openSUSE Security Announce
Threads by month
- ----- 2024 -----
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2003 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2002 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2001 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2000 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 1999 -----
- December
- November
- October
- September
- August
- 2 participants
- 9927 discussions
Hi,
I resend advisory SuSE-SA:2001:06, because of a wrong signature.
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: pop
Announcement-ID: SuSE-SA:2001:06
Date: Wednesday, March 21th, 2001 19.19 MEST
Affected SuSE versions: 6.1
Vulnerability Type: remote command execution
Severity (1-10): 2
SuSE default package: no
Other affected systems: all system using the pop package
Content of this advisory:
1) security vulnerability resolved: imapd, ipop2d, ipop3d
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The eMail access daemons imapd(8), ipop2d(8) and ipop3d(8) of SuSE 6.1
are vulnerable to several buffer overflows. Due to a misconfiguration
these vulnerbilities could be triggered remotely after a user had been
authenticated.
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> i386 Intel Platform:
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm
1277deee87f3d1553ee18ae078d646aa
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm
ce326335b36e51b6a635b69fc0106911
<p><p> AXP Alpha Platform:
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm
33405d29e279795d99853a1235a821f9
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm
eecd7c9ac81397f9eb7b2bee01a0154d
<p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- joe (configuration file vulnerability): The problem has been reported
on multiple security-related mailing lists. We are about to provide
fixed packages.
- The game spaceboom (SVGA shoot'em up) has been found vulnerable to
multiple vulnerabilities. As a reaction to these bugs, the spaceboom
game has been dropped from the distribution. We recommend to deinstall
the game from our 6.x and 7.x distribution by using the command
`rpm -e spaceŽ, or to remove the suid bit from the file
/usr/games/SpaceBoom/SpaceBoom using the command
`chmod -s /usr/games/SpaceBoom/SpaceBoomŽ.
(Note: removing the suid bit prevents the game from being used by
non-root users and from being reinstalled after removal.)
- We are in the process of preparing update packages for the man package
which has been found vulnerable to a commandline format string bug.
The man command is installed suid man on SuSE systems. When exploited,
the bug can be used to install a different man binary to introduce a
trojan into the system. As an interim workaround, we recommend to
`chmod -s /usr/bin/manŽ and ignore the warnings and errors when
viewing manpages.
- The file browser MidnightCommander (mc) is vulnerable to unwanted
program execution. Updates are currently being built.
- A new nkitb/nkitserv package will be availabe soon. This update adresses
bugs in timed, in.ftpd.
- New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1
are currently being built.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
<p>-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOrpWCXey5gA9JdPZAQEyxwf+PEmG3VQd59s4IEkNpStXAH6cRqEIAIkh
rKXcrukIiBWdj08uNLoiggEgzq7wyUKBQH3thCD3CkolpPM4ViZmiVLAr8uerTmx
fP4Vd+m47VeYzcsdhRPPASpnVzgVHyLVxCiOKOM76QK1sOHZhf2jAzQEZbl9G1Mc
Z2Jo+4tAtFUPxsp0IN9NmfDezGOLeuXH5eIyp+Sgpw1fMa6Mkpk+Eib6Dc0qnM4H
JBqj1WBw539lD2wU8n4N4mM0YdUhzCx179vVJKf9C9XLPdFHUwuyDRR75M/lOH8U
dC5eg3QVdDm4bUDxMyDbvJqfxFpzlRt6dsb/vDk7Q6Hepat3plXhdQ==
=klWl
-----END PGP SIGNATURE-----
Bye,
Thomas
--
Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg
E@mail: thomas(a)suse.de Function: Security Support & Auditing
"lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka"
Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: nkitb/nkitserv
Announcement-ID: SuSE-SA:2001:07
Date: Thursday, March 22th, 2001 19.06 MEST
Affected SuSE versions: 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
Vulnerability Type: remote denial-of-service
Severity (1-10): 4
SuSE default package: yes: in.ftpd, no: timed
Other affected systems: all system using in.ftpd (OpenBSD port) or timed
Content of this advisory:
1) security vulnerability resolved: timed, in.ftpd
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
Two parts of the nkitb/nkitserv package are vulnerable to security related
bugs.
in.ftpd(8):
A one-byte bufferoverflow was discovered in the OpenBSD port of the
FTP daemon in.ftpd(8) several weeks ago.
This bug could just be triggered by authenticated users, which have write
access. This bug is believed to not be exploitable under Linux. However,
we prefer to provide a fixed update package to make sure that the daemon
is on the safe side.
in.ftpd(8) will be invoked by inetd(8) and is activated by default.
timed(8):
The time server daemon timed(8), which is started at boot time, tries to
synchronize the local host time with the time of other machines on the
local area network.
A bug in timed(8) was reported by the FreeBSD Security Officer, that could
be triggered remotely to crash the time server daemon.
For SuSE 6.1-6.4 in.ftpd and timed were part of nkitb.
Users of SuSE 7.0 need to download the nkitserv package for both in.ftpd
and timed.
The bug in in.ftpd is fixed in SuSE 7.1, so nkitserv for SuSE 7.1 just
includes a new version of timed(8).
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p><p> i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/nkitserv-2001.3.16-0.i386.rpm
c4313f92a36916f0eba0b8837c9c0c81
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/nkitb-2001.3.16-1.src.rpm
ec452523fa25c8aed962fbd3349d1f3d
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/nkitserv-2001.3.16-0.i386.rpm
02772824805c6c4293bd1750d7bda6d3
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm
5d301edc1b1ec9111572815aace33984
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2001.3.16-1.i386.rpm
842dea179cc449c4af25accf0c3f38ec
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2001.3.16-1.src.rpm
c099e7c1194b7706100453a89433b59c
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/nkitb-2001.3.16-0.i386.rpm
768a636df4731cd8efd181aa2eaf2e60
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm
b705425c4c3cb70ebf9cd1345c92104a
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/nkitb-2001.3.16-0.i386.rpm
cbae31148c79c91a1443f79ee1ba34d3
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkitb-2001.3.16-0.src.rpm
d287c01d35d00756ecbf8da04556037c
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/nkitb-2001.3.16-0.i386.rpm
5f45ade69a9e8c2756e671c4a6e3522a
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm
62b969c4e666f3ea71b6ce6b31762718
<p><p> Sparc Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/sparc/update/7.1/n1/nkitserv-2001.3.16-0.sparc.…
142329dcae76a1603c0d84836192e357
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm
5bd9123cecba6ddd42cc965c599f383e
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/nkitserv-2001.3.16-0.sparc.…
07ed33c76c7ae2df5b877003b254944d
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm
66ba7b71624f636e24e2d628c8f06e81
<p><p> AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/nkitserv-2001.3.16-0.alpha.rpm
5fcf177588788eb069bdb69332046d23
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/nkitb-2001.3.16-0.src.rpm
c27ed3bf0c293eaa77fe5a8fa960e95d
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2001.3.16-0.alpha.rpm
385fa60c0c216f1d9e61afd52d37df93
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm
5ba60084740c9be9f89a729e2d21a77c
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/nkitb-2001.3.16-0.alpha.rpm
8a9e207a77e3c7f954e8faa91954f7aa
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkitb-2001.3.16-0.src.rpm
53f8a03feacc7fb81b92a726c8e81d21
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/nkitb-2001.3.16-0.alpha.rpm
359a3432f73220cecd42ba0b365d5e06
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/nkitb-2001.3.16-0.src.rpm
e0ccf6395312f9c33518f5f083c9d51f
<p><p> PPC PowerPC Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/nkitserv-2001.3.16-0.ppc.rpm
37bf5a963bc93215084b5634e864479c
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/zq1/nkitb-2001.3.16-0.src.rpm
c31af637f58d9b43db542657b02bc772
<p> SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/nkitserv-2001.3.16-1.ppc.rpm
ddc1dcfb94ba90f3cbdf395f89dd3b84
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2001.3.16-1.src.rpm
2fa9c58b871248172285a64107e3be7c
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2001.3.16-0.ppc.rpm
1dc4c831b5f6bd344ab8f511497b3fa5
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2001.3.16-0.src.rpm
5529e5f63e2391ab1669efa0a8c33b57
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- joe (configuration file vulnerability): The problem has been reported
on multiple security-related mailing lists. We are about to provide
fixed packages.
