-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SuSE Security Announcement

        Package:                perl, all versions
        Date:                   Thursday, August 10th, 2000
        Affected SuSE versions: 6.0-6.4, 7.0
        Vulnerability Type:     local root compromise
        Severity (1-10):        5
        SuSE default package:   yes, but not configured exploitable.
        Other affected systems: all linux systems using this package

    Content of this advisory:
        1) security vulnerability resolved: suidperl (local root compromise)
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, temporary workarounds
           (Netscape)
        3) standard appendix (further information)


______________________________________________________________________________

1)  problem description, brief discussion, solution, upgrade information

    suidperl is the perl interpreter for suid perl scripts, a part of the
    perl package. A maliciously implemented feature causes the interpreter
    to spawn the /bin/mail program to inform the superuser of its usage,
    thereby passing on untrusted environment that causes /bin/mail to 
    execute arbitrary commands as user root. 

    SuSE distributions are not susceptible to this problem because 
    /usr/bin/suidperl is mode 755 (not suid) by default. Administrators
    must explicitly have enabled suidperl by changing the permission modes
    of the interpreter to 4755 root.root (suid root) for the exploit 
    mechanism to work.
    In SuSE-Linux, activating suidperl is done by changing one of the 
    files /etc/permissions.(easy|secure) and running SuSEconfig or
    `chkstat -set /etc/permissions.(easy|secure)', alternatively, 
    depending on the setting of PERMISSION_SECURITY in /etc/rc.config.
    If SuSEconfig is turned off completely, the administrator of the 
    system is obliged to change the permission modes by hand.
    The decision to not activate suidperl has been made because
    security problems were expected in the wild.
    O/S vendors have provided updated packages for both suidperl and
    mailx, the package containing /bin/mail. Basically, /bin/mail's
    fetures are not the origin of the security hole because the
    hostile environment is passed on by the suidperl interpreter,
    despite the fact that the interpreter runs suid root.

    Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the 
          problem of this advisory if /usr/bin/suidperl is setuid root.
          However, suidperl is installed with mode 755 after the
          installation like in older SuSE Linux distributions and 
          therefore can't be exploited without prior manual activation
          of suidperl by the system administrator.

    SuSE provides an updated package for the vulnerable software. It is
    strongly recommended to upgrade to the latest version found on our
    ftp server as described below. The package removes the mail 
    notification and uses the syslog facility (priority warning) instead.

    Chose one of the following paths to download the package from our 
    ftp server and install the package with the command `rpm -Fhv file.rpm'.
    The md5sum for each file is in the line below.
    You can verify the integrity of the rpm files using the command
        `rpm --checksig --nogpg file.rpm', independently from the md5 
    signatures below.

    i386 Intel Platform:

      SuSE-7.0
      ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm
        01c855f752b835536403c7bcc74d8114
      source rpm:
      ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm
        16c850efed03cc5bd5b9bff3910dd6e4

      SuSE-6.4
      ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm
        0640e11ba0b87f0d8a01b4b5dedbb8eb
      source rpm:
      ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm
        a68ade45a65e73805b2276ad35266d46

      SuSE-6.3
      ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm
        7a3c2adae0c556a7ccb647eaca34e6c7
      source rpm:
      ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm
        6bc207d360a1349f8f8067a83061f848

      SuSE-6.2
      ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm
        6403b21d3795def485ad4a577a38c3be
      source rpm:
      ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm
        47760a9798dc1489ca9fd2ee3a1756f6

      SuSE-6.1
      ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm
        ac14b4fccfb10e5465f377b095621730
      source rpm:
      ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm
        7d3aec7879fabcac3d2b7e4996340c31

    AXP Alpha Platform:
      SuSE-6.4
      ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm
        47853649c4683748558dbb72f759d739
      source rpm:
      ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm
        5949a68b6126afdca98224cd6ed4be74
      SuSE-6.3
      ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm
        994804e426adf718df64162c92a1ce84
      source rpm:
      ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm
        879238a9e443bbe32cc4d421ed9a5d28
      SuSE-6.1
      ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm
        cf2d763fb562a75395c5e613704cbd10
      source rpm:
      ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm
        e0aa5d0c91f474592e56eed2a8b3fae0

    PPC Power PC Platform:
      SuSE-6.4
      ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm
        828a210ef2b3aa462161010d4d19416a
      source rpm:
      ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm
        9253498d7c474ad2e9f8dabe576d2c96

______________________________________________________________________________

2)  Pending vulnerabilities in SuSE Distributions and Workarounds

    This section addresses currently known vulnerabilities in Linux/Unix
    systems that have not been resolved up to the release date of this
    advisory.

    - Netscape, versions from 3.0 to 4.73:

        The latest version of Netscape is currently being tested. SuSE 
        Netscape rpms contain efficient workarounds against some "morbid"
        properties of Netscape in order to provide stable packages.
        These additions are being reworked right now. 
        Also, cryprographical software export regulations require us to 
        wait for the permission to redistribute the netscape package from 
        our US-American ftp server. 
        There are currently two known vulnerabilities in Netscape versions
        from 3.0 to 4.73:
            a) a buffer overflow in the jpeg image handling code
            b) a security flaw in Netscape's Java implementation
        a) has been fixed in Netscape version 4.74. Updated packages 
        from SuSE will follow very soon.
        Temporary fix/workaround:
            problem a) Turn off automatic image loading and do not
                       click on images to trigger the download. This may
                       be a fairly unsatisfying solution.
            problem b) Turn off Java and JavaScript.

    - ntop

        ntop is a network statistics visualization utility which offers
        graphical analysis of network traffic and other statistics with
        a web browser. By default, ntop listens on port 3000 and requires
        no or a commonly known authentication password to view the data.
        ntop is only installed in network server selections and is not 
        activated by default in SuSE Linux installations.
        The ntop packages shipped with SuSE Linux did not exhibit the 
        unsafe behaviour when a file like /../../etc/passwd is referenced.
______________________________________________________________________________

3)  standard appendix:

    SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        -   general/linux/SuSE security discussion. 
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to 
                <suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
        -   SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (faq) 
    send mail to:
        <suse-security-info@suse.com> or
        <suse-security-faq@suse.com> respectively.

    ===============================================
    SuSE's security contact is <security@suse.com>.
    ===============================================

Regards,
Roman Drahtmüller.
- -- 
 -                                                                      -
| Roman Drahtmüller      <draht@suse.de> //          "Caution: Cape does |
  SuSE GmbH - Security           Phone: //       not enable user to fly."
| Nürnberg, Germany     +49-911-740530 // (Batman Costume warning label) |
 -                                                                      -
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way.
    SuSE GmbH makes no warranties of any kind whatsoever with respect 
    to the information contained in this security advisory.

Type Bits/KeyID    Date       User ID
pub  2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4
Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS
RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W
AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf
G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B
tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw==
=DQ80
-----END PGP SIGNATURE-----


-- 
To unsubscribe, e-mail: suse-security-announce-unsubscribe@suse.com
For additional commands, e-mail: suse-security-announce-help@suse.com