-----BEGIN PGP SIGNED MESSAGE----- Subject: Caldera Security Advisory SA-1997.32: Vulnerability in svgalib 1.2.10 Original report date: 09-Jun-1997 RPM build date: 12-Dec-1997 Advisory issue date: 17-Dec-1997 Topic: Vulnerability in svgalib 1.2.10 which can be exploited with zgv. I. Problem Description Svgalib 1.2.10 and below do not properly revoke privileges, and through the use of saved user ids, any SUID svgalib application may be vulnerable to a buffer overrun attack. II. Impact There is a potential to exploit the bug in svgalib with any svgalib application which is SUID. With zgv consequences are minimal as only users having access to the console can exploit svgalib in this way. This problem was present on the following OpenLinux releases: CND 1.0 Base 1.0 Lite 1.1 Base 1.1 Standard 1.1 To determine if you are affected and need this update you may do the following: rpm -q svgalib If the results do not show svgalib-1.2.11-1 or later then you are vulnerable. CND 1.0 installations: Please note that the following operations require prior installation of the RPM update at: ftp://ftp.caldera.com/pub/cnd-1.0/updates/rpm-update.README III. Solution The solution to this problem requires installation of svgalib 1.2.11 or later. New svgalib files files are located on Caldera's FTP server: ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/RPMS/ The source RPM can be found at: ftp://ftp.caldera.com/pub/openlinux/updates/1.1/current/SRPMS/ The MD5 checksums are: d775be876ce6c5211dc70f63f5ced912 svgalib-1.2.11-2.i386.rpm fb5db17f57e8ee520b908af6224b0912 svgalib-1.2.11-2.src.rpm ca4286fa0363a928285895cd52c516ad svgalib-devel-1.2.11-2.i386.rpm 87de042314d761ced8673df27c554e52 svgalib-devel-static-1.2.11-2.i386.rpm The only required file is svgalib-1.2.11-2.i386.rpm. The installation can be done with the following command. rpm -U svgalib-1.2.11-2.i386.rpm CND 1.0 installations: Please note that the preceding operations require prior installation of the RPM update described in: ftp://ftp.caldera.com/pub/cnd-1.0/updates/rpm-upgrade.README IV. References / Credits This advisory is based on KSR[T] Advisory #001 found at: http://www.dec.net/ksrt/ Also posted on the BUGTRAQ email list: From: ksrt To: BUGTRAQ@netspace.org Subject: svgalib/zgv Date: Thu, 19 Jun 1997 14:15:42 -0700 Message-ID: This and other Caldera security resources are located at: http://www.caldera.com/tech-ref/security/ This security alert closes Caldera's internal problem report #825. V. PGP Signature This message was signed with the PGP key for . This key can be obtained from: ftp://ftp.caldera.com/pub/pgp-keys/ Or on an OpenLinux CDROM under: /OpenLinux/pgp-keys/ $Id: SA-1997.32,v 1.2 1997/12/18 22:49:42 ron Exp $ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNJmoxun+9R4958LpAQE/sQP+M3GElY1R4QqACXV3vo69Cgwy7QBzUkHd 6mR1P3Zb2AGn8abrPX9kFOmzwJkZYbr9O7K8ZQwUsDeHUm9ySSgOBtsiS+oHsOw4 ey5IafxVNk40iW14nGuZFPyOlKx3C5NGe9rzh8LHJHb9LGoFIIBNQJFMx75vAjru 4RiouAmiylA= =AzHA -----END PGP SIGNATURE-----