-----BEGIN PGP SIGNED MESSAGE-----

Subject: Caldera Security Advisory SA-1997.32: Vulnerability in svgalib 1.2.10

Original report date:  09-Jun-1997
RPM build date:    12-Dec-1997
Advisory issue date:  17-Dec-1997

Topic: Vulnerability in svgalib 1.2.10 which can be exploited with zgv.


I. Problem Description

  Svgalib 1.2.10 and below do not properly revoke privileges, and
  through the use of saved user ids, any SUID svgalib application
  may be vulnerable to a buffer overrun attack.


II. Impact

  There is a potential to exploit the bug in svgalib with any
  svgalib application which is SUID.

  With zgv consequences are minimal as only users having access
  to the console can exploit svgalib in this way.

  This problem was present on the following OpenLinux releases:

    CND 1.0
    Base 1.0
    Lite 1.1
    Base 1.1
    Standard 1.1

  To determine if you are affected and need this update you may do
  the following:

    rpm -q svgalib

  If the results do not show svgalib-1.2.11-1 or later then you
  are vulnerable.

  CND 1.0 installations: Please note that the following operations
  require prior installation of the RPM update at:

  ftp://ftp.caldera.com/pub/cnd-1.0/updates/rpm-update.README


III. Solution

  The solution to this problem requires installation of svgalib
  1.2.11 or later.

  New svgalib files files are located on Caldera's FTP server:
  ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/RPMS/

  The source RPM can be found at:
  ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/SRPMS/

  The MD5 checksums are:

  d775be876ce6c5211dc70f63f5ced912  svgalib-1.2.11-2.i386.rpm
  fb5db17f57e8ee520b908af6224b0912  svgalib-1.2.11-2.src.rpm
  ca4286fa0363a928285895cd52c516ad  svgalib-devel-1.2.11-2.i386.rpm
  87de042314d761ced8673df27c554e52  svgalib-devel-static-1.2.11-2.i386.rpm

  The only required file is svgalib-1.2.11-2.i386.rpm.
  The installation can be done with the following command.

    rpm -U svgalib-1.2.11-2.i386.rpm

  CND 1.0 installations: Please note that the preceding operations
  require prior installation of the RPM update described in:

  ftp://ftp.caldera.com/pub/cnd-1.0/updates/rpm-upgrade.README


IV. References / Credits

  This advisory is based on KSR[T] Advisory #001 found at:

    http://www.dec.net/ksrt/

  Also posted on the BUGTRAQ email list:

  From:    ksrt <ksrt@DEC.NET>
  To:    BUGTRAQ@netspace.org
  Subject:  svgalib/zgv
  Date:    Thu, 19 Jun 1997 14:15:42 -0700
  Message-ID: <Pine.LNX.3.95.970619141449.1498A-100000@yoshiwara.dec.net>
  
  This and other Caldera security resources are located at:

    http://www.caldera.com/tech-ref/security/

  This security alert closes Caldera's internal problem report #825.


V. PGP Signature

  This message was signed with the PGP key for <security@caldera.com>.

  This key can be obtained from:
    ftp://ftp.caldera.com/pub/pgp-keys/

  Or on an OpenLinux CDROM under:
    /OpenLinux/pgp-keys/

  $Id: SA-1997.32,v 1.2 1997/12/18 22:49:42 ron Exp $

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNJmoxun+9R4958LpAQE/sQP+M3GElY1R4QqACXV3vo69Cgwy7QBzUkHd
6mR1P3Zb2AGn8abrPX9kFOmzwJkZYbr9O7K8ZQwUsDeHUm9ySSgOBtsiS+oHsOw4
ey5IafxVNk40iW14nGuZFPyOlKx3C5NGe9rzh8LHJHb9LGoFIIBNQJFMx75vAjru
4RiouAmiylA=
=AzHA
-----END PGP SIGNATURE-----