmp-4.2.1-6b.i386.rpm
0c8f8963ce490f80a47681996e9370ab
RPMS/ucd-snmp-devel-4.2.1-6b.i386.rpm
d584b6cd0b799b4b928dadce9f2ec058
RPMS/ucd-snmp-utils-4.2.1-6b.i386.rpm
1e78df3f5bfce4319ce8e7622e45d795
SRPMS/ucd-snmp-4.2.1-6b.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh ucd-snmp-4.2.1-6b.i386.rpm \
ucd-snmp-devel-4.2.1-6b.i386.rpm \
ucd-snmp-utils-4.2.1-6b.i386.rpm
6. OpenLinux eDesktop 2.4
not vulnerable
7. OpenLinux 3.1 Server
not vulnerable
8. OpenLinux 3.1 Workstation
not vulnerable
9. References
This and other Caldera security resources are located at:
http://www.caldera.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 10043.
10. Disclaimer
Caldera International, Inc. is not responsible for the misuse of
any of the information we provide on this website and/or through
our security advisories. Our advisories are a service to our
customers
intended to promote secure installation and use of Caldera
OpenLinux.
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE7e8xX18sy83A/qfwRAo5PAJ9jSIigxzeYe8VQiITZDugLUTTY/wCff/ka
C7IXbFJO40v6YYKKTMdglFk=
=VFQ1
-----END PGP SIGNATURE-----
(6925470) /Support Info <supinfo@caldera.com>/(Ombruten)
Kommentar i text 6930804 av Alex Prestin <wakko@bitey.net>