SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Generic)  >   Fileutils (GNU) Vendors:   [Multiple Authors/Vendors]
(Caldera Issues Revised Fix for OpenLinux) GNU Fileutils Package