[Full-Disclosure] OpenLinux: util-linux could leak sensitive data

please_reply_to_security_at_sco.com
Date: 04/01/04

  • Next message: Bruce Martins: "[Full-Disclosure] RE: Addressing Cisco Security Issues" 
    To: security-announce@list.sco.com, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com
Date: Wed, 31 Mar 2004 15:44:30 -0800 (PST)

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    ______________________________________________________________________________

                            SCO Security Advisory

    Subject: OpenLinux: util-linux could leak sensitive data
    Advisory number: CSSA-2004-016.0
    Issue date: 2004 March 30
    Cross reference: sr889555 fz528943 erg712558 CAN-2004-0080
    ______________________________________________________________________________

    1. Problem Description

            The login program in util-linux 2.11 and earlier uses a pointer
            after it has been freed and reallocated, which could cause login
            to leak sensitive data.

            The Common Vulnerabilities and Exposures project (cve.mitre.org)
            has assigned the name CAN-2004-0080 to this issue.

    2. Vulnerable Supported Versions

            System Package
            ----------------------------------------------------------------------
            OpenLinux 3.1.1 Server prior to util-linux-2.12-1.i386.rpm
            OpenLinux 3.1.1 Workstation prior to util-linux-2.12-1.i386.rpm

    3. Solution

            The proper solution is to install the latest packages. Unix
            users with Linux Kernel Personality can use the Caldera System
            Updater, called cupdate (or kcupdate under the KDE environment),
            to update these packages rather than downloading and installing
            them by hand.

    4. OpenLinux 3.1.1 Server

            4.1 Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/RPMS

            4.2 Packages

            43420f997baa5875bba02bc8df410f88 util-linux-2.12-1.i386.rpm

            4.3 Installation

            rpm -Fvh util-linux-2.12-1.i386.rpm

            4.4 Source Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/SRPMS

            4.5 Source Packages

            7a014652e2029b4dda3209b62e1ba375 util-linux-2.12-1.src.rpm

    5. OpenLinux 3.1.1 Workstation

            5.1 Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/RPMS

            5.2 Packages

            cff227fcbc2d7e121e2134927b86a125 util-linux-2.12-1.i386.rpm

            5.3 Installation

            rpm -Fvh util-linux-2.12-1.i386.rpm

            5.4 Source Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/SRPMS

            5.5 Source Packages

            24c22395492db21fbd62d4c0419ec524 util-linux-2.12-1.src.rpm

    6. References

            Specific references for this advisory:
                    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0080

            SCO security resources:
                    http://www.sco.com/support/security/index.html

            This security fix closes SCO incidents sr889555 fz528943
            erg712558.

    7. Disclaimer

            SCO is not responsible for the misuse of any of the information
            we provide on this website and/or through our security
            advisories. Our advisories are a service to our customers intended
            to promote secure installation and use of SCO products.

    8. Acknowledgements

            SCO would like to thank Red Hat

    ______________________________________________________________________________

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

    iD8DBQFAaicYbluZssSXDTERAiYeAKCHSVw69wPHlur/nqPZsza0udGKYwCgjDSp
    qC3DOMlPqfQ9oF7NMT69ci0=
    =Mr4Z
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Bruce Martins: "[Full-Disclosure] RE: Addressing Cisco Security Issues"

    Relevant Pages