-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ Caldera Systems, Inc. Security Advisory Subject: security problems in ptrace and sysctl Advisory number: CSSA-2001-009.0 Issue date: 2001 February, 08 Cross reference: ______________________________________________________________________________ 1. Problem Description There are two security problems in 2.2 and 2.4 kernels. By passing a negative offset to sysctl(), an attacker can read large parts of Linux kernel memory. In addition, a race condition has been discovered that allows an attacker to attach via ptrace to a setuid process, allowing him to modify the running process. 2. Vulnerable Versions System Package ----------------------------------------------------------- OpenLinux 2.3 All packages previous to linux-2.2.10-11 OpenLinux eServer 2.3.1 All packages previous to and OpenLinux eBuilder linux-2.2.14-10S OpenLinux eDesktop 2.4 All packages previous to linux-2.2.14-6 3. Solution Workaround none The proper solution is to upgrade to the latest packages. 4. OpenLinux 2.3 4.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS 4.2 Verification 8a0ef1cedca96379e5a1d1edb9c125ad RPMS/linux-kernel-binary-2.2.10-11.i386.rpm f07baace0c59d53e224771ed08ebf997 RPMS/linux-kernel-doc-2.2.10-11.i386.rpm 32bcd0c87ea21059849f9a2d19f24b96 RPMS/linux-kernel-include-2.2.10-11.i386.rpm 6d8bf49f14207588b700c85534962f1d RPMS/linux-source-alpha-2.2.10-11.i386.rpm 05e01990ade901cabc13835fbdbb408d RPMS/linux-source-arm-2.2.10-11.i386.rpm 0fca33e2c7ba92a6d1bd07800b83a08c RPMS/linux-source-common-2.2.10-11.i386.rpm 0d779697b36fbad15c66fa5fb050982c RPMS/linux-source-i386-2.2.10-11.i386.rpm 548b09b70a84f25a7ce1b89e3a08dd52 RPMS/linux-source-m68k-2.2.10-11.i386.rpm 047d2b9fa3bba181a4cfa24938eb6992 RPMS/linux-source-mips-2.2.10-11.i386.rpm f565161051887da728af6a5c9498fd72 RPMS/linux-source-ppc-2.2.10-11.i386.rpm d054d7d142f3934dad724764c10c2366 RPMS/linux-source-sparc-2.2.10-11.i386.rpm 530cd4780c4a2985f7622a6f5d3b0e2d RPMS/linux-source-sparc64-2.2.10-11.i386.rpm 65294d6f7aa24446d29b8ad0a3e8110e RPMS/pcmcia-cs-3.0.14-2.i386.rpm 355b3b900f6991ae0952c820af0c47c6 SRPMS/linux-2.2.10-11.src.rpm 9cdf867c2e9ce4f30ee7c6075dfe44a3 SRPMS/pcmcia-cs-3.0.14-2.src.rpm 4.3 Installing Fixed Packages Upgrade the affected packages with the following commands: modprobe loop rpm -Fhv linux-*.i386.rpm pcmcia-*i386.rpm 5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0 5.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS 5.2 Verification 9f0c065aa14dea81aa3328cf5714d52b RPMS/iBCS-2.1-5.i386.rpm 96ba2899df9086fc0f805844fedeff8d RPMS/iBCS-extras-2.1-5.i386.rpm e1e8480264cdbb766b0ce72fdbd48210 RPMS/linux-kernel-binary-2.2.14-10S.i386.rpm 1ee722df6359d24b7e585aacb8551fd9 RPMS/linux-kernel-doc-2.2.14-10S.i386.rpm c9645f600529def2cdebf44f6df5570c RPMS/linux-kernel-include-2.2.14-10S.i386.rpm 8eeed84077d1c91055f39751481ab241 RPMS/linux-source-alpha-2.2.14-10S.i386.rpm d73db690f13f3aeb73d1c9f6d39fc041 RPMS/linux-source-arm-2.2.14-10S.i386.rpm 936b50d5e54a2bc0065d1027cdda9283 RPMS/linux-source-common-2.2.14-10S.i386.rpm b2c92124ddda525c79c6eb25999577cd RPMS/linux-source-i386-2.2.14-10S.i386.rpm 072afe6e635c6db3d3cfc6150d711eb0 RPMS/linux-source-m68k-2.2.14-10S.i386.rpm 2591caa8b746764296920a56af41e176 RPMS/linux-source-mips-2.2.14-10S.i386.rpm e08c380c2f28ad8518921d70e34febff RPMS/linux-source-ppc-2.2.14-10S.i386.rpm 33337a54e9e4a5b314755d2a510a7e32 RPMS/linux-source-sparc-2.2.14-10S.i386.rpm c1eec98091fd9740bf7bfc6532e50820 RPMS/linux-source-sparc64-2.2.14-10S.i386.rpm 40019cca864690f2c38352a093f364c8 RPMS/pcmcia-cs-3.1.4-2.i386.rpm 14565258531852898ff0be9b5825dd7d SRPMS/iBCS-2.1-5.src.rpm e5497fff424aa61632b022a07bc85912 SRPMS/linux-2.2.14-10S.src.rpm 5b92f68f680345805e1c77fd44d89a2a SRPMS/pcmcia-cs-3.1.4-2.src.rpm 5.3 Installing Fixed Packages Upgrade the affected packages with the following commands: modprobe loop rpm -Fvh linux-*i386.rpm pcmcia*i386.rpm iBCS*i386.rpm 6. OpenLinux eDesktop 2.4 6.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS 6.2 Verification 67c7df7f573a831c5c46a643f7930499 RPMS/hwprobe-20000214-3.i386.rpm ee79eb927480213cf57df6550086c432 RPMS/iBCS-2.1-9.i386.rpm 3f958c65965f370b500e9fbefbd0ce55 RPMS/iBCS-extras-2.1-9.i386.rpm ff437f5400a7b7e301c233d0ff3a2320 RPMS/iBCS-module-2.1_2.2.14-9.i386.rpm a339adde345ce87c95b27e553b597bc4 RPMS/linux-kernel-binary-2.2.14-6.i386.rpm 686725eb5aa1854b6e805bf0d1697995 RPMS/linux-kernel-doc-2.2.14-6.i386.rpm a2b361bea7d2f7a0d56b9e2465d91fa6 RPMS/linux-kernel-include-2.2.14-6.i386.rpm de2a84e9016fafe1df142e6587a2af73 RPMS/linux-source-alpha-2.2.14-6.i386.rpm af53b5b1bc47489374fd690002345ea7 RPMS/linux-source-arm-2.2.14-6.i386.rpm 58d12902baae6f3baa693d14a760cbc3 RPMS/linux-source-common-2.2.14-6.i386.rpm fbf9fbd017e612d1710170f3d7118c7f RPMS/linux-source-i386-2.2.14-6.i386.rpm cad18295f0df7ca1eba19cf97384aeb6 RPMS/linux-source-m68k-2.2.14-6.i386.rpm 75942d127d7ef9b98c956e7cb4abac6b RPMS/linux-source-mips-2.2.14-6.i386.rpm 5c94b82aae50f4925d3a64ef9aae6412 RPMS/linux-source-ppc-2.2.14-6.i386.rpm 84eb1eff37fabd7d0f4df5ae025c0fd3 RPMS/linux-source-sparc-2.2.14-6.i386.rpm 1624e4bb66a6be2a1982809bf0f25e60 RPMS/linux-source-sparc64-2.2.14-6.i386.rpm e34a47ff00e045d7aaa0c321e9444b33 RPMS/pcmcia-cs-3.1.8-2.i386.rpm 64bb4f963b374c2ae0be9b7cefc458da SRPMS/hwprobe-20000214-3.src.rpm 0c0a223b294aa311d9f9b3eecd57f2b3 SRPMS/iBCS-2.1-9.src.rpm b7d59154a2ec54334b0d26f693336094 SRPMS/linux-2.2.14-6.src.rpm 141b5dcf89bc6976c5e8a7c15cd27e58 SRPMS/pcmcia-cs-3.1.8-2.src.rpm 6.3 Installing Fixed Packages Upgrade the affected packages with the following commands: modprobe loop rpm -Fvh linux-*i386.rpm pcmcia*i386.rpm iBCS*i386.rpm hwprobe*i386.rpm 7. References This and other Caldera security resources are located at: http://www.calderasystems.com/support/security/index.html This security fix closes Caldera's internal Problem Report 9042. 8. Disclaimer Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux. 9. Acknowledgements Caldera, Inc. wishes to thank Chris Evans, Solar Designer and Alan Cox for finding the bugs and their assistance in getting them fixed. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.0 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE6goQi18sy83A/qfwRApM0AJ9fwIFRqKtq5TzEwL9lJlutOaRspwCgh0/e 0FFxS+9ycE6XYkEeHVTKcD0= =sOaz -----END PGP SIGNATURE-----