Date: Mon, 28 Oct 2002 12:27:08 -0800
From: [email protected]
To: [email protected], [email protected],
Subject: Security Update: [CSSA-2002-040.0] Linux: uudecode performs inadequate checks on user-specified output files
--nYySOmuH/HDX6pKp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
To: [email protected][email protected][email protected][email protected]
______________________________________________________________________________
SCO Security Advisory
Subject: Linux: uudecode performs inadequate checks on user-specified output files
Advisory number: CSSA-2002-040.0
Issue date: 2002 October 28
Cross reference:
______________________________________________________________________________
1. Problem Description
The uudecode utility would create an output file without checking
to see if it was about to write to a symlink or a pipe. If a
user uses uudecode to extract data into open shared directories,
such as /tmp, this vulnerability could be used by a local attacker
to overwrite files or lead to privilege escalation.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to sharutils-4.2.1-7MR.1.i386.rpm
OpenLinux 3.1.1 Workstation prior to sharutils-4.2.1-7MR.1.i386.rpm
OpenLinux 3.1 Server prior to sharutils-4.2.1-7MR.1.i386.rpm
OpenLinux 3.1 Workstation prior to sharutils-4.2.1-7MR.1.i386.rpm
3. Solution
The proper solution is to install the latest packages. Many
customers find it easier to use the Caldera System Updater, called
cupdate (or kcupdate under the KDE environment), to update these
packages rather than downloading and installing them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/RPMS
4.2 Packages
98a9348513f981d0c919de67c7a3fd44 sharutils-4.2.1-7MR.1.i386.rpm
4.3 Installation
rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/SRPMS
4.5 Source Packages
9c89a0b5d4527def4cb2764bcd87f972 sharutils-4.2.1-7MR.1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/RPMS
5.2 Packages
d790a48715269c624d347556e4e84253 sharutils-4.2.1-7MR.1.i386.rpm
5.3 Installation
rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/SRPMS
5.5 Source Packages
521eb3dbd3aabb1e76a5db895f46e0bf sharutils-4.2.1-7MR.1.src.rpm
6. OpenLinux 3.1 Server
6.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/RPMS
6.2 Packages
87cd6250715583afa9905785853e546b sharutils-4.2.1-7MR.1.i386.rpm
6.3 Installation
rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm
6.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/SRPMS
6.5 Source Packages
ce9daba62eb424024a37b1d0288384db sharutils-4.2.1-7MR.1.src.rpm
7. OpenLinux 3.1 Workstation
7.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/RPMS
7.2 Packages
03b5f44ec89f04f36500e9ce909459ad sharutils-4.2.1-7MR.1.i386.rpm
7.3 Installation
rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm
7.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/SRPMS
7.5 Source Packages
cc2636f8152aced9d77fa310c65f0b8c sharutils-4.2.1-7MR.1.src.rpm
8. References
Specific references for this advisory:
http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=enhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178http://www.kb.cert.org/vuls/id/336083
SCO security resources:
http://www.sco.com/support/security/index.html
This security fix closes SCO incidents sr864863, fz521051,
erg712053.
9. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
10. Acknowledgements
AERAsec discovered and researched this vulnerability.
______________________________________________________________________________
--nYySOmuH/HDX6pKp
Content-Type: application/pgp-signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org
iEYEARECAAYFAj29nZwACgkQbluZssSXDTEuxQCfW3QpP/o9FTZTSBbuPz3C1Qse
LXcAoKp6t8vBfLEM4ijb8ksI+wN2Rt2X
=mYaL
-----END PGP SIGNATURE-----
--nYySOmuH/HDX6pKp--
