Date: Wed, 31 Mar 2004 15:44:30 -0800 (PST)
From: [email protected]
To: [email protected], [email protected],
Subject: OpenLinux: util-linux could leak sensitive data
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
______________________________________________________________________________
SCO Security Advisory
Subject: OpenLinux: util-linux could leak sensitive data
Advisory number: CSSA-2004-016.0
Issue date: 2004 March 30
Cross reference: sr889555 fz528943 erg712558 CAN-2004-0080
______________________________________________________________________________
1. Problem Description
The login program in util-linux 2.11 and earlier uses a pointer
after it has been freed and reallocated, which could cause login
to leak sensitive data.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0080 to this issue.
2. Vulnerable Supported Versions
System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to util-linux-2.12-1.i386.rpm
OpenLinux 3.1.1 Workstation prior to util-linux-2.12-1.i386.rpm
3. Solution
The proper solution is to install the latest packages. Unix
users with Linux Kernel Personality can use the Caldera System
Updater, called cupdate (or kcupdate under the KDE environment),
to update these packages rather than downloading and installing
them by hand.
4. OpenLinux 3.1.1 Server
4.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/RPMS
4.2 Packages
43420f997baa5875bba02bc8df410f88 util-linux-2.12-1.i386.rpm
4.3 Installation
rpm -Fvh util-linux-2.12-1.i386.rpm
4.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/SRPMS
4.5 Source Packages
7a014652e2029b4dda3209b62e1ba375 util-linux-2.12-1.src.rpm
5. OpenLinux 3.1.1 Workstation
5.1 Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/RPMS
5.2 Packages
cff227fcbc2d7e121e2134927b86a125 util-linux-2.12-1.i386.rpm
5.3 Installation
rpm -Fvh util-linux-2.12-1.i386.rpm
5.4 Source Package Location
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/SRPMS
5.5 Source Packages
24c22395492db21fbd62d4c0419ec524 util-linux-2.12-1.src.rpm
6. References
Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0080
SCO security resources:
http://www.sco.com/support/security/index.html
This security fix closes SCO incidents sr889555 fz528943
erg712558.
7. Disclaimer
SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.
8. Acknowledgements
SCO would like to thank Red Hat
______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)
iD8DBQFAaicYbluZssSXDTERAiYeAKCHSVw69wPHlur/nqPZsza0udGKYwCgjDSp
qC3DOMlPqfQ9oF7NMT69ci0=
=Mr4Z
-----END PGP SIGNATURE-----
