-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________
		   Caldera Systems, Inc.  Security Advisory

Subject:		security problem with seyon
Advisory number: 	CSSA-1999-037.0
Issue date: 		1999 November, 29
Cross reference:
______________________________________________________________________________


1. Problem Description

   There's a long-standing security problem with seyon that
   allows any user to obtain group uucp privilege. Since
   the license forbids modification of the code, we are unable
   to address these issues.

2. Vulnerable Versions

   Systems : up to COL 2.3
   Packages: all seyon packages

3. Solutions

   We recommend to uninstall seyon.

   Workaround:

   If you do need a terminal program occasionally, we recommend
   that you remove the setgid bit, and add those users permitted
   to access the modem to the uucp group:

	chmod g-s /usr/X11R6/bin/seyon
	perl -pi -e '/^uucp:/ && s/$/,joe/' /etc/group
	perl -pi -e '/^uucp:/ && s/$/,jane/' /etc/group

   The above commands will add users joe and jane to
   group uucp. This will give them sufficient privilege to run
   seyon without it being setgid.

4. Location of Fixed Packages

   N/A

5. Installing Fixed Packages

   N/A
	
6. Verification

   N/A

7. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 5244

8. Disclaimer
   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iQCVAwUBOEKWJun+9R4958LpAQGk+AP+Olz65qRmJe1tfW4kCyS6wAgPF4FqTHLa
y1s3x2j+troEiiQe6uS4uIHqnpSTkERlPaExFXUDG4SssWtk8Ut3t7EnFYXbu+EU
btEu81yGXyNCM2IZGmOvGWOisl7tqOuSjPyeyMrr8aJKoMq0cVo3OKdl+LjcfaUB
0HSaEXEyK0E=
=Qca1
-----END PGP SIGNATURE-----