lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20040127145503.ALLYOURBASEAREBELONGTOUS.X22531@hbedv.net>
Date: Tue, 27 Jan 2004 15:55:03 +0100
From: AntiVir Support <support@...ivir.de>
To: bugtraq@...urityfocus.com
Subject: Re: symlink vul for Antivir / Linux Version 2.0.9-9 (maybe lower)

Update Information:
-------------------
On 14 January 2004 we provided a new version of our software that was no 
longer vulnerable to the exploit posted by <l0om@...luded.org>. This 
version was 2.0.9-11.

It was later determined that a more aggressive brute force symlink 
attack would be possible with this version. Therefore, on 15 January 
2004 we provided another new version of our software that no longer was 
vulnerable to any symlink attacks using the temporary PID files. This 
version was 2.0.9-12. Users were able to attain the updated versions 
using the internet updater:

	$ antivir --update

or by downloading the latest software package from the website:

	http://www.antivir.de/download/download.htm

Users may check their currently installed version by running:

	$ antivir --version

The sigificant version information is:

	product version: 2.0.9-12

This version and all subsequent versions are not vulnerable to any 
symlink attacks using the temporary PID files.

Solution Information:
---------------------
Previous versions had created temporary files without first checking if
the file already existed. A check for existing files has now been added.
If the file exists, it is removed. A new file is then created using the
exclusive flag. If this is unsuccessful, no temporary file will be created.

Users should not use an NFS mount for AntiVir temporary files since file
locking over NFS does not work on most implementations. As default,
AntiVir uses /tmp or /var/tmp for temporary files.

Addional Information:
---------------------
It should be noted that H+BEDV Datentechnik GmbH was not first contacted
by <l0om@...luded.org>. We learned of the problem through the bugtraq
mailing list.

We ask that all security-related problems be directed to 
<security@...ivir.de> before being posted publicly. This gives us a 
chance to evaluate the problem and determine a course of action without 
putting our users at risk. We appreciate your cooperation.
-- 
AntiVir Support
H+BEDV Datentechnik GmbH
<mailto:support@...ivir.de>
Lindauer Strasse 21, 88069 Tettnang, Germany
Tel.: +49 (0)7542 500-0
Fax : +49 (0)7542 52510
<http://www.antivir.de>

Content of type "application/pgp-signature" skipped

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