- The game spaceboom (SVGA shoot'em up) has been found vulnerable to
multiple vulnerabilities. As a reaction to these bugs, the spaceboom
game has been dropped from the distribution. We recommend to deinstall
the game from our 6.x and 7.x distribution by using the command
`rpm -e spaceŽ, or to remove the suid bit from the file
/usr/games/SpaceBoom/SpaceBoom using the command
`chmod -s /usr/games/SpaceBoom/SpaceBoomŽ.
(Note: removing the suid bit prevents the game from being used by
non-root users and from being reinstalled after removal.)
- We are in the process of preparing update packages for the man package
which has been found vulnerable to a commandline format string bug.
The man command is installed suid man on SuSE systems. When exploited,
the bug can be used to install a different man binary to introduce a
trojan into the system. As an interim workaround, we recommend to
`chmod -s /usr/bin/manŽ and ignore the warnings and errors when
viewing manpages.
- The file browser MidnightCommander (mc) is vulnerable to unwanted
program execution. Updates are currently being built.
- New RPMs, that fix' a vulnerbility in the eperl package for SuSE 6.1-7.1
are currently being built.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
<p>-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOrpHQ3ey5gA9JdPZAQEWXwf/TwIX3tVUM4l32z6efEOdiLPNe0FmdImz
kgFkyWX+aDSLIVvhoqjpfr7DjD0p2Run9d1BjdLoTGqUgFZf+WR5yZWUbR94+5wN
ahaoKWHMGGxHxynrbr+YnlOFyKH1Zv3HqFbsY/KTrVSsWCsbqsqs1wd8ePVG/El9
oODwYHDBlMHGu+tXRqXAMhxGgrlMw5Id2fQEXVXvQu6/OJjqjzeRDHCA05vw/lZK
hK0vAPbU3UKHkgbHLmA1kKyqMIYJZcSWDngv6IOWrS/5MyoswL8sWcda+7Z3omyL
885DLHrszKcnH2mYzVeVV/ZYE2u711dhVRn+FEHIxukNty0un6rLaQ==
=aQ3n
-----END PGP SIGNATURE-----
Bye,
Thomas
--
Thomas Biege, SuSE GmbH, Schanzaeckerstr. 10, 90443 Nuernberg
E@mail: thomas(a)suse.de Function: Security Support & Auditing
"lynx -source http://www.suse.de/~thomas/thomas.pgp | pgp -fka"
Key fingerprint = 09 48 F2 FD 81 F7 E7 98 6D C7 36 F1 96 6A 12 47
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: pop
Announcement-ID: SuSE-SA:2001:06
Date: Wednesday, March 21th, 2001 19.19 MEST
Affected SuSE versions: 6.1
Vulnerability Type: remote command execution
Severity (1-10): 2
SuSE default package: no
Other affected systems: all system using the pop package
Content of this advisory:
1) security vulnerability resolved: omap, ipop2d, ipop3d
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The eMail access daemons impad(8), ipop2d(8) and ipop3d(8) of SuSE 6.1
are vulnerable to several buffer overflows. Due to a misconfiguration
these vulnerbilities could be triggered remotely after a user had been
authenticated.
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> i386 Intel Platform:
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/pop-2001.3.21-0.i386.rpm
1277deee87f3d1553ee18ae078d646aa
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/pop-2001.3.21-0.src.rpm
ce326335b36e51b6a635b69fc0106911
<p><p> AXP Alpha Platform:
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/pop-2001.3.21-0.alpha.rpm
33405d29e279795d99853a1235a821f9
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/pop-2001.3.21-0.src.rpm
eecd7c9ac81397f9eb7b2bee01a0154d
<p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- joe (configuration file vulnerability): The problem has been reported
on multiple security-related mailing lists. We are about to provide
fixed packages.
- The game spaceboom (SVGA shoot'em up) has been found vulnerable to
multiple vulnerabilities. As a reaction to these bugs, the spaceboom
game has been dropped from the distribution. We recommend to deinstall
the game from our 6.x and 7.x distribution by using the command
`rpm -e spaceŽ, or to remove the suid bit from the file
/usr/games/SpaceBoom/SpaceBoom using the command
`chmod -s /usr/games/SpaceBoom/SpaceBoomŽ.
(Note: removing the suid bit prevents the game from being used by
non-root users and from being reinstalled after removal.)
- We are in the process of preparing update packages for the man package
which has been found vulnerable to a commandline format string bug.
The man command is installed suid man on SuSE systems. When exploited,
the bug can be used to install a different man binary to introduce a
trojan into the system. As an interim workaround, we recommend to
`chmod -s /usr/bin/manŽ and ignore the warnings and errors when
viewing manpages.
- The file browser MidnightCommander (mc) is vulnerable to unwanted
program execution. Updates are currently being built.
- A new nkitb/nkitserv package will be availabe soon. This update adresses
bugs in timed, in.ftpd (and rwhod).
- A vulnerbility, that exists in the eperl package for SuSE 6.1-7.1 are
currently being built.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
<p>-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOronNHey5gA9JdPZAQHNtwf+JRiIV2do5UeA7+YG3hc0f+RVP3ZAHqM9
u7Pb/2oK9yb6AQrrc2PSJeY1WKMqYGDGAs1RtMuRYykgFux3vFnVsmmZ6/BUKKwz
Ziz8uMe6BwUt3BZZiYwQQTLxEPBTJXxQpY6nF4rNhzVsecUCXM6LFBggkyV9Yd05
Vk3D+bvkkLHlJss5CFG3CITxJGi54MfqIyxab0aapu+723sxRu07MLXsmi1p3lL9
HJpVDr7OM07Sc2Sla3jjq+BiZk8R9SoZUzezn8imSmzXtKpCqZdxdv322weju7Gr
LXQuC0QfnX/Du0w0Ko3ayZK0VXe+8VDdg3DA2UUZdOmBkBPTeqUDVg==
=nRUf
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: cups
Announcement-ID: SuSE-SA:2001:05
Date: Monday, March 5th, 2001 13:10:13 MET
Affected SuSE versions: 7.1
Vulnerability Type: local/remote root compromise
Severity (1-10): 5
SuSE default package: no
Other affected systems: All UN*X-systems using cups < 1.1.6.
Content of this advisory:
1) security vulnerability resolved: cups
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
<p> CUPS is an implementation of the Internet Printing Protocol (IPP) and
is used as an alternative to the lpr and LPRng packages.
The CUPS package aims to be a comprehensive printing solution for
UN*X-systems. In SuSE-7.1 distribution, the cups package is not used by
any configuration utilities unless the admin has decided to configure
the package manually.
The cups package has been introduced in the SuSE-7.1 distribution;
enhanced support for future releases of the SuSE Linux distribution is
planned.
A SuSE-internal security audit conducted by Sebastian Krahmer and Thomas
Biege revealed several overflows as well as insecure file handling.
These bugs have been fixed by adding length-checks and securing the
file-access.
For a temporary workaround, remove the suid-bit from the 'lppasswd'
program.
Make sure nobody from outside your network can access the CUPS-server
running on port 631. Allowing access to this port from outside is a
bad idea regardless whether or not the used version is vulnerable.
No remote-exploits are known yet.
