SuSE Security Announcement: xf86 (SuSE-SA:2002:032)
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: xf86
Announcement-ID: SuSE-SA:2002:032
Date: Wed Sep 18 12:00:00 MEST 2002
Affecte products: SuSE Linux 8.0
Vulnerability Type: local privilege escalation
Severity (1-10): 5
SuSE default package: yes
Cross References: http://www.xfree.org/security
Content of this advisory:
1) security vulnerability resolved: LD_PRELOAD vulnerability in the X11
library
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- Perl 5.6.1 glob overflow fix
- new OpenSSH packages
- sparc info
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The xf86 package contains various libraries and programs which are
fundamental for the X server to function.
The libX11.so library from this package dynamically loads other libraries
where the pathname is controlled by the user invoking the program linked
against libX11.so. Unfortunately, libX11.so also behaves the same way when
linked against setuid programs. This behavior allows local users to
execute arbitrary code under a different UID which can be the root-UID in
the worst case.
libX11.so has been fixed to check for calls from setuid programs. It
denies loading of user controlled libraries in this case.
We recommend an update in any case since there is no easy workaround
possible except removing the setuid bit from any program linked against
libX11.so.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
i386 Intel Platform:
SuSE-8.0
ftp://ftp.suse.com/pub/suse/i386/update/8.0/x1/xshared-4.2.0-174.i386.rpm
2a515055a811de5b465d016ffa77a09c
ftp://ftp.suse.com/pub/suse/i386/update/8.0/x2/xdevel-4.2.0-174.i386.rpm
67ddeb24b04b8c2badb7a039d9ea270e
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/xf86-4.2.0-174.src.rpm
e44b3f6dd4a406bd422adc4f7fac63f2
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- perl
New Perl 5.6.1 packages will soon be available which fix overflows
in the globbing code of the Perl interpreter. Although we believe
that there is not much impact by this bug, we recommend an update
especially on systems offering remote services based on Perl.
- openssh
New openssh packages are available for the SuSE Linux distributions
7.0 - 7.3 (version 2.9.9p2). These packages have been rebuilt to
contain the fixes in the openssl library, which is used by openssh.
It is possible but not proven that the weaknesses in the openssl code
(fixed and announced by SuSE-SA:2002:027) can be exploited in any way.
We release the packages to prevent the possibility that the
vulnerability exists. It is recommended to install the updates.
- sparc
Due to a lack of build power on the sparc architecture, we will
discontinue providing security updates for the SuSE Linux 7.0 and 7.1
distributions for sparc. We estimate that more than 95% of all SuSE
Linux for sparc users use the most recent version 7.3 so that the loss
should be considerably small.
In addition to the update directories on ftp.suse.com, we will also
move the directories containing the distributions themselves into the
discontinued/ tree on ftp.suse.com/pub/suse/discontinued/. By
consequence, all updates will continue to be available, but the path
indicates that these directories and files will remain there for
archiving purposes only.
Please note that mirrors of the SuSE ftp server ftp.suse.com might not
contain the discontinued/ directory tree.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
On Wed, Sep 18, 2002 at 12:57:19PM +0200, Sebastian Krahmer wrote:
1) security vulnerability resolved: LD_PRELOAD vulnerability in the X11 library
Please download the update package for your distribution
i386 Intel Platform:
SuSE-8.0
What's about other platforms and other distributions (e.g. SuSE 7.3)? Thanks and bye, Hatto v. Hatzfeld
* Hatto von Hatzfeld (hatto@salesianer.de) [020918 05:21]: :: ::What's about other platforms and other distributions (e.g. SuSE 7.3)? :: Yes, I would agree with this quite a lot. I know it's a common belief at SuSE that 7.3 and 7.2 users haven't/won't upgrade to 4.2.0 and this is the reason AA fonts and Icon smoothing have been disabled in QT..but this is just silly. There are lots of us who DO run XF4.2.0 and would like at least to have security fixes if not REAL QT/KDE3 packages with EVERYTHING enabled that's suppose to be enabled. How's about this ..why not release XFree86 4.2.1 pkgs for 7.2, 7.3 and 8.0 since it was released about 2 weeks ago and the major fixes are security related. That would be just dandy. ;) -- Ben Rosenberg ---===---===---===--- mailto:ben@whack.org Tell me what you believe.. I tell you what you should see.
participants (3)
-
Ben Rosenberg
-
Hatto von Hatzfeld
-
Sebastian Krahmer