-----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: perl, all versions Date: Thursday, August 10th, 2000 Affected SuSE versions: 6.0-6.4, 7.0 Vulnerability Type: local root compromise Severity (1-10): 5 SuSE default package: yes, but not configured exploitable. Other affected systems: all linux systems using this package Content of this advisory: 1) security vulnerability resolved: suidperl (local root compromise) problem description, discussion, solution and upgrade information 2) pending vulnerabilities, temporary workarounds (Netscape) 3) standard appendix (further information) <p>______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information suidperl is the perl interpreter for suid perl scripts, a part of the perl package. A maliciously implemented feature causes the interpreter to spawn the /bin/mail program to inform the superuser of its usage, thereby passing on untrusted environment that causes /bin/mail to execute arbitrary commands as user root. SuSE distributions are not susceptible to this problem because /usr/bin/suidperl is mode 755 (not suid) by default. Administrators must explicitly have enabled suidperl by changing the permission modes of the interpreter to 4755 root.root (suid root) for the exploit mechanism to work. In SuSE-Linux, activating suidperl is done by changing one of the files /etc/permissions.(easy|secure) and running SuSEconfig or `chkstat -set /etc/permissions.(easy|secure)', alternatively, depending on the setting of PERMISSION_SECURITY in /etc/rc.config. If SuSEconfig is turned off completely, the administrator of the system is obliged to change the permission modes by hand. The decision to not activate suidperl has been made because security problems were expected in the wild. O/S vendors have provided updated packages for both suidperl and mailx, the package containing /bin/mail. Basically, /bin/mail's fetures are not the origin of the security hole because the hostile environment is passed on by the suidperl interpreter, despite the fact that the interpreter runs suid root. Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the problem of this advisory if /usr/bin/suidperl is setuid root. However, suidperl is installed with mode 755 after the installation like in older SuSE Linux distributions and therefore can't be exploited without prior manual activation of suidperl by the system administrator. SuSE provides an updated package for the vulnerable software. It is strongly recommended to upgrade to the latest version found on our ftp server as described below. The package removes the mail notification and uses the syslog facility (priority warning) instead. Chose one of the following paths to download the package from our ftp server and install the package with the command `rpm -Fhv file.rpm'. The md5sum for each file is in the line below. You can verify the integrity of the rpm files using the command `rpm --checksig --nogpg file.rpm', independently from the md5 signatures below. i386 Intel Platform: SuSE-7.0 ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm 01c855f752b835536403c7bcc74d8114 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm 16c850efed03cc5bd5b9bff3910dd6e4 SuSE-6.4 ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm 0640e11ba0b87f0d8a01b4b5dedbb8eb source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm a68ade45a65e73805b2276ad35266d46 SuSE-6.3 ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm 7a3c2adae0c556a7ccb647eaca34e6c7 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm 6bc207d360a1349f8f8067a83061f848 SuSE-6.2 ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm 6403b21d3795def485ad4a577a38c3be source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm 47760a9798dc1489ca9fd2ee3a1756f6 SuSE-6.1 ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm ac14b4fccfb10e5465f377b095621730 source rpm: ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm 7d3aec7879fabcac3d2b7e4996340c31 AXP Alpha Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm 47853649c4683748558dbb72f759d739 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm 5949a68b6126afdca98224cd6ed4be74 SuSE-6.3 ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm 994804e426adf718df64162c92a1ce84 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm 879238a9e443bbe32cc4d421ed9a5d28 SuSE-6.1 ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm cf2d763fb562a75395c5e613704cbd10 source rpm: ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm e0aa5d0c91f474592e56eed2a8b3fae0 PPC Power PC Platform: SuSE-6.4 ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm 828a210ef2b3aa462161010d4d19416a source rpm: ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm 9253498d7c474ad2e9f8dabe576d2c96 ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Distributions and Workarounds This section addresses currently known vulnerabilities in Linux/Unix systems that have not been resolved up to the release date of this advisory. - Netscape, versions from 3.0 to 4.73: The latest version of Netscape is currently being tested. SuSE Netscape rpms contain efficient workarounds against some "morbid" properties of Netscape in order to provide stable packages. These additions are being reworked right now. Also, cryprographical software export regulations require us to wait for the permission to redistribute the netscape package from our US-American ftp server. There are currently two known vulnerabilities in Netscape versions from 3.0 to 4.73: a) a buffer overflow in the jpeg image handling code b) a security flaw in Netscape's Java implementation a) has been fixed in Netscape version 4.74. Updated packages from SuSE will follow very soon. Temporary fix/workaround: problem a) Turn off automatic image loading and do not click on images to trigger the download. This may be a fairly unsatisfying solution. problem b) Turn off Java and JavaScript. - ntop ntop is a network statistics visualization utility which offers graphical analysis of network traffic and other statistics with a web browser. By default, ntop listens on port 3000 and requires no or a commonly known authentication password to view the data. ntop is only installed in network server selections and is not activated by default in SuSE Linux installations. The ntop packages shipped with SuSE Linux did not exhibit the unsafe behaviour when a file like /../../etc/passwd is referenced. ______________________________________________________________________________ 3) standard appendix: SuSE runs two security mailing lists to which any interested party may subscribe: suse-security@suse.com - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to <suse-security-subscribe@suse.com>. suse-security-announce@suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to <suse-security-announce-subscribe@suse.com>. For general information or the frequently asked questions (faq) send mail to: <suse-security-info@suse.com> or <suse-security-faq@suse.com> respectively. =============================================== SuSE's security contact is <security@suse.com>. =============================================== Regards, Roman Drahtmüller. - -- - - | Roman Drahtmüller <draht@suse.de> // "Caution: Cape does | SuSE GmbH - Security Phone: // not enable user to fly." | Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) | - - ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4 Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw== =DQ80 -----END PGP SIGNATURE-----