full-disclosure - Security Update: [CSSA-2002-040.0] Linux: uudecode performs inadequate checks on user-specified output files

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20021028123339.D7998@caldera.com>
From: security at caldera.com (security@...dera.com)
Subject: Security Update: [CSSA-2002-040.0] Linux: uudecode performs inadequate checks on user-specified output files

To: full-disclosure@...ts.netsys.com

______________________________________________________________________________

			SCO Security Advisory

Subject:		Linux: uudecode performs inadequate checks on user-specified output files
Advisory number: 	CSSA-2002-040.0
Issue date: 		2002 October 28
Cross reference:
______________________________________________________________________________


1. Problem Description

	The uudecode utility would create an output file without checking
	to see if it was about to write to a symlink or a pipe. If a
	user uses uudecode to extract data into open shared directories,
	such as /tmp, this vulnerability could be used by a local attacker
	to overwrite files or lead to privilege escalation.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to sharutils-4.2.1-7MR.1.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to sharutils-4.2.1-7MR.1.i386.rpm

	OpenLinux 3.1 Server		prior to sharutils-4.2.1-7MR.1.i386.rpm

	OpenLinux 3.1 Workstation	prior to sharutils-4.2.1-7MR.1.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/RPMS

	4.2 Packages

	98a9348513f981d0c919de67c7a3fd44	sharutils-4.2.1-7MR.1.i386.rpm

	4.3 Installation

	rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/SRPMS

	4.5 Source Packages

	9c89a0b5d4527def4cb2764bcd87f972	sharutils-4.2.1-7MR.1.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/RPMS

	5.2 Packages

	d790a48715269c624d347556e4e84253	sharutils-4.2.1-7MR.1.i386.rpm

	5.3 Installation

	rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/SRPMS

	5.5 Source Packages

	521eb3dbd3aabb1e76a5db895f46e0bf	sharutils-4.2.1-7MR.1.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/RPMS

	6.2 Packages

	87cd6250715583afa9905785853e546b	sharutils-4.2.1-7MR.1.i386.rpm

	6.3 Installation

	rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

	6.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/SRPMS

	6.5 Source Packages

	ce9daba62eb424024a37b1d0288384db	sharutils-4.2.1-7MR.1.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/RPMS

	7.2 Packages

	03b5f44ec89f04f36500e9ce909459ad	sharutils-4.2.1-7MR.1.i386.rpm

	7.3 Installation

	rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

	7.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/SRPMS

	7.5 Source Packages

	cc2636f8152aced9d77fa310c65f0b8c	sharutils-4.2.1-7MR.1.src.rpm


8. References

	Specific references for this advisory:
		http://www.aerasec.de/security/index.html?id=ae-200204-033&lang=en
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178
		http://www.kb.cert.org/vuls/id/336083

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr864863, fz521051,
	erg712053.


9. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


10. Acknowledgements

	AERAsec discovered and researched this vulnerability.

______________________________________________________________________________
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 237 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20021028/609fe9ae/attachment.bin