-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SuSE Security Announcement

        Package:                glibc (shlibs)
        Announcement-ID:        SuSE-SA:2001:01
        Date:                   Friday, January 26th, 2001 15:40 MET
        Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
        Vulnerability Type:     local root compromise
        Severity (1-10):        6
        SuSE default package:   yes
        Other affected systems: most Linux/glibc based systems

    Content of this advisory:
        1) security vulnerability resolved: glibc
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1)  problem description, brief discussion, solution, upgrade information


    ld-linux.so.2, the dynamical linker, adds shared libraries to the
    memoryspace of a program to be started. Its flexibility allows for
    some environment variables to influence the linking process such as
    preloading shared libraries as well as defining the path in which
    the linker will search for the shared libraries. Special care must
    be exercised when runtime-linking setuid- or setgid-binaries:
    The runtime-linker must not link against user-specified libraries
    since the code therein would then run with the elevated privileges
    of the suid binary.
    The runtime-linker as used in the SuSE distributions ignores the
    content of the critical environment variables if the specified path
    begins with a slash ("/"), or if the library file name is not
    cached (eg it is contained in a path from /etc/ld.so.conf).
    However, Solar Designer has found out that even preloading glibc-
    native shared libraries can be dangerous: The code in the user-linked
    library is not aware of the fact that the binary runs with suid or
    sgid privileges. Using debugging features of the glibc (and possibly
    other features) it is possible for a local attacker to overwrite
    arbitrary files with the elevated privileges of the suid/sgid binary
    executed. This may lead to a local root compromise.

    To eliminate these problems, we provide update packages that completely
    disregard the LD_* variables upon runtime-linking of a binary that has
    an effective uid different from the caller's userid.


    Download the update package from locations desribed below and install
    the package with the command `rpm -Uhv file.rpm'. The md5sum for each
    file is in the line below. You can verify the integrity of the rpm
    files using the command
        `rpm --checksig --nogpg file.rpm',
    independently from the md5 signatures below.

    SPECIAL INSTALL INSTRUCTIONS:
    ==============================
    The glibc (the shlibs package) is an intrinsic part of the GNU/Linux
    operating system since most binary executables are dependent on
    the shared libraries from that package. For this reason, special care
    must be taken while updating the shlibs package.
    After downloading the binary rpm files, make sure that your system is
    idle by bringing it down to Single User Mode (`init 1´). If this is not
    applicable for operational reasons, then keep your machine as calm as
    possible while you perform the update. In particular, make sure that
    no shell scripts are running during the update.

    Install the package using the command
            rpm -Uhv  package-rpm-file
    Do _NOT_ interrupt the operation of the rpm command!
    After the installation, execute the commands
            ldconfig            # alternatively, use SuSEconfig
            /sbin/init u        # will restart init

    At this point, the update is done.
    On low-memory machines a reboot is advisable to free the memory that
    is used by the old memory-mapped libraries.


    Note 1:
    The upcoming SuSE-7.1 distribution is based on glibc-2.2. This
    distribution is not affected by the security problems in glibc as
    discussed in security forums.

    Note 2:
    The source rpm for the shlibs package is called "libc*.rpm".
    Multiple binary rpm packages are being generated from this source
    rpm package. These include: localedb, nssv1, shlibs, timezone.
    To get a fix for the runtime-linker related security issue (topic
    of this announcement), it is only necessary to update the shlibs
    binary rpm package.



    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/shlibs-2.1.3-190.i386.rpm
      94ccbb80d2841f08f2b7322671d6e7f3
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/libc-2.1.3-190.src.rpm
      3d15b6ffff534f0bf705882dbd8a2551

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/shlibs-2.1.3-155.i386.rpm
      bc03f1a6f32a66958128e9450e355698
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/libc-2.1.3-155.src.rpm
      e8f2aa8d32122edfbe3c436a52abb847

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/shlibs-2.1.2-48.i386.rpm
      8d572332c67b488e5d64a8d4d3274e90
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/libc-2.1.2-48.src.rpm
      8e1f861112f4a921ea4c7b5631304ee6

    SuSE-6.2
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/shlibs-2.1.1-30.i386.rpm
      b6b4cfe73e46c5b3bd5b626d68dfa584
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/libc-2.1.1-30.src.rpm
      67fcd70b40f145b5f40b86f7254e35be

    SuSE-6.1
    SuSE-6.0

    The rpm packages are being produced as this announcement is written.
    The md5sums for these rpm packages will be provided on the ftp-server,
    signed with the security@suse.de pgp key below.


