SuSE: 'at' Local privilege escalation
Summary
______________________________________________________________________________
SuSE Security Announcement
Package: at
Announcement-ID: SuSE-SA:2002:003
Date: Wednesday, Jan 16th 2001 16:00 MET
Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3
Vulnerability Type: local privilege escalation
Severity (1-10): 5
SuSE default package: yes
Other affected systems: most Linux systems with the at package
installed
Content of this advisory:
1) security vulnerability resolved: at
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, solutions, workarounds
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
The 'at' command reads commands from standard input for execution at a
later time specified on the command line. If such an execution time is
given in a carefully drafted (but wrong) format, the at command may
crash as a result of a surplus call to free(). The cause of the crash
is a heap corruption that is exploitable under certain circumstances
since the /usr/bin/at command is installed setuid root.
A temporary workaround against the bug is to disable the at command for
non-root users by removing the setuid-bit from the /usr/bin/at command.
As a permanent solution it is recommended to install the update packages
as listed for download below. In addition to the fixed heap corruption,
file handling security has been improved by adding the O_EXCL (exclusive)
option to an open(2) system call inside the at(1) code. We thank
zen-parse for reporting this vulnerability.
Please download the update package for your distribution and verify its
integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command "rpm -Fhv file.rpm" to apply
the update.
i386 Intel Platform:
SuSE-7.3
db3d2bd38f81667dcece38d1c4a86725
source rpm:
82701057fc8ea3217800b0ab1e2e544b
SuSE-7.2
91b759e6a8d433273c5567ed26735690
source rpm:
3df6d6d708d4ef90515f6f1fbbdea5bf
SuSE-7.1
73eb22d5c958c17e264fd31ec339b763
source rpm:
1303a1328f31313a62f5645f7cb476ef
SuSE-7.0
3179e64f87371d7864d1956ceb9bd020
source rpm:
67efafe83908ac53fc54acac9a0f056b
SuSE-6.4
aaffed7c302b9ec42885087296c6f0a1
source rpm:
374cf4374fbe1e66ab2e685aa0449034
Sparc Platform:
SuSE-7.3
ec76d45245ef917e22f5f1a863a89988
source rpm:
40de9490a06bd294ad6a7f90e682c0cd
SuSE-7.1
27f575762c0b1643008968a167324347
source rpm:
66546dc729e071039595a13d01feacfb
SuSE-7.0
98007292769f55e4239b6922157bfa13
source rpm:
2d20cdbb10680282596677aac3106f30
AXP Alpha Platform:
SuSE-7.1
df71ebf25a2252637ee1421d08779b8d
source rpm:
b8b3a4f80e0d19e0211131ca58c1e0fe
SuSE-7.0
0bc21b9ddc12746a17592fa74473bbf6
source rpm:
4d93aa10b426224936e3de357540ea49
SuSE-6.4
aeb76c2eb37f7e442c49c7ba3c5e44a5
source rpm:
6d783c34eb0b855a96736e58d67bc053
PPC Power PC Platform:
SuSE-7.3
111bd6e813ef33265035b21d19776b49
source rpm:
fa2ee9aca5b73009b1d9c90731265a19
SuSE-7.1
868a1662f751823432d3d881edd371cd
source rpm:
d759233bfc2ce230e1c46d2ec0f15a73
SuSE-7.0
7b12fe4b5f31434eb7cf3c0caae75811
source rpm:
4c6e2724bb76e08be66831ed85c60f85
SuSE-6.4
7ebc9a1fde97f5ac8226b9e17621a40b
source rpm:
fa3c5e08703eb54b4f493de56ec837bb
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Linux Distributions and Workarounds:
- clanlib
dotslash@snosoft.com reported an environment variable copying buffer
overflow in the clanlib package. If a program that is linked against
the clanlib shared library is installed setuid or setgid, this error
may lead to elevated privileges. In the case of SuSE Linux distributions,
this is only the case for the methane package: It comes installed with a
setgid bit to group "game", which is used to store highscores in group-
writeable files. This setgid bit will be cleared in future releases of
the SuSE Linux distribution. For already installed "methane" packages,
we recommend to remove the setgid bit with the command
chmod -s /usr/X11R6/bin/methane
The methane package is not installed on SuSE systems by default, nor is
the defective library "clanlib".
- thttpd
The thttpd daemon contained several off-by-one overflows. Due to internal
organization of the variables affected by these overflows, they seem
not exploitable. However, these bugs have been fixed. Please update to
the newest thttpd packages.
- pine
The popular mail client "pine" was found vulnerable to an attack where
shell metacharacters inside an URL could be used to execute arbitrary
commands if pine passes the URL to an external viewer on the
commandline. The pine packages on SuSE products are not vulnerable to
this weakness because they contain a patch that works around this
problem since it is not new.
- xchat
We are working on updates for the xchat packages in the SuSE Linux
7.0 and 7.1 distributions that are vulnerable to an encoding bug
while receiving and decoding ctcp datagrams. This bug can lead
an xchat IRC client to execute IRC protocol specific commands to an
IRC server such as channel mode changes.
______________________________________________________________________________
3) standard appendix: authenticity verification, additional information
- Package authenticity verification:
SuSE update packages are available on many mirror ftp servers all over
the world. While this service is being considered valuable and important
to the free and open source software community, many users wish to be
sure about the origin of the package and its content before installing
the package. There are two verification methods that can be used
independently from each other to prove the authenticity of a downloaded
file or rpm package:
1) md5sums as provided in the (cryptographically signed) announcement.
2) using the internal gpg signatures of the rpm package.
1) execute the command
md5sum
References
