lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
From: please_reply_to_security at (
Subject: OpenLinux: slocate local user buffer overflow

Hash: SHA1


			SCO Security Advisory

Subject:		OpenLinux: slocate local user buffer overflow
Advisory number: 	CSSA-2004-001.0
Issue date: 		2004 February 10
Cross reference: 	sr886033 fz528414 erg712456

1. Problem Description

	Heap-based buffer overflow in main.c of slocate 2.6, and possibly
	other versions, may allow local users to gain privileges via a
	modified slocate database that causes a negative "pathlen" value
	to be used. The Common Vulnerabilities and Exposures project
	( has assigned the name CAN-2003-0848 to this issue.

2. Vulnerable Supported Versions

	System				Package
	OpenLinux 3.1.1 Server		prior to slocate-2.7-1.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to slocate-2.7-1.i386.rpm

3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.

4. OpenLinux 3.1.1 Server

	4.1 Package Location

	4.2 Packages

	fd4e0b81e27fd236fcf0e34c28dcca2c	slocate-2.7-1.i386.rpm

	4.3 Installation

	rpm -Fvh slocate-2.7-1.i386.rpm

	4.4 Source Package Location

	4.5 Source Packages

	3a2adce6e30bdcba92fe6a7f70216461	slocate-2.7-1.src.rpm

5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	5.2 Packages

	44f7234c2a58efada5512157bc421d78	slocate-2.7-1.i386.rpm

	5.3 Installation

	rpm -Fvh slocate-2.7-1.i386.rpm

	5.4 Source Package Location

	5.5 Source Packages

	e2f70c80ae832d1267ce22e62ea90d15	slocate-2.7-1.src.rpm

6. References

	Specific references for this advisory:

	SCO security resources:

	This security fix closes SCO incidents sr886033 fz528414

7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.

8. Acknowledgements

	SCO would like to thank Patrik Hornik


Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)


Powered by blists - more mailing lists