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/d3/cups-devel-1.1.6-13.i386.rpm
23c6484952ab0c1de81e2db38bcd3afc
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/cups-1.1.6-13.i386.rpm
812e0c47dcfe508eb9e8ccb38165b6d7
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/cups-1.1.6-13.src.rpm
204cea2ad6a61293c191e70a2cacdc82
<p><p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
<p> Effective Monday, March 19 2001, five weeks after the release of the new
SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux
distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2.
SuSE puts much effort into adding security improvements (patches) to the
software instead of publishing a new version; the same program with a fix
for a specific problem promises to work just as reliable as the original
version from the distribution, whereas new versions introduce new
functionality which changes the behaviour.
In some cases however, especially if the security leak is based on
problematic design decisions or when the fix(es) are fairly large, the
only reasonable fix for a security problem is to update to a newer version
of the software. These newer versions tend to become incompatible with our
older distribution releases because of missing features in the operating
system environment. This forces us to focus on the distributions of a
newer release date.
The remaining distributions
SuSE-6.3,
SuSE-6.4,
SuSE-7.0 and
SuSE-7.1
for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms
will continue to be supported for a two-year period after the release of
the respective distribution.
<p>______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
Regards,
Sebastian Krahmer
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
<p><p>-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOqODeXey5gA9JdPZAQHRYQf/aNhY+lHrkpmWlxGtQI29qetDlIuqVbvQ
jUb4jm6vMvYJrFwzhtZ9XpWWYECDiqQjhy9KwmkkaVBrDTtbboNuQ+Wqq93zLzTD
t1uXxGqb3p847p3OtoxZXR9ZUxxB+tn6MS2CGUZVDA+TaYgUD9DW1eb9+z0t5ehN
2cdYZqvAp22BasIdXGlFSvCJ4oBqXT9HmqBk8Q+FS7ZzT0VKvOmXShqv5bWOPRj+
XwuuiPdPGc9Ykwp8lcoymU2Y8b62MASEVYsFT4rynMxrDSfNUaEPXTAhc2RPM9vn
+BgXrT0rfUiPkRWQTNpokp93TO3v8cOFgw0keeLcYRbP1nk36Ng03w==
=BWbh
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
Effective Monday, March 19 2001, five weeks after the release of the new
SuSE-7.1 distribution, SuSE will discontinue support for the SuSE-linux
distributions SuSE-6.0 SuSE-6.1 and SuSE-6.2.
SuSE puts much effort into adding security improvements (patches) to the
software instead of publishing a new version; the same program with a fix
for a specific problem promises to work just as reliable as the original
version from the distribution, whereas new versions introduce new
functionality which changes the behaviour.
In some cases however, especially if the security leak is based on
problematic design decisions or when the fix(es) are fairly large, the
only reasonable fix for a security problem is to update to a newer version
of the software. These newer versions tend to become incompatible with our
older distribution releases because of missing features in the operating
system environment. This forces us to focus on the distributions of a
newer release date.
The remaining distributions
SuSE-6.3,
SuSE-6.4,
SuSE-7.0 and
SuSE-7.1
for the Intel i386, AXP Alpha, SPARC as well as PPC Power PC platforms
will continue to be supported for a two-year period after the release of
the respective distribution.
Regards,
SuSE Security.
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOpZPwXey5gA9JdPZAQENnQf+NMuY2HQv85EWBujG3/40fktZTEKs+DDi
Wkh2M+t8L40UaVZQn52P3UdaWi4KV3WbK0/GK6V3t4xyc8arrrOu+eR3Ipty37Wc
GAcXG4Yk1xdIGmI0oUKj0tg1Dy7H7qPHvD+Gt4pLsgy8HPmr3I+Cnzw1fFDpTpt3
4hW0iAOPkHJR3tOJKgEgy3lnckPNQCYG3SyQUU9FR8sTa0/CSkEq+biXb4jPPWYm
bQmOZ4oXzy8CM9r5NzqYy+wmI4J0EP9kwDF8Nxgeq7yLKKELCfAUoj8DMy5Zs0PE
Gx8sO7tw3hIGy+ppBSjS9Vc+b/9HlWPFmQrmSWdehw1dOhM+i0gLlA==
=ms46
-----END PGP SIGNATURE-----
1
0
<p>The announcement is being resent because of a small error in the
"Affected SuSE versions" section: SuSE-7.1 is vulnerable, too.
<p>-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: ssh
Announcement-ID: SuSE-SA:2001:04
Date: Friday, February 16th, 2000 18:00 MET
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
Vulnerability Type: possible remote root compromise
Severity (1-10): 9
SuSE default package: yes, no (openssh is default after SuSE-6.3)
Other affected systems: Unix systems with sshd running
Content of this advisory:
1) security vulnerability resolved: ssh
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
SuSE distributions contain the ssh package in the version 1.2.27. No
later version is provided because of licensing issues. SuSE maintains
the 1.2.27 version in a patched package. Three new patches have been added
that workaround three independent security problems in the ssh package:
a) SSHD-1 Logging Vulnerability (discovered and published by Jose Nazario,
Crimelabs). Attackers can remotely brute-force passwords without
getting noticed or logged. In the ssh package from the SuSE
distribution, root login is allowed, as well as password
authentication. Even though brute-forcing a password may take an
enormous amount of time and resources, the issue is to be taken
seriously.
b) SSH1 session key recovery vulnerability (by (Ariel Waissbein, Agustin
Azubel) - CORE SDI, Argentina, and David Bleichenbacher). Captured
encrypted ssh traffic can be decrypted with some effort by obtaining
the session key for the ssh session. The added patch in our package
causes the ssh daemon to generate a new server key pair upon failure
of an RSA operation (please note that the patch supplied with Iván
Arce on bugtraq on Wed, 7 Feb 2001 has been corrected later on!).
c) In 1998, the ssh-1 protocol was found to be vulnerable to an
attack where arbitrary sequences could be inserted into the ssh-1
protocol layer. The attack was called "crc32 compensation attack", and
a fix was introduced (crc compensation attack detector in the ssh -v
output) into the later versions of ssh. Michal Zalewski discovered
that the fix in its most widely used implementation is defective. An
integer overflow allows an attacker to overwrite arbitrary memory in
the sshd process' address space, which potentionally results in a
remote root compromise.
There are easy resorts that can be offered:
a) switch to openssh (please use the openssh packages on ftp.suse.com from
the same update directories as the ssh package update URLs below indicate).
openssh is a different implementation of the ssh protocol that is
compatible to the protocol versions 1 and 2.
Openssh Version 2.3.0 does not suffer from the problems listed above.
Versions before 2.3.0 are vulnerable to other problems, so please
use the updates from the update directory on the ftp.suse.de ftp server.
See section 2) of this announcement for the md5sums of the packages.
b) upgrade your ssh package from the locations described below.
<p> Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> SPECIAL INSTALL INSTRUCTIONS:
==============================
If you run a sshd (secure shell daemon) server on your system, then the
daemon process must be restarted for the update package to become active
after installation of the update rpm.
You can do this easily with the command (ran as root):
kill -15 `cat /var/run/sshd.pid`
After this, you can start the daemon using the command
rcsshd start
It should be possible now to log on again to your server as usual. Please
consult the syslogs in /var/log if this is not the case.
Warning: killing all instances of sshd on a system might render the system
inaccessible from remote, especially if secure shell is your only
method to access the system. Be careful to not lock yourself out.
<p> Note: The packages on our German ftp server have been built again to
correct one of the patches. The package for the 6.1-i386 distribution
has finished building a few minutes ago and uses the same name as the
build from Wednesday. Use the --force commandline option for the rpm
command if you have used the package that was published before the
release date of this announcement.
