full-disclosure - OpenLinux: slocate local user buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040211192129.4467C1ADEF@helix.pdev.ca.sco.com>
From: please_reply_to_security at sco.com (please_reply_to_security@....com)
Subject: OpenLinux: slocate local user buffer overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

			SCO Security Advisory

Subject:		OpenLinux: slocate local user buffer overflow
Advisory number: 	CSSA-2004-001.0
Issue date: 		2004 February 10
Cross reference: 	sr886033 fz528414 erg712456
______________________________________________________________________________


1. Problem Description

	Heap-based buffer overflow in main.c of slocate 2.6, and possibly
	other versions, may allow local users to gain privileges via a
	modified slocate database that causes a negative "pathlen" value
	to be used. The Common Vulnerabilities and Exposures project
	(cve.mitre.org) has assigned the name CAN-2003-0848 to this issue.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------
	OpenLinux 3.1.1 Server		prior to slocate-2.7-1.i386.rpm
	OpenLinux 3.1.1 Workstation	prior to slocate-2.7-1.i386.rpm


3. Solution

	The proper solution is to install the latest packages. Many
	customers find it easier to use the Caldera System Updater, called
	cupdate (or kcupdate under the KDE environment), to update these
	packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/RPMS

	4.2 Packages

	fd4e0b81e27fd236fcf0e34c28dcca2c	slocate-2.7-1.i386.rpm

	4.3 Installation

	rpm -Fvh slocate-2.7-1.i386.rpm

	4.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/SRPMS

	4.5 Source Packages

	3a2adce6e30bdcba92fe6a7f70216461	slocate-2.7-1.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/RPMS

	5.2 Packages

	44f7234c2a58efada5512157bc421d78	slocate-2.7-1.i386.rpm

	5.3 Installation

	rpm -Fvh slocate-2.7-1.i386.rpm

	5.4 Source Package Location

	ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/SRPMS

	5.5 Source Packages

	e2f70c80ae832d1267ce22e62ea90d15	slocate-2.7-1.src.rpm


6. References

	Specific references for this advisory:
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848
		http://marc.theaimsgroup.com/?l=bugtraq&m=106546447321274&w=2
		http://marc.theaimsgroup.com/?l=bugtraq&m=106589631819348&w=2
		http://www.ebitech.sk/patrik/SA/SA-20031006.txt
		http://www.ebitech.sk/patrik/SA/SA-20031006-A.txt

	SCO security resources:
		http://www.sco.com/support/security/index.html

	This security fix closes SCO incidents sr886033 fz528414
	erg712456.


7. Disclaimer

	SCO is not responsible for the misuse of any of the information
	we provide on this website and/or through our security
	advisories. Our advisories are a service to our customers intended
	to promote secure installation and use of SCO products.


8. Acknowledgements

	SCO would like to thank Patrik Hornik

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFAKY0fbluZssSXDTERAu6rAKC+SIPACchxNJ579hYlNnXz9jEOQwCg5w+c
DU21bhDCYBuhyJTHWipdffw=
=vPHf
-----END PGP SIGNATURE-----