Date: Tue, 3 Apr 2001 16:16:33 -0600
From: Caldera OpenLinux User <[email protected]>
To: [email protected]Subject: Security update: several security problems in linux kernel CSSA-2001-012.0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
___________________________________________________________________________=
___
Caldera Systems, Inc. Security Advisory
Subject: several security problems in linux kernel
Advisory number: CSSA-2001-012.0
Issue date: 2001 April, 3
Cross reference:
___________________________________________________________________________=
___
1. Problem Description
During code audits of the Linux Kernel several security problems
have been found. Some of them allow a local attacker to gain
root privileges through race conditions, others allow reading
and possibly writing of random kernel memory.
With these patches now being available in the 2.2.19 kernel, this
update backports them to the kernels used in our products.
2. Vulnerable Versions
System Package
-----------------------------------------------------------
OpenLinux 2.3 All packages previous to
linux-2.2.10-12
OpenLinux eServer 2.3.1 All packages previous to
and OpenLinux eBuilder linux-2.2.14-11S
OpenLinux eDesktop 2.4 All packages previous to
linux-2.2.14-7
3. Solution
Workaround
none
The proper solution is to upgrade to the latest packages.
4. OpenLinux 2.3
4.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
=20
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS
4.2 Verification
c0abd6e725f9791545738d74e7a338f0 RPMS/linux-kernel-binary-2.2.10-12.i386.r=
pm
43907dfa0696a0d0e23b3d74ac98d6a0 RPMS/linux-kernel-doc-2.2.10-12.i386.rpm
ff332be214d5796097ee81bb436aa8aa RPMS/linux-kernel-include-2.2.10-12.i386.=
rpm
bb28b2c5f99f601014e8c5f0f41b8e38 RPMS/linux-source-alpha-2.2.10-12.i386.rpm
4544ba8d0bd42d7cacb7624ac55cb97e RPMS/linux-source-arm-2.2.10-12.i386.rpm
f6f6249203c1c01d7ce1343e2526a7c8 RPMS/linux-source-common-2.2.10-12.i386.r=
pm
7a6089c9c84b7ffece6429c0cc4061d5 RPMS/linux-source-i386-2.2.10-12.i386.rpm
d882ef84c328a93f7fe5ef4be618053e RPMS/linux-source-m68k-2.2.10-12.i386.rpm
d65460cb00441d97ea84ccc4beebd8d9 RPMS/linux-source-mips-2.2.10-12.i386.rpm
6c8f1575dd55c3421081a1d225c808b8 RPMS/linux-source-ppc-2.2.10-12.i386.rpm
4b2ede9a55b08f7cfece30c60c82b25c RPMS/linux-source-sparc-2.2.10-12.i386.rpm
2556435b553f1ad13974d6c5997639fe RPMS/linux-source-sparc64-2.2.10-12.i386.=
rpm
21e54c126869848f2a87e13be8c8cf3e RPMS/pcmcia-cs-3.0.14-3.i386.rpm
eb1bd121022e40501edb26104142dfdb SRPMS/linux-2.2.10-12.src.rpm
45a67c026f4ec2f215431a77e593d318 SRPMS/pcmcia-cs-3.0.14-3.src.rpm
4.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
modprobe loop
rpm -Fhv *.i386.rpm
5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0
5.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS
5.2 Verification
4d81026c3b760cd3dfe6b18d6acbe123 RPMS/iBCS-2.1-6.i386.rpm
724c1ac2254480bbc0c694281d32e3b7 RPMS/iBCS-extras-2.1-6.i386.rpm
fa0b96983659f4394960420cc5840e06 RPMS/linux-kernel-binary-2.2.14-11S.i386.=
rpm
caa634390f73722de809082cb357f701 RPMS/linux-kernel-doc-2.2.14-11S.i386.rpm
5c4f321a82fdbe517a504124a6b52b99 RPMS/linux-kernel-include-2.2.14-11S.i386=
.rpm
db9dde4d02b3e7f8c49ed2e003ac2bec RPMS/linux-source-alpha-2.2.14-11S.i386.r=
pm
0e25fda46af2085881085fdba0664061 RPMS/linux-source-arm-2.2.14-11S.i386.rpm
5c3c76c792108e2a50a7a13a9f450494 RPMS/linux-source-common-2.2.14-11S.i386.=
rpm
6a42f80110b86b34a74bf84b08b69d44 RPMS/linux-source-i386-2.2.14-11S.i386.rpm
abcfb03c424cbbb4584741659753f8dc RPMS/linux-source-m68k-2.2.14-11S.i386.rpm
0cf7968c5c3e518cc44caf1931c406ec RPMS/linux-source-mips-2.2.14-11S.i386.rpm
bc580c613872ce59319583f793fddb9f RPMS/linux-source-ppc-2.2.14-11S.i386.rpm
040f856963f39940b93eb15203281337 RPMS/linux-source-sparc-2.2.14-11S.i386.r=
pm
ac0c3167d324a920f2fb96c63b80a38c RPMS/linux-source-sparc64-2.2.14-11S.i386=
.rpm
3847dc7f2f8c0e38f8becedb5c252bf4 RPMS/pcmcia-cs-3.1.4-3.i386.rpm
5945740159408f1776dcb6aa2fb49b03 SRPMS/iBCS-2.1-6.src.rpm
563cf982dba25b5952040bcd47ea581b SRPMS/linux-2.2.14-11S.src.rpm
d15ab81be9d67ffec3242b4ec48e8eb9 SRPMS/pcmcia-cs-3.1.4-3.src.rpm
5.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
modprobe loop
rpm -Fvh *.i386.rpm
6. OpenLinux eDesktop 2.4
6.1 Location of Fixed Packages
The upgrade packages can be found on Caldera's FTP site at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/
The corresponding source code package can be found at:
ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS
6.2 Verification
831b263708b378875b5e70c30b2d1a81 RPMS/hwprobe-20000214-4.i386.rpm
25af31770447ac4fd18b050a0c0c3b9e RPMS/iBCS-2.1-10.i386.rpm
01a135805e279368bd829daef4a6af78 RPMS/iBCS-extras-2.1-10.i386.rpm
d4370bf7f3a68df55ff0001aea1d1f32 RPMS/iBCS-module-2.1_2.2.14-10.i386.rpm
d5fa42ab1c129f89f6aac8ab594bf7e6 RPMS/linux-kernel-binary-2.2.14-7.i386.rpm
b39cf54a0ff4a3f0de6edc02f6f15804 RPMS/linux-kernel-doc-2.2.14-7.i386.rpm
d5e005ab9e3d568d82aa002c14336fb0 RPMS/linux-kernel-include-2.2.14-7.i386.r=
pm
69d1f35ff0afe3e3f3ac33c22c6c08a9 RPMS/linux-source-alpha-2.2.14-7.i386.rpm
619af8b2535238d5b0fc01ccc1aa4b15 RPMS/linux-source-arm-2.2.14-7.i386.rpm
563a2448d1eb3a66ed744e705aede3d3 RPMS/linux-source-common-2.2.14-7.i386.rpm
065ac34ecc23b322e3481752ddeb1a29 RPMS/linux-source-i386-2.2.14-7.i386.rpm
760c2a64d58f3f44ee113ccbf7490777 RPMS/linux-source-m68k-2.2.14-7.i386.rpm
460047a1cc64a92bfafc953790388b3d RPMS/linux-source-mips-2.2.14-7.i386.rpm
596aadafa3a68461ec9957810d20629e RPMS/linux-source-ppc-2.2.14-7.i386.rpm
a5070e30981d650498ac3c5dd67b361c RPMS/linux-source-sparc-2.2.14-7.i386.rpm
2db448f5eb2e7aac48f0a9c7f07d71c6 RPMS/linux-source-sparc64-2.2.14-7.i386.r=
pm
fed0d802f6a9d8b19eeb39f13e3d9b17 RPMS/pcmcia-cs-3.1.8-3.i386.rpm
7d585fa7cc3201aa554bfba0bc923f9d SRPMS/hwprobe-20000214-4.src.rpm
7042ea57831b9e4c5649a8cd668a8624 SRPMS/iBCS-2.1-10.src.rpm
9a055948c09c36ed379de72525bf2896 SRPMS/linux-2.2.14-7.src.rpm
db43acbef146ae3be972f1515d030c82 SRPMS/pcmcia-cs-3.1.8-3.src.rpm
6.3 Installing Fixed Packages
Upgrade the affected packages with the following commands:
rpm -Fvh *.i386.rpm
7. References
This and other Caldera security resources are located at:
http://www.calderasystems.com/support/security/index.html
This security fix closes Caldera's internal Problem Report 9633.
8. Disclaimer
Caldera Systems, Inc. is not responsible for the misuse of any of the
information we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended to
promote secure installation and use of Caldera OpenLinux.
9. Acknowledgements
Caldera Systems wishes to thank Chris Evans, Solar Designer, Alan
Cox and David Miller for spotting and fixing these problems.
___________________________________________________________________________=
___
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE6yfqH18sy83A/qfwRAhVuAJ4i/QYECTWBX8Hb4PImolhojEG3zACfeIJd
iw77xxCGpFcv7KeAk2OfomM=3D
=3DFrD0
-----END PGP SIGNATURE-----
=00