    Sparc Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/shlibs-2.1.3-155.sparc.rpm
      6b000a6278366c6da4b719d2f62ad7a4
    source rpm:
    ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/libc-2.1.3-155.src.rpm
      e845606be9c9aca72213e4c5f1f32290


    AXP Alpha Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/axp/update/7.0/a1/shlibs-2.1.3-155.alpha.rpm
      2df813e3c08b52e3f914c591efc742d4
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/7.0/zq1/libc-2.1.3-155.src.rpm
      9cb7a6e5981112da6d702916d453b419

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/shlibs-2.1.3-155.alpha.rpm
      0636c2cddf131e76c19e154619a65bd8
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/libc-2.1.3-155.src.rpm
      39fd3b8e7e4054bc7a333a831e99e6fd

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/shlibs-2.1.2-48.alpha.rpm
      f9713bc945bf7f98527d2fdfbe756dfb
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/libc-2.1.2-48.src.rpm
      af2eb3df9d83f8f8ca13526046a3a539

    SuSE-6.1
    ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/shlibs-2001.1.17-0.alpha.rpm
      4a0033c4ec32ef0e79fc1b7a83692738
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/libc-2000.9.5-0.src.rpm
      11871baa8279f8c0c79f6c9d95ca531c



    PPC Power PC Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/shlibs-2.1.3-173.ppc.rpm
      8d9d27a8fba22de4df5cd4700a541ad9
    source rpm:
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/libc-2.1.3-173.src.rpm
      89946b9a2bb7c545a1761a84ebd979ab

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/shlibs-2.1.3-190.ppc.rpm
      383bb49a2f6a3e83a9c2ed3eea30dc99
    source rpm:
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/libc-2.1.3-190.src.rpm
      91ed7087165b74383cddb556abc07402




______________________________________________________________________________

2)  Pending vulnerabilities in SuSE Distributions and Workarounds:

    This announcement is followed by a sequence of more announcements
    to address the ongoing security problems as discussed in public
    security forums. In particular, there are temporary file races in
    multiple packages (we collect and address them in a single
    announcement to keep the noise low), format string bugs, as well
    as a man-in-the-middle attack in the kdesu program and a single-byte
    buffer overflow. The next announcenemts will contain more information
    on these topics.
    Please stay tuned.
______________________________________________________________________________

3)  standard appendix:

    SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        -   general/linux/SuSE security discussion.
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
        -   SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (faq)
    send mail to:
        <suse-security-info@suse.com> or
        <suse-security-faq@suse.com> respectively.

    ===============================================
    SuSE's security contact is <security@suse.com>.
    ===============================================



Regards,
Roman Drahtmüller,
SuSE Security.
 -                                                                      -
| Roman Drahtmüller      <draht@suse.de> //          "Caution: Cape does |
  SuSE GmbH - Security           Phone: //       not enable user to fly."
| Nürnberg, Germany     +49-911-740530 // (Batman Costume warning label) |
 -                                                                      -
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way.
    SuSE GmbH makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.

Type Bits/KeyID    Date       User ID
pub  2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBOnGNKney5gA9JdPZAQHwWAf+O/xaFgEnMGl1E3NqR/oC6zDB5TelVWil
7Ng4KVr1Ijwodi7CjXAOXdI1SfVt2v64IWKxjpppQdM1F9epNEFCHx2XdLCviBEo
EMC8r+KmPICRvfZJUzhJQPszXuLm7SDPTf5fsrWBcQrLnaQ+1eCBqlyCciFqLb3s
iZYaxP/NoQh18UuKUVo3lRAzwN7eZwKh4xuwRfmxdB1yBqHloquTKA+JV7kl8SV4
k3PaNO7yC1kkbltkUX/y95hKEhQazh5Il/vK0FyKMHzXYdj8y28kQJKL07Gmwaye
Sx3U7QRe9AD1e+IcfPzE6G9n1beaNhKMu+hGfyYXg+5n8lGKp/FTxw==
=bcEa
-----END PGP SIGNATURE-----


-- 
To unsubscribe, e-mail: suse-security-announce-unsubscribe@suse.com
For additional commands, e-mail: suse-security-announce-help@suse.com