8440832 2002-05-14 13:28 -0700 /176 rader/ <security@caldera.com> Sänt av: joel@lysator.liu.se Importerad: 2002-05-14 23:39 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Mottagare: Bugtraq (import) <22273> Ärende: Security Update: [CSSA-2002-018.1] Linux: REVISED: Race condition in fileutils ------------------------------------------------------------ From: security@caldera.com To: bugtraq@securityfocus.com, announce@lists.caldera.com, security-alerts@linuxsecurity.com Message-ID: <20020514132829.E368@caldera.com> To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com ______________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: Linux: REVISED: Race condition in fileutils Advisory number: CSSA-2002-018.1 Issue date: 2002 May 13 Cross reference: ______________________________________________________________________________ 1. Problem Description A race condition in various utilities from the GNU fileutils package may cause a root user to delete the whole filesystem. This updates resolves a problem in the original fix that would cause an attempt to recursively remove a directory with trailing slashes to memory fault. 2. Vulnerable Supported Versions System Package ---------------------------------------------------------------------- OpenLinux 3.1.1 Server prior to fileutils-4.1-5.i386.rpm OpenLinux 3.1.1 Workstation prior to fileutils-4.1-5.i386.rpm OpenLinux 3.1 Server prior to fileutils-4.1-5.i386.rpm OpenLinux 3.1 Workstation prior to fileutils-4.1-5.i386.rpm 3. Solution The proper solution is to install the latest packages. 4. OpenLinux 3.1.1 Server 4.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS 4.2 Packages d01d42d41800d0b9c1d02c4fec07a79d fileutils-4.1-5.i386.rpm 4.3 Installation rpm -Fvh fileutils-4.1-5.i386.rpm 4.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS 4.5 Source Packages ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm 5. OpenLinux 3.1.1 Workstation 5.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS 5.2 Packages 993d932af015edb5ad6e4d70db171492 fileutils-4.1-5.i386.rpm 5.3 Installation rpm -Fvh fileutils-4.1-5.i386.rpm 5.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS 5.5 Source Packages ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm 6. OpenLinux 3.1 Server 6.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS 6.2 Packages 79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm 6.3 Installation rpm -Fvh fileutils-4.1-5.i386.rpm 6.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS 6.5 Source Packages 238ad9663d26b196eea92874a96b1c53 fileutils-4.1-5.src.rpm 7. OpenLinux 3.1 Workstation 7.1 Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS 7.2 Packages 79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm 7.3 Installation rpm -Fvh fileutils-4.1-5.i386.rpm 7.4 Source Package Location ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS 7.5 Source Packages 01a126030929e44c83a473ee662fecb9 fileutils-4.1-5.src.rpm 8. References Specific references for this advisory: http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html http://isec.pl/vulnerabilities/0002.txt Caldera OpenLinux security resources: http://www.caldera.com/support/security/index.html Caldera UNIX security resources: http://stage.caldera.com/support/security/ This security fix closes Caldera incidents sr862917, fz520627, erg712018. 9. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera products. 10. Acknowledgements Caldera would like to thank Vincent Danen at Mandrake for alerting us to the problems with the original fix. Wojciech Purczynski (iSEC Security Research, http://isec.pl) reported this vulnerability. ______________________________________________________________________________ (8440832) / <security@caldera.com>/-------(Ombruten) Bilaga (application/pgp-signature) i text 8440833 8440833 2002-05-14 13:28 -0700 /9 rader/ <security@caldera.com> Importerad: 2002-05-14 23:39 av Brevbäraren Extern mottagare: bugtraq@securityfocus.com Extern mottagare: announce@lists.caldera.com Extern mottagare: security-alerts@linuxsecurity.com Mottagare: Bugtraq (import) <22274> Bilaga (text/plain) till text 8440832 Ärende: Bilaga till: Security Update: [CSSA-2002-018.1] Linux: REVISED: Race condition in fileutils ------------------------------------------------------------ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.6 (SCO_SV) Comment: For info see http://www.gnupg.org iEYEARECAAYFAjzhc20ACgkQbluZssSXDTHGSQCfbXNoVb8C99r92obDYevNMGtg 0TQAoIT5OPdottTSj6SIp4UiAArJtX+o =eXHQ -----END PGP SIGNATURE----- (8440833) / <security@caldera.com>/-----------------