-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: glibc
Announcement-ID: SuSE-SA:2003:027
Date: Monday, May 26th 2003 16:12 MET
Affected products: 7.1, 7.2, 7.3, 8.0, 8.1
SuSE Linux Database Server,
SuSE eMail Server III, 3.1
SuSE Linux Enterprise Server 7,
SuSE Linux Firewall on CD/Admin host
SuSE Linux Connectivity Server
SuSE Linux Office Server
Vulnerability Type: remote system compromise
Severity (1-10): 6
SuSE default package: yes
Cross References: CAN-2003-0028
Content of this advisory:
1) security vulnerability resolved: integer overflow in XDR code
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds:
- ethereal
- XFree4
- vnc
- bitchx
- lv
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
Another integer overflow was found in glibc' XDR code. This bug is equal
to the one described in advisory SuSE-SA:2002:031. The overflow occurs in
the function xdrmem_getbytes() and can be used by external attackers to
execute arbitrary code.
There is no temporary workaround for this security problem other than
disabling all RPC based server and client programs. The permanent
solution is to update the glibc packages with the update packages
listed below.
Notes, Special installation instructions:
* PRECAUTIONS
The shared libraries package of the glibc is the most sensitive
part of a running Linux system, and modifications to it should be
handled with special care. During the update of the shlibs/glibc
package, runtime-linking the shared libraries is likely to fail for
processes that execute a new binary with the execve(2) system call.
Therefore, we recommend to bring a system to single user mode
("init S") to perform the package update. If this is not applicable
for operational reasons, a system receiving the update should be kept
as quiet as possible (no shell scripts of any kind, no cron jobs, no
incoming email).
* After performing the update, you should run the following command
on your system:
/sbin/ldconfig
ldconfig will rebuild the runtime linker cache. If you use YOU
(Yast2 Online Update), the ldconfig command will be executed
automatically at the end of the update.
The shared libraries that were installed on the system before the
update have been removed from the filesystem, but they are still
in use by the running applications. Therefore, the disk-space as well
as the memory will not be freed until the last process that uses
these files exits. We recommend to reboot the system to workaround
this problem.
Listed below you find the URLs for the update packages for the SuSE Linux
products. We only list the packages that are relevant for the security update.
Our maintenance customers are being notified individually. The packages
are being offered to install from the maintenance web.
Intel i386 Platform:
SuSE-8.1:
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.rpm
1cf549fa52427710c7dc3316fc5df4a6
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i686/glibc-2.2.5-177.i686.patch.rpm
f87601fd71edf54928104581684dae8f
SuSE-8.0:
ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.rpm
da51402d30c37dd5dc6d5444c37f4dc3
patch rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/a1/glibc-2.2.5-177.i386.patch.rpm
0b5ea57d89c31d923cfb56cb1f951bac
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/8.0/zq1/glibc-2.2.5-177.src.rpm
6fecec2ed42fb792b6e9cb2a5602fe23
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/i386/update/7.3/a1/glibc-2.2.4-78.i386.rpm
11cc1ceb173b18fc82d8500b1528663e
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.3/zq1/glibc-2.2.4-78.src.rpm
38527e5f75d94c016659c71028c37c52
SuSE-7.2:
ftp://ftp.suse.com/pub/suse/i386/update/7.2/a1/glibc-2.2.2-68.i386.rpm
82f4c3ee8ba0cf3feef5e0ba7321a230
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.2/zq1/glibc-2.2.2-68.src.rpm
34114134cb51d706989c45306f4fdde3
SuSE-7.1:
ftp://ftp.suse.com/pub/suse/i386/update/7.1/a1/glibc-2.2-26.i386.rpm
ffe7c422727ee98b8191facbbf40b9d7
source rpm(s):
ftp://ftp.suse.com/pub/suse/i386/update/7.1/zq1/glibc-2.2-26.src.rpm
1c5b778ff60a82f03e412239b907671b
Sparc Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/a1/glibc-2.2.4-46.sparc.rpm
dc577491e13344411462603b6fe83d3f
source rpm(s):
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/zq1/glibc-2.2.4-46.src.rpm
0a0a5dd6ee76e6b0ef866b500d6537b2
AXP Alpha Platform:
SuSE-7.1:
ftp://ftp.suse.com/pub/suse/axp/update/7.1/a1/glibc-2.2-34.alpha.rpm
d250c254668e02b9f23341903f2f3a5e
source rpm(s):
ftp://ftp.suse.com/pub/suse/axp/update/7.1/zq1/glibc-2.2-34.src.rpm
d89b4a1ff27227a085e516b48ccdb1cf
PPC Power PC Platform:
SuSE-7.3:
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/a1/glibc-2.2.4-69.ppc.rpm
5bf4edf432c996b3e38ef085122e1e8
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds:
- ethereal
Several one-byte buffer overflows and integer overflows are fixed.
These bugs lead to remote denial-of-service or even remote code
execution.
New packages are available on our FTP servers.
- XFree4
A buffer overflow in the Xlib code can be triggered while handling
the environment variable XLOCALEDIR. The X version affected is 4.2.0
(SuSE Linux 8.0 and 8.1).
New packages are available on our FTP servers.
- vnc
VNC (Virtual Network Computing) uses a weak cookie generation process
which can be exploited by an attacker to bypass authentication.
New packages are available on our FTP servers.
- bitchx
Several buffer overflows got fixed that can be exploited remotely by
a malicious IRC servers.
New packages are available on our FTP servers.
- lv
lv reads config files from the current directory without verifying the
ownership. If lv is called in world-writeable directories like /tmp it
can be tricked into executing commands by putting a malicious config-
file there.
New packages are available on our FTP servers.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum