-----BEGIN PGP SIGNED MESSAGE-----

Subject: Caldera Security Advisory SA-1998.13: Buffer overflow in mailx

Topic: Buffer overflow in mailx
Advisory issue date: 24-July-1998


I. Problem Description

	There were several buffer overflows in mailx, e.g. via
	environment variables like HOME.  Some of these were
	exploitable by local users.


II. Impact

Description:

Vulnerable Systems:

	OpenLinux 1.0, 1.1, & 1.2 systems using the mailx package
	prior to mailx-8.1.1-3.
	

III. Solution

Correction:

        The proper solution is to Upgrade to the mailx-8.1.1-3 packages. 

        They can be found on Caldera's FTP site at:
	ftp://ftp.caldera.com/pub/OpenLinux/updates/1.2/010/RPMS

        The corresponding source code can be found at:
	ftp://ftp.caldera.com/pub/OpenLinux/updates/1.2/010/SRPMS

        The MD5 checksums (from the "md5sum" command) for these packages are:

87ed7999df10c0109ca00abab784c253  RPMS/mailx-8.1.1-3.i386.rpm
30840f0707958dd77b52d88daedb8d3b  SRPMS/mailx-8.1.1-3.src.rpm

        Upgrade with the following commands:

	rpm -q mailx && rpm -U mailx-8.1.1-3.i386.rpm
	

IV. References


        This and other Caldera security resources are located at:
	http://www.caldera.com/news/security/index.html

        This security fix closes Caldera's internal Problem Report
	4063.


V. PGP Signature

	This message was signed with the PGP key for security@caldera.com.

	This key can be obtained from:
		ftp://ftp.caldera.com/pub/pgp-keys/

	Or on an OpenLinux CDROM under:
		/OpenLinux/pgp-keys/

	$Id: SA-1998.13.txt,v 1.3 1998/07/24 13:00:53 rf Exp $


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQCVAwUBNbiFhen+9R4958LpAQFAvQP/TiVnfBOw3XXjstspJdd/Xr+AAW++aPS0
MAh6L75i0Uk71VHz0BhayZXTGRU5yy8TSeXKYVwhTCXMyUW81oIVD+PFIrE/9z+7
8K2j9pmllJe6QA58x6cHgfX9KkXe4Otr4t+l2n0iX9PjPAJZWmDxB8fR+bSLQhl9
5ezoCEqfbaI=
=0BkJ
-----END PGP SIGNATURE-----