<p> i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.de/pub/suse/i386/update/7.1/sec2/ssh-1.2.27-226.i386.rpm
ae68bf3ac28b5e81f9c5f2a1d1d8980e
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/7.1/zq1/ssh-1.2.27-226.src.rpm
d332e662daff71ff7d10cf4d962b6933
SuSE-7.0
ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/ssh-1.2.27-220.i386.rpm
f88b339dea96ef186e70872ce9444c24
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/ssh-1.2.27-220.src.rpm
93ca5fc96c103a5f9adee16cb319195c
SuSE-6.4
ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/ssh-1.2.27-86.i386.rpm
3f1b41116b7c7d63c791de4fdca9d1ee
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/ssh-1.2.27-86.src.rpm
3a8d859f2ae9751852339c642b07b4cf
SuSE-6.3
ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/ssh-1.2.27-86.i386.rpm
3f1b41116b7c7d63c791de4fdca9d1ee
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/ssh-1.2.27-86.src.rpm
3a8d859f2ae9751852339c642b07b4cf
SuSE-6.2
ftp://ftp.suse.de/pub/suse/i386/update/6.2/sec1/ssh-1.2.27-210.i386.rpm
b29822198dc6430167465706965e3499
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.2/zq1/ssh-1.2.27-210.src.rpm
4a2130635f702bb266748b9e4838877a
SuSE-6.1
ftp://ftp.suse.de/pub/suse/i386/update/6.1/sec1/ssh-1.2.27-210.i386.rpm
17f281262edd689d9861c099489cbcc6
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.1/zq1/ssh-1.2.27-210.src.rpm
5e12e0086f61bba2f37c4ccbc4282a92
<p><p> Sparc Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/ssh-1.2.27-221.sparc.rpm
e1545287f954d089707c55a66598c318
source rpm:
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/ssh-1.2.27-221.src.rpm
f37a8b3addaf70711d91f6a3f788a8b3
<p><p> AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/ssh-1.2.27-221.alpha.rpm
77bd0dcda5df929fba07d56de2bf3399
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/ssh-1.2.27-221.src.rpm
77305ae844c9b68e8af559ccf81417e8
SuSE-6.4
ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/ssh-1.2.27-86.alpha.rpm
7a8d7086c8b99822b020f3c9d0e4764e
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/ssh-1.2.27-86.src.rpm
e75660e54edc2cf38086b4de3da91881
SuSE-6.3
ftp://ftp.suse.de/pub/suse/axp/update/6.3/sec1/ssh-1.2.27-212.alpha.rpm
671761326c11c9eac50c3d992b550bdf
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/6.3/zq1/ssh-1.2.27-212.src.rpm
5472b658aac01bea8667769a04e0e92d
<p><p> PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/ssh-1.2.27-220.ppc.rpm
ec7274c8a88b6ce5420c91da0622f94c
source rpm:
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/ssh-1.2.27-220.src.rpm
1ae9f7cf4c7099f5cad8cb0ccc8f3e5d
SuSE-6.4
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/ssh-1.2.27-86.ppc.rpm
fc3cb2e3b927c7ffc5e8374e183f860e
source rpm:
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/ssh-1.2.27-86.src.rpm
439abdfb6f56e2c0d3880cddd103935f
<p><p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- The openssh package URLs and md5sums:
ftp://ftp.suse.de/pub/suse/i386/update/7.1/sec1/openssh-2.3.0p1-5.i386.rpm 3687c385e3e8f6e845c17518c12dd61b
ftp://ftp.suse.de/pub/suse/i386/update/7.1/zq1/openssh-2.3.0p1-5.src.rpm 3cf3a1f652d92d66e70bfc9c40c0eb38
ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-2.3.0p1-0.i386.rpm ce12abcff3dec118ceabe62e6cd1e090
ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 3a7cf864f695a9f3ec2dd0bf6cc7e161
ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/openssh-2.3.0p1-0.i386.rpm 3219bf7853c2c27056ec502b5fd3345c
ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 82a18d49a9a98942417258ffcd7a4800
ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/openssh-2.3.0p1-0.i386.rpm 3219bf7853c2c27056ec502b5fd3345c
ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/openssh-2.3.0p1-0.src.rpm 82a18d49a9a98942417258ffcd7a4800
ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-2.3.0p1-0.alpha.rpm b924315c09cb990009b24d3c1093e142
ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 6339a4f2a4982ba2e6b943a182d02420
ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/openssh-2.3.0p1-0.alpha.rpm 61da28e2695d8f4a4b1c6300d867e6b6
ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 9e8e5af8b890f2a18e244da1c94be796
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-2.3.0p1-0.ppc.rpm 72f7c339991e54a476585012423dda62
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 749ccc55396944ad43c1977e55903958
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/openssh-2.3.0p1-0.ppc.rpm e08ec87634dfd0dd76d18886d04ebd4b
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 95820e1934a5586c8d73719957972d7c
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm 8ed7a34fec7bcc6c658809effe20fd82
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm c551925107c7000fa32556dbe4a4fad4
<p> - Linux kernel upgrade.
Several security flaws have been found in the linux-2.2.x kernel versions.
The only suitable workaround is to upgrade to a newer kernel version.
SuSE provides kernels that have been expanded with several dozen device
drivers that are not included in the standard main stream kernel.
While working on the kernel update packages for our distributions, more
security problems were discovered. Currently, several persons audit code
in the kernel, so that more problems are expected to be discovered in the
very near future.
Since kernel updates are very time-consuming on behalf of the system
administrator, we decided to not publish a new kernel package
each week. Instead, the new kernel packages with all known security bugs
fixed will be published by the midth/end of next week.
In the meanwhile, administrators who require immediate updates, please go
to ftp.kernel.org (or one of its mirrors, respectively) and get Alan Cox'
prepatches for the 2.2.19 version of the Linux kernel. The directory
usually is /pub/linux/kernel/people/alan/2.2.19pre, his latest patch is
pre-patch-2.2.19-13.gz. This patch fixes all currently publically known
security problems in the Linux v2.2 kernel. For those who are not
experienced in patching and installing kernels, we recommend to wait
for the release of the SuSE Linux kernel update packages.
<p> - From SuSE-SA:2001:03 (bind8): The sparc update packages were pending
because of build bottlenecks. The URLs to the update packages and the
md5sums are as follows:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/bind8-8.2.3-39.sparc.rpm
c7e2a95bd4b90d03207ffc3a9880c36c
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
5d4d4b608f2a8a3e61f7dc6917254f4f
<p><p> - bind: The bind package version 4.x has been found vulnerable to multiple
security problems that were discussed and published in public security
forums. See http://www.securityfocus.com/templates/advisory.html?id=3051
for more information. SuSE provides update packages for the bind nameserver
in version 4 for all distributions and architectures.
We also hereby announce that the bind package (bind-4.x; the bind
nameserver in version 8 is contained in the bind8 package) will be
discontinued in future versions of the SuSE Linux Distribution. We
recommend to migrate to bind in the 8.x or 9.x series.
There will be a seperate security announcement for the bind (4.x) package
by Monday, February 19th 2001. In the meanwhile, get the md5sums from the
URL ftp://ftp.suse.de/private/draht/bind4-checksums . It is signed.
- More announcements are following this one. (mysql, tmpfile races, ...)
