OpenLinux: slocate local user buffer overflow

please_reply_to_security_at_sco.com
Date: 02/11/04

  • Next message: Peter Pentchev: "Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption" 
    To: announce@lists.caldera.com, bugtraq@securityfocus.com, full-disclosure@lists.netsys.com, security-alerts@linuxsecurity.com
Date: Wed, 11 Feb 2004 11:21:29 -0800 (PST)

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    ______________________________________________________________________________

                            SCO Security Advisory

    Subject: OpenLinux: slocate local user buffer overflow
    Advisory number: CSSA-2004-001.0
    Issue date: 2004 February 10
    Cross reference: sr886033 fz528414 erg712456
    ______________________________________________________________________________

    1. Problem Description

            Heap-based buffer overflow in main.c of slocate 2.6, and possibly
            other versions, may allow local users to gain privileges via a
            modified slocate database that causes a negative "pathlen" value
            to be used. The Common Vulnerabilities and Exposures project
            (cve.mitre.org) has assigned the name CAN-2003-0848 to this issue.

    2. Vulnerable Supported Versions

            System Package
            ----------------------------------------------------------------------
            OpenLinux 3.1.1 Server prior to slocate-2.7-1.i386.rpm
            OpenLinux 3.1.1 Workstation prior to slocate-2.7-1.i386.rpm

    3. Solution

            The proper solution is to install the latest packages. Many
            customers find it easier to use the Caldera System Updater, called
            cupdate (or kcupdate under the KDE environment), to update these
            packages rather than downloading and installing them by hand.

    4. OpenLinux 3.1.1 Server

            4.1 Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/RPMS

            4.2 Packages

            fd4e0b81e27fd236fcf0e34c28dcca2c slocate-2.7-1.i386.rpm

            4.3 Installation

            rpm -Fvh slocate-2.7-1.i386.rpm

            4.4 Source Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/SRPMS

            4.5 Source Packages

            3a2adce6e30bdcba92fe6a7f70216461 slocate-2.7-1.src.rpm

    5. OpenLinux 3.1.1 Workstation

            5.1 Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/RPMS

            5.2 Packages

            44f7234c2a58efada5512157bc421d78 slocate-2.7-1.i386.rpm

            5.3 Installation

            rpm -Fvh slocate-2.7-1.i386.rpm

            5.4 Source Package Location

            ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/SRPMS

            5.5 Source Packages

            e2f70c80ae832d1267ce22e62ea90d15 slocate-2.7-1.src.rpm

    6. References

            Specific references for this advisory:
                    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848
                    http://marc.theaimsgroup.com/?l=bugtraq&m=106546447321274&w=2
                    http://marc.theaimsgroup.com/?l=bugtraq&m=106589631819348&w=2
                    http://www.ebitech.sk/patrik/SA/SA-20031006.txt
                    http://www.ebitech.sk/patrik/SA/SA-20031006-A.txt

            SCO security resources:
                    http://www.sco.com/support/security/index.html

            This security fix closes SCO incidents sr886033 fz528414
            erg712456.

    7. Disclaimer

            SCO is not responsible for the misuse of any of the information
            we provide on this website and/or through our security
            advisories. Our advisories are a service to our customers intended
            to promote secure installation and use of SCO products.

    8. Acknowledgements

            SCO would like to thank Patrik Hornik

    ______________________________________________________________________________

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

    iD8DBQFAKY0fbluZssSXDTERAu6rAKC+SIPACchxNJ579hYlNnXz9jEOQwCg5w+c
    DU21bhDCYBuhyJTHWipdffw=
    =vPHf
    -----END PGP SIGNATURE-----

  • Next message: Peter Pentchev: "Re: EEYE: Microsoft ASN.1 Library Length Overflow Heap Corruption"
    • Quantcast