[ SOURCE: http://www.secureroot.com/security/advisories/9671773771.html ]

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



______________________________________________________________________________

   Caldera Systems, Inc.  Security Advisory



Subject: ld.so unsetenv problem

Advisory number: CSSA-2000-028.0

Issue date: 2000 August, 24

Cross reference:

______________________________________________________________________________





1. Problem Description



   A bug has been discovered in ld.so that could allow local

   users to obtain super user privilege.



   The dynamic loader ld.so is responsible for making shared

   libraries available within a program at run-time. Normally,

   a user is allowed to load additional shared libraries when

   executing a program; they can be specified with environment

   variables like LD_PRELOAD.



   Since this is not acceptable for applications that run setuid

   root, ld.so normally removes these environment variables for

   these.



   The bug causes these environment variables to not be removed

   completely under some circumstances.  While setuid programs

   themselves are not vulnerable, external programs they execute

   can be affected by this problem.



   So far, no exploit has been published.  However, we

   nevertheless recommend to update glibc (which contains

   ld.so) because of the potential risks.



2. Vulnerable Versions



   System                       Package

   -----------------------------------------------------------

   OpenLinux Desktop 2.3        All packages previous to

   glibc-2.1.1-2



   OpenLinux eServer 2.3        All packages previous to

   and OpenLinux eBuilder       glibc-2.1.3-3S



   OpenLinux eDesktop 2.4 All packages previous to

                                glibc-2.1.2-4



3. Solution



   Workaround:



   none



   We recommend our users to upgrade to the new packages.



4. OpenLinux Desktop 2.3



   4.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/



       The corresponding source code package can be found at:



       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS



   4.2 Verification



   c157fd6b875d5823200984fbfeb10dea  RPMS/glibc-2.1.1-2.i386.rpm

   feb9215b56eb4c715dff9c3f6a890a2e  RPMS/glibc-devel-2.1.1-2.i386.rpm

   9291761b0c03d7f54ca252fc22af8bdc  RPMS/glibc-devel-static-2.1.1-2.i386.rpm

   2584a2a494b7009342324bf2391b17dc  RPMS/glibc-localedata-2.1.1-2.i386.rpm

   de9d14020a0b4283656e9a01ca7f0bd8  SRPMS/glibc-2.1.1-2.src.rpm

   4.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv glibc-*i386.rpm



5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0



   5.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/



       The corresponding source code package can be found at:



       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS



   5.2 Verification



   c8f5ee3e789cdcc7544fd215e8aa9824  RPMS/glibc-2.1.3-3S.i386.rpm

   bec5b2aa1cc780dbdc1fd68ed7400256  RPMS/glibc-devel-2.1.3-3S.i386.rpm

   90e708d06f598e2eca9609f7a2329682  RPMS/glibc-devel-static-2.1.3-3S.i386.rpm

   e1e255eb10ad693a26d695d1db04b7fd  RPMS/glibc-localedata-2.1.3-3S.i386.rpm

   d5c3de3b296496f2c1f08b53f10d6bb6  SRPMS/glibc-2.1.3-3S.src.rpm



   5.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv glibc-*i386.rpm



6. OpenLinux eDesktop 2.4



   6.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/



       The corresponding source code package can be found at:



       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS



   6.2 Verification



   734787918b8d5f85c2c4564bf8470ee3  RPMS/glibc-2.1.2-4.i386.rpm

   73976743de20e3883aff47274d56e00e  RPMS/glibc-devel-2.1.2-4.i386.rpm

   0baea7c2c3fc4cd127b0904a76d4125f  RPMS/glibc-devel-static-2.1.2-4.i386.rpm

   1d253bc28eabc199d5c9aec734ffef4a  RPMS/glibc-localedata-2.1.2-4.i386.rpm

   b0ac7210766f0e48a8a6726f62c18381  SRPMS/glibc-2.1.2-4.src.rpm



   6.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv glibc-*i386.rpm



7. References



   This and other Caldera security resources are located at:



   http://www.calderasystems.com/support/security/index.html



   This security fix closes Caldera's internal Problem Report 7512.



8. Disclaimer



   Caldera Systems, Inc. is not responsible for the misuse of any of the

   information we provide on this website and/or through our security

   advisories. Our advisories are a service to our customers intended to

   promote secure installation and use of Caldera OpenLinux.



______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.0 (GNU/Linux)

Comment: For info see http://www.gnupg.org



iD8DBQE5pSty18sy83A/qfwRAj66AJ0c8Ez5oVCeehQtM0QLHSQsGGDkuQCfdgz3

4DQQP0NY6Vqwt4mr6qfbExs=

=CErA

-----END PGP SIGNATURE-----