Please read (this) section 2) in the announcements carefully.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOo1lWney5gA9JdPZAQF6hAf+Ln99M4IVo1YwU5sM+Xf4RQIJ2lXyzG20
MgtJcB2cy+N9zGwd7nPN177AAXZvThArvYjww8Tf+Rpqwl+/oVXvLxtJY5SwW4tj
yc7EbZ6OAuoUF7tdx5QRemnnxG1Kck4zOzqa7pb/aWyxBYv65bKF0/Sm4ugMk0E5
E/7xX9FCbcs0Fld4GEuDNbpK5YCOI886JpUJ59AsJ9H/oa2LJ21esb0qPSrysSE9
ZGsA/HwqB0XQ1UhUukG5NPaxdynCDk/drJJVJKDd8Of2ctqoARAyCYU8PUAtNsLz
eRAOdhrcD++LOQYNcsmLFmMyUb0lnDA8eXuCkRO+B105oHMzV6/dkQ==
=KRzP
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: ssh
Announcement-ID: SuSE-SA:2001:04
Date: Friday, February 16th, 2000 18:00 MET
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
Vulnerability Type: possible remote root compromise
Severity (1-10): 9
SuSE default package: yes, no (openssh is default after SuSE-6.3)
Other affected systems: Unix systems with sshd running
Content of this advisory:
1) security vulnerability resolved: ssh
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
SuSE distributions contain the ssh package in the version 1.2.27. No
later version is provided because of licensing issues. SuSE maintains
the 1.2.27 version in a patched package. Three new patches have been added
that workaround three independent security problems in the ssh package:
a) SSHD-1 Logging Vulnerability (discovered and published by Jose Nazario,
Crimelabs). Attackers can remotely brute-force passwords without
getting noticed or logged. In the ssh package from the SuSE
distribution, root login is allowed, as well as password
authentication. Even though brute-forcing a password may take an
enormous amount of time and resources, the issue is to be taken
seriously.
b) SSH1 session key recovery vulnerability (by (Ariel Waissbein, Agustin
Azubel) - CORE SDI, Argentina, and David Bleichenbacher). Captured
encrypted ssh traffic can be decrypted with some effort by obtaining
the session key for the ssh session. The added patch in our package
causes the ssh daemon to generate a new server key pair upon failure
of an RSA operation (please note that the patch supplied with Iván
Arce on bugtraq on Wed, 7 Feb 2001 has been corrected later on!).
c) In 1998, the ssh-1 protocol was found to be vulnerable to an
attack where arbitrary sequences could be inserted into the ssh-1
protocol layer. The attack was called "crc32 compensation attack", and
a fix was introduced (crc compensation attack detector in the ssh -v
output) into the later versions of ssh. Michal Zalewski discovered
that the fix in its most widely used implementation is defective. An
integer overflow allows an attacker to overwrite arbitrary memory in
the sshd process' address space, which potentionally results in a
remote root compromise.
There are easy resorts that can be offered:
a) switch to openssh (please use the openssh packages on ftp.suse.com from
the same update directories as the ssh package update URLs below indicate).
openssh is a different implementation of the ssh protocol that is
compatible to the protocol versions 1 and 2.
Openssh Version 2.3.0 does not suffer from the problems listed above.
Versions before 2.3.0 are vulnerable to other problems, so please
use the updates from the update directory on the ftp.suse.de ftp server.
See section 2) of this announcement for the md5sums of the packages.
b) upgrade your ssh package from the locations described below.
<p> Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> SPECIAL INSTALL INSTRUCTIONS:
==============================
If you run a sshd (secure shell daemon) server on your system, then the
daemon process must be restarted for the update package to become active
after installation of the update rpm.
You can do this easily with the command (ran as root):
kill -15 `cat /var/run/sshd.pid`
After this, you can start the daemon using the command
rcsshd start
It should be possible now to log on again to your server as usual. Please
consult the syslogs in /var/log if this is not the case.
Warning: killing all instances of sshd on a system might render the system
inaccessible from remote, especially if secure shell is your only
method to access the system. Be careful to not lock yourself out.
<p> Note: The packages on our German ftp server have been built again to
correct one of the patches. The package for the 6.1-i386 distribution
has finished building a few minutes ago and uses the same name as the
build from Wednesday. Use the --force commandline option for the rpm
command if you have used the package that was published before the
release date of this announcement.
<p> i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.de/pub/suse/i386/update/7.1/sec2/ssh-1.2.27-226.i386.rpm
ae68bf3ac28b5e81f9c5f2a1d1d8980e
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/7.1/zq1/ssh-1.2.27-226.src.rpm
d332e662daff71ff7d10cf4d962b6933
SuSE-7.0
ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/ssh-1.2.27-220.i386.rpm
f88b339dea96ef186e70872ce9444c24
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/ssh-1.2.27-220.src.rpm
93ca5fc96c103a5f9adee16cb319195c
SuSE-6.4
ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/ssh-1.2.27-86.i386.rpm
3f1b41116b7c7d63c791de4fdca9d1ee
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/ssh-1.2.27-86.src.rpm
3a8d859f2ae9751852339c642b07b4cf
SuSE-6.3
ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/ssh-1.2.27-86.i386.rpm
3f1b41116b7c7d63c791de4fdca9d1ee
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/ssh-1.2.27-86.src.rpm
3a8d859f2ae9751852339c642b07b4cf
SuSE-6.2
ftp://ftp.suse.de/pub/suse/i386/update/6.2/sec1/ssh-1.2.27-210.i386.rpm
b29822198dc6430167465706965e3499
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.2/zq1/ssh-1.2.27-210.src.rpm
4a2130635f702bb266748b9e4838877a
SuSE-6.1
ftp://ftp.suse.de/pub/suse/i386/update/6.1/sec1/ssh-1.2.27-210.i386.rpm
17f281262edd689d9861c099489cbcc6
source rpm:
ftp://ftp.suse.de/pub/suse/i386/update/6.1/zq1/ssh-1.2.27-210.src.rpm
5e12e0086f61bba2f37c4ccbc4282a92
<p><p> Sparc Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/ssh-1.2.27-221.sparc.rpm
e1545287f954d089707c55a66598c318
source rpm:
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/ssh-1.2.27-221.src.rpm
f37a8b3addaf70711d91f6a3f788a8b3
<p><p> AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/ssh-1.2.27-221.alpha.rpm
77bd0dcda5df929fba07d56de2bf3399
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/ssh-1.2.27-221.src.rpm
77305ae844c9b68e8af559ccf81417e8
SuSE-6.4
ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/ssh-1.2.27-86.alpha.rpm
7a8d7086c8b99822b020f3c9d0e4764e
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/ssh-1.2.27-86.src.rpm
e75660e54edc2cf38086b4de3da91881
SuSE-6.3
ftp://ftp.suse.de/pub/suse/axp/update/6.3/sec1/ssh-1.2.27-212.alpha.rpm
671761326c11c9eac50c3d992b550bdf
source rpm:
ftp://ftp.suse.de/pub/suse/axp/update/6.3/zq1/ssh-1.2.27-212.src.rpm
5472b658aac01bea8667769a04e0e92d
<p><p> PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/ssh-1.2.27-220.ppc.rpm
ec7274c8a88b6ce5420c91da0622f94c
source rpm:
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/ssh-1.2.27-220.src.rpm
1ae9f7cf4c7099f5cad8cb0ccc8f3e5d
SuSE-6.4
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/ssh-1.2.27-86.ppc.rpm
fc3cb2e3b927c7ffc5e8374e183f860e
source rpm:
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/ssh-1.2.27-86.src.rpm
439abdfb6f56e2c0d3880cddd103935f
<p><p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- The openssh package URLs and md5sums:
ftp://ftp.suse.de/pub/suse/i386/update/7.1/sec1/openssh-2.3.0p1-5.i386.rpm 3687c385e3e8f6e845c17518c12dd61b
ftp://ftp.suse.de/pub/suse/i386/update/7.1/zq1/openssh-2.3.0p1-5.src.rpm 3cf3a1f652d92d66e70bfc9c40c0eb38
ftp://ftp.suse.de/pub/suse/i386/update/7.0/sec1/openssh-2.3.0p1-0.i386.rpm ce12abcff3dec118ceabe62e6cd1e090
ftp://ftp.suse.de/pub/suse/i386/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 3a7cf864f695a9f3ec2dd0bf6cc7e161
ftp://ftp.suse.de/pub/suse/i386/update/6.4/sec1/openssh-2.3.0p1-0.i386.rpm 3219bf7853c2c27056ec502b5fd3345c
ftp://ftp.suse.de/pub/suse/i386/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 82a18d49a9a98942417258ffcd7a4800
ftp://ftp.suse.de/pub/suse/i386/update/6.3/sec1/openssh-2.3.0p1-0.i386.rpm 3219bf7853c2c27056ec502b5fd3345c
ftp://ftp.suse.de/pub/suse/i386/update/6.3/zq1/openssh-2.3.0p1-0.src.rpm 82a18d49a9a98942417258ffcd7a4800
ftp://ftp.suse.de/pub/suse/axp/update/7.0/sec1/openssh-2.3.0p1-0.alpha.rpm b924315c09cb990009b24d3c1093e142
ftp://ftp.suse.de/pub/suse/axp/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 6339a4f2a4982ba2e6b943a182d02420
ftp://ftp.suse.de/pub/suse/axp/update/6.4/sec1/openssh-2.3.0p1-0.alpha.rpm 61da28e2695d8f4a4b1c6300d867e6b6
ftp://ftp.suse.de/pub/suse/axp/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 9e8e5af8b890f2a18e244da1c94be796
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/sec1/openssh-2.3.0p1-0.ppc.rpm 72f7c339991e54a476585012423dda62
ftp://ftp.suse.de/pub/suse/ppc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm 749ccc55396944ad43c1977e55903958
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/sec1/openssh-2.3.0p1-0.ppc.rpm e08ec87634dfd0dd76d18886d04ebd4b
ftp://ftp.suse.de/pub/suse/ppc/update/6.4/zq1/openssh-2.3.0p1-0.src.rpm 95820e1934a5586c8d73719957972d7c
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/sec1/openssh-2.3.0p1-0.sparc.rpm 8ed7a34fec7bcc6c658809effe20fd82
ftp://ftp.suse.de/pub/suse/sparc/update/7.0/zq1/openssh-2.3.0p1-0.src.rpm c551925107c7000fa32556dbe4a4fad4
<p> - Linux kernel upgrade.
Several security flaws have been found in the linux-2.2.x kernel versions.
The only suitable workaround is to upgrade to a newer kernel version.
SuSE provides kernels that have been expanded with several dozen device
drivers that are not included in the standard main stream kernel.
While working on the kernel update packages for our distributions, more
security problems were discovered. Currently, several persons audit code
in the kernel, so that more problems are expected to be discovered in the
very near future.
Since kernel updates are very time-consuming on behalf of the system
administrator, we decided to not publish a new kernel package
each week. Instead, the new kernel packages with all known security bugs
fixed will be published by the midth/end of next week.
In the meanwhile, administrators who require immediate updates, please go
to ftp.kernel.org (or one of its mirrors, respectively) and get Alan Cox'
prepatches for the 2.2.19 version of the Linux kernel. The directory
usually is /pub/linux/kernel/people/alan/2.2.19pre, his latest patch is
pre-patch-2.2.19-13.gz. This patch fixes all currently publically known
security problems in the Linux v2.2 kernel. For those who are not
experienced in patching and installing kernels, we recommend to wait
for the release of the SuSE Linux kernel update packages.
<p> - From SuSE-SA:2001:03 (bind8): The sparc update packages were pending
because of build bottlenecks. The URLs to the update packages and the
md5sums are as follows:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/n1/bind8-8.2.3-39.sparc.rpm
c7e2a95bd4b90d03207ffc3a9880c36c
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
5d4d4b608f2a8a3e61f7dc6917254f4f
<p><p> - bind: The bind package version 4.x has been found vulnerable to multiple
security problems that were discussed and published in public security
forums. See http://www.securityfocus.com/templates/advisory.html?id=3051
for more information. SuSE provides update packages for the bind nameserver
in version 4 for all distributions and architectures.
We also hereby announce that the bind package (bind-4.x; the bind
nameserver in version 8 is contained in the bind8 package) will be
discontinued in future versions of the SuSE Linux Distribution. We
recommend to migrate to bind in the 8.x or 9.x series.
There will be a seperate security announcement for the bind (4.x) package
by Monday, February 19th 2001. In the meanwhile, get the md5sums from the
URL ftp://ftp.suse.de/private/draht/bind4-checksums . It is signed.
- More announcements are following this one. (mysql, tmpfile races, ...)
Please read (this) section 2) in the announcements carefully.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOo1ck3ey5gA9JdPZAQFXJAgAle2SSB5ddOCY2fk3rzphFmqW7Loh+7KQ
jijyw1SQO2/aJsEjszMVGEmlnwJD0H8wOuTrHJzWvl4/lefC+D1qM2Lpd+yJTyus
tKdzGIESSmrhXD652iBndB+kpYmMmcRKx7KgBrr9/+q9Z6UNTRUy+8N7ClRoZmuM
srLN7KA2yuHDNVwUelmyeHOh3gQGeyKGuBXI8wg3IxQgr2C+64kUyuruTqnG196m
GirfMhCKIH1hTdhuM63JZBp6LxQ1rkv8Cd9EeFMm5kL+0yTKU0dv4nO1GHBYe3TD
wKkHpENOjGBqEb4jQe/syT/DvBqo8HH5fm9OA9j/R4onEDErFJJqYw==
=/AJH
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: bind8
Announcement-ID: SuSE-SA:2001:03
Date: Tuesday, January 30th, 2000 23:40 MEST
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0, 7.1
Vulnerability Type: remote root compromise
Severity (1-10): 9
SuSE default package: no
Other affected systems: all systems using bind, versions before
8.2.3-REL
Content of this advisory:
1) security vulnerability resolved: bind8
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
bind-8.x in all versions of the SuSE distributions contain a bug in the
transaction signature handling code that can allow to remotely over-
flow a buffer and thereby execute arbitrary code as the user running
the nameserver (this is user named by default on SuSE systems).
In addition to this bug, another problem allows for a remote attacker
to collect information about the running bind process (this has been
found by Claudio Musmarra <a9605121(a)unet.univie.ac.at>).
For more information on these bugs, please visit the CERT webpage at
http://www.cert.org/advisories/CA-2001-02.html and the bind bugs
webpage at http://www.isc.org/products/BIND/bind-security.html .
The problem is existent in the upcoming SuSE distribution 7.1 that
will be available by February 10th in the CD/DVD version.
There exists no reasonable method to circumvent the problems other than
to update the package as described below.
<p> Please choose the update package for your distribution from the
URLs listed below and download the necessary rpm files. Then,
install the package using the command `rpm -Uhv file.rpmŽ. rpm
packages have an internal md5 checksum that protects against file
corruption. You can verify this checksum using the command
(independently from the md5 signatures below)
`rpm --checksig --nogpg file.rpm',
The md5 sums under each package are to prove the package authenticity,
independently from the md5 checksums in the rpm package format.
SPECIAL INSTALL INSTRUCTIONS:
==============================
If you run a bind8 nameserver on your system, please update the package
immediately. In order for the updated package to become active, the
nameserver process "named" needs to be restarted. Do this using the
command
`rcnamed restartŽ
as root after performing the rpm command as shown above. Afterwards,
check for the running daemon using the ps command as `ps auxŽ. The
named process should show a new starting time. Repeat the
`rcnamed restartŽ command if the nameserver shut down too slowly to
release the socket for the new server.
<p> i386 Intel Platform:
SuSE-7.1
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n2/bind8-8.2.3-92.i386.rpm
e9b354dbd96f6216b9da01f2b3a0a166
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/bind8-8.2.3-92.src.rpm
f77200a6c476b58980f68b5db3fd7c4b
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/n1/bind8-8.2.3-61.i386.rpm
4fdee7483fce85f2a31a1a53d2b01b76
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/bind8-8.2.3-61.src.rpm
e53896d1ddfb405774a492469621af02
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/n1/bind8-8.2.3-0.i386.rpm
bb25cb6ba2e54bf929f61c14b3663b3e
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/bind8-8.2.3-0.src.rpm
1033f0df4b747f1d2758fdae69a5fa17
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/bind8-8.2.3-0.i386.rpm
73fe798d4afb87beecb2546ecf076f64
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/bind8-8.2.3-0.src.rpm
dfe4e452d8d0a0a8ff0994e514353b3f
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/bind8-8.2.3-0.i386.rpm
48b45d14724e852810de130864ab8281
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/bind8-8.2.3-0.src.rpm
22ca23ed06739effc887370bfef2d83e
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/bind8-8.2.3-0.i386.rpm
fc9cd0970c15246599f90ce1f5955f29
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/bind8-8.2.3-0.src.rpm
6cdf2e5c3a9a25ca98f8916de677cb70
SuSE-6.0
Please use the SuSE-6.1 packages for the SuSE-6.0 distribution on the
i386 Intel Platform.
<p><p> AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/n1/bind8-8.2.3-39.alpha.rpm
84014e0f19e52a09b90897e18d8eb774
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/bind8-8.2.3-39.src.rpm
99df556319e0c232d78cdb69d5d28ac0
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/n1/bind8-8.2.3-0.alpha.rpm
2e2a8f6c3c6838a7fd49bd7926fc3de3
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/bind8-8.2.3-0.src.rpm
9b0c2e8469f597f43010a125af8f54fe
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/bind8-8.2.3-0.alpha.rpm
0194fc4461ef902c46b75f28fa8f2ef6
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/bind8-8.2.3-0.src.rpm
dffa2d911f6dae9092301bd8ad4f026f
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/n1/bind8-8.2.3-0.alpha.rpm
ebd233233829eef3d73db7d0a828c35a
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/bind8-8.2.3-0.src.rpm
582e7985719d3f7da86a77349aa1611d
<p><p> PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/n1/bind8-8.2.3-39.ppc.rpm
b9354106b0b89edf8f1883b2ea50e656
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/bind8-8.2.3-39.src.rpm
534d84e900c6edf3fa8f2ef546d08c0a
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/n1/bind8-8.2.3-0.ppc.rpm
5c3a00ebd3ddb0388e460673bfec88d0
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/bind8-8.2.3-0.src.rpm
418ae09b44885199f4a4403748b6ab2b
<p> Sparc Platform:
Due to build bottlenecks, the update package for the sparc platform
(SuSE-7.0 distribution) is delayed.
<p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
SuSE distributions contain the bind nameserver in Version 4 as well.
bind-4.x in the currently used version has security-related bugs,
some of which are similar to the ones in the 8.x versions. We will
provide update packages as well as an announcement for the bind
(not bind8) package shortly, along with an own announcement.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
Regards,
Roman Drahtmüller.
- - --
- -
| Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does |
SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
- -
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOndmjXey5gA9JdPZAQGwCwf/U0uWMe9nA8sQmu9C2scFsK5MYpNT0rgu
uEUnChBznoc7FzeeWt2I1sube0DiVx5qcZDY4M7u0/BK4VJCacZIHFgWpye1GseP
RU8bKhsUiujoplyiWb0Fm39AoKa5HGvAAdRFDNuMC7vt8FtKZic6JGm76MOlqVoD
a0hXd6E0Jr55juGxZ5eQqpKWPAR+EjUjEE+R79LQMG8K5FWKHqfwgO2tMNUASaj9
VDkdSTkZS2DX8JIoII6s4g9ksYS0gJds1zivfFdj0fVYcHzwPEvn/ZUv/Mukf2/b
MMDFIaTSGM/G751wRD7sYUhcJ5hxJ8qulsdMvLO8nBorh7IjMZSJrw==
=zKPn
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: kdesu
Announcement-ID: SuSE-SA:2001:02
Date:
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 3
SuSE default package: yes
Other affected systems: All KDE 1 & KDE 2 systems
Content of this advisory:
1) security vulnerability resolved: kdesu
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
<p> kdesu is a KDE frontend for su(1). When invoked it prompts for the
root password and runs su(1). kdesu itself does not run setuid/setgid.
However when enabling the 'keep password' option it tries to send
the password across process boundaries to kdesud via a UNIX socket.
During this it does not verify the identity of the listener on the other
end. This allows attackers to obtain the root password.
This bug has been fixed in the update packages by checking the ownership
of the socket on the listener side.
Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
<p> i386 Intel Platform:
SuSE-6.1:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu-0.98-187.i386.rpm
3d51f84f2dc87916bc937f3afe507c1a
SuSE-6.1:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/kpa1/kdesu.rpm
3d51f84f2dc87916bc937f3afe507c1a
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/kdesu-0.98-187.src.rpm
f8764afd475fa7a41c18603d15ce48ab
SuSE-6.2:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu-0.98-187.i386.rpm
027617e19c957b1ed5f42f140b62521b
SuSE-6.2:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/kpa1/kdesu.rpm
027617e19c957b1ed5f42f140b62521b
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/kdesu-0.98-187.src.rpm
9cf3d4b0c00db4598968dd5c7e07eef7
SuSE-6.3:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu-0.98-187.i386.rpm
d2b6c6f3330a20c2eb7d5500de2f9df6
SuSE-6.3:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/kpa1/kdesu.rpm
d2b6c6f3330a20c2eb7d5500de2f9df6
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/kdesu-0.98-187.src.rpm
a50cc8ba1a793f9151559454fdad0a14
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu-0.98-187.i386.rpm
8f06dd49bdc00dca25eff33a3754ddee
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/kpa1/kdesu.rpm
8f06dd49bdc00dca25eff33a3754ddee
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/kdesu-0.98-187.src.rpm
0ca2d30cf51d1307f88581d4e240bbf0
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu-0.98-187.i386.rpm
c7238ea5775939239b3857b550ca9f1b
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/kpa1/kdesu.rpm
c7238ea5775939239b3857b550ca9f1b
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/kdesu-0.98-187.src.rpm
bc74c75ba0b514f7df4f0250ccc7454a
<p><p> Sparc Platform:
<p><p> AXP Alpha Platform:
SuSE-6.1:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu-0.98-187.alpha.rpm
8017cd7fed463cae4bef3fa471e7e1d8
SuSE-6.1:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/kpa1/kdesu.rpm
8017cd7fed463cae4bef3fa471e7e1d8
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/kdesu-0.98-187.src.rpm
78846e4ae3f50e9264e8840da1a628a8
SuSE-6.3:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu-0.98-187.alpha.rpm
cf1629ba236c0c84e0f2b33101b5f1aa
SuSE-6.3:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/kpa1/kdesu.rpm
cf1629ba236c0c84e0f2b33101b5f1aa
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/kdesu-0.98-187.src.rpm
da851ebaee36cb91cb1e1fca0c8bfda2
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu-0.98-187.alpha.rpm
d1904cc9db320ea2c576b73633ee6bd5
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/kpa1/kdesu.rpm
d1904cc9db320ea2c576b73633ee6bd5
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/kdesu-0.98-187.src.rpm
27261cf8ff0ea66a597520260b832f7d
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu-0.98-187.alpha.rpm
be3b258eeeb3c56351b93ec8a32826db
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/kpa1/kdesu.rpm
be3b258eeeb3c56351b93ec8a32826db
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/kdesu-0.98-187.src.rpm
b7e3139377784c5cbbc4f14a5061d124
<p><p> PPC Power PC Platform:
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu-0.98-187.ppc.rpm
705afa4defc64c48f89dd94b2d52c296
SuSE-6.4:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/kpa1/kdesu.rpm
705afa4defc64c48f89dd94b2d52c296
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/kdesu-0.98-187.src.rpm
32e626fa7e8206d6803957c77062185b
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu-0.98-187.ppc.rpm
e9b4a8a26844af0bc8cb37c8d2d26530
SuSE-7.0:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/kpa1/kdesu.rpm
e9b4a8a26844af0bc8cb37c8d2d26530
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/kdesu-0.98-187.src.rpm
aaa092ffafe149ef8ba3acf570966e09
<p><p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- Kmail remote code execution.
This issue will be adressed in following advisories.
- pgp4pine bufferoverflow.
Very unlikely to be exploited, but next advisories will
contain information on this as well as URL's for patches.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
Regards,
Sebastian Krahmer
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOnLxI3ey5gA9JdPZAQGh/Qf+MoBq8Ys7ANMtnSg9mKVLxA7HXSM5DPVP
lM4zFFJwyU8b/DBNfEHYPwDwNeAxeHtjMbpYbWt2zos2dVsz9caFOZznBRjM9hlF
AhGMzXjTus+qfVoothlsMfVGvV3xOqbbIjdiUZChiULe8/Bm+YDmD2y9fkquxD+Z
dmoY9yOaQ2bSjT8a1Gyin04Jew/uFyAroNmaAn1XDPGqXPq9EIXJz8gWigqDLwe+
Qfcizp9picMLnfEipGtCARP2/my53hp+2JwGy78E+lf7EZrhq0wlJ5nELQUdvYyA
Y6aOEVq349q6Q5QeMF9ABfpyKPbmUXwkzzXTtMwdmYKoKtu6cUEThQ==
=YAhD
-----END PGP SIGNATURE-----
1
0
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: glibc (shlibs)
Announcement-ID: SuSE-SA:2001:01
Date: Friday, January 26th, 2001 15:40 MET
Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 6
SuSE default package: yes
Other affected systems: most Linux/glibc based systems
Content of this advisory:
1) security vulnerability resolved: glibc
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
<p> ld-linux.so.2, the dynamical linker, adds shared libraries to the
memoryspace of a program to be started. Its flexibility allows for
some environment variables to influence the linking process such as
preloading shared libraries as well as defining the path in which
the linker will search for the shared libraries. Special care must
be exercised when runtime-linking setuid- or setgid-binaries:
The runtime-linker must not link against user-specified libraries
since the code therein would then run with the elevated privileges
of the suid binary.
The runtime-linker as used in the SuSE distributions ignores the
content of the critical environment variables if the specified path
begins with a slash ("/"), or if the library file name is not
cached (eg it is contained in a path from /etc/ld.so.conf).
However, Solar Designer has found out that even preloading glibc-
native shared libraries can be dangerous: The code in the user-linked
library is not aware of the fact that the binary runs with suid or
sgid privileges. Using debugging features of the glibc (and possibly
other features) it is possible for a local attacker to overwrite
arbitrary files with the elevated privileges of the suid/sgid binary
executed. This may lead to a local root compromise.
To eliminate these problems, we provide update packages that completely
disregard the LD_* variables upon runtime-linking of a binary that has
an effective uid different from the caller's userid.
<p> Download the update package from locations desribed below and install
the package with the command `rpm -Uhv file.rpm'. The md5sum for each
file is in the line below. You can verify the integrity of the rpm
files using the command
`rpm --checksig --nogpg file.rpm',
independently from the md5 signatures below.
SPECIAL INSTALL INSTRUCTIONS:
==============================
The glibc (the shlibs package) is an intrinsic part of the GNU/Linux
operating system since most binary executables are dependent on
the shared libraries from that package. For this reason, special care
must be taken while updating the shlibs package.
After downloading the binary rpm files, make sure that your system is
idle by bringing it down to Single User Mode (`init 1Ž). If this is not
applicable for operational reasons, then keep your machine as calm as
possible while you perform the update. In particular, make sure that
no shell scripts are running during the update.
Install the package using the command
rpm -Uhv package-rpm-file
Do _NOT_ interrupt the operation of the rpm command!
After the installation, execute the commands
ldconfig # alternatively, use SuSEconfig
/sbin/init u # will restart init
At this point, the update is done.
On low-memory machines a reboot is advisable to free the memory that
is used by the old memory-mapped libraries.
<p> Note 1:
The upcoming SuSE-7.1 distribution is based on glibc-2.2. This
distribution is not affected by the security problems in glibc as
discussed in security forums.
Note 2:
The source rpm for the shlibs package is called "libc*.rpm".
Multiple binary rpm packages are being generated from this source
rpm package. These include: localedb, nssv1, shlibs, timezone.
To get a fix for the runtime-linker related security issue (topic
of this announcement), it is only necessary to update the shlibs
binary rpm package.
<p><p> SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm
94ccbb80d2841f08f2b7322671d6e7f3
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm
3d15b6ffff534f0bf705882dbd8a2551
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm
bc03f1a6f32a66958128e9450e355698
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm
e8f2aa8d32122edfbe3c436a52abb847
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm
8d572332c67b488e5d64a8d4d3274e90
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm
8e1f861112f4a921ea4c7b5631304ee6
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm
b6b4cfe73e46c5b3bd5b626d68dfa584
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm
67fcd70b40f145b5f40b86f7254e35be
SuSE-6.1
SuSE-6.0
The rpm packages are being produced as this announcement is written.
The md5sums for these rpm packages will be provided on the ftp-server,
signed with the security(a)suse.de pgp key below.
<p> Sparc Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm
6b000a6278366c6da4b719d2f62ad7a4
source rpm:
ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm
e845606be9c9aca72213e4c5f1f32290
<p> AXP Alpha Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm
2df813e3c08b52e3f914c591efc742d4
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm
9cb7a6e5981112da6d702916d453b419
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm
0636c2cddf131e76c19e154619a65bd8
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm
39fd3b8e7e4054bc7a333a831e99e6fd
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm
f9713bc945bf7f98527d2fdfbe756dfb
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm
af2eb3df9d83f8f8ca13526046a3a539
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm
4a0033c4ec32ef0e79fc1b7a83692738
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm
11871baa8279f8c0c79f6c9d95ca531c
<p><p> PPC Power PC Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm
8d9d27a8fba22de4df5cd4700a541ad9
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm
89946b9a2bb7c545a1761a84ebd979ab
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm
383bb49a2f6a3e83a9c2ed3eea30dc99
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm
91ed7087165b74383cddb556abc07402
<p><p><p>______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
This announcement is followed by a sequence of more announcements
to address the ongoing security problems as discussed in public
security forums. In particular, there are temporary file races in
multiple packages (we collect and address them in a single
announcement to keep the noise low), format string bugs, as well
as a man-in-the-middle attack in the kdesu program and a single-byte
buffer overflow. The next announcenemts will contain more information
on these topics.
Please stay tuned.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security(a)suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe(a)suse.com>.
suse-security-announce(a)suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe(a)suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info(a)suse.com> or
<suse-security-faq(a)suse.com> respectively.
===============================================
SuSE's security contact is <security(a)suse.com>.
===============================================
<p><p>Regards,
Roman Drahtmüller,
SuSE Security.
- -
| Roman Drahtmüller <draht(a)suse.de> // "Caution: Cape does |
SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
- -
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security(a)suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOnGNKney5gA9JdPZAQHwWAf+O/xaFgEnMGl1E3NqR/oC6zDB5TelVWil
7Ng4KVr1Ijwodi7CjXAOXdI1SfVt2v64IWKxjpppQdM1F9epNEFCHx2XdLCviBEo
EMC8r+KmPICRvfZJUzhJQPszXuLm7SDPTf5fsrWBcQrLnaQ+1eCBqlyCciFqLb3s
iZYaxP/NoQh18UuKUVo3lRAzwN7eZwKh4xuwRfmxdB1yBqHloquTKA+JV7kl8SV4
k3PaNO7yC1kkbltkUX/y95hKEhQazh5Il/vK0FyKMHzXYdj8y28kQJKL07Gmwaye
Sx3U7QRe9AD1e+IcfPzE6G9n1beaNhKMu+hGfyYXg+5n8lGKp/FTxw==
=bcEa
-----END PGP SIGNATURE-----
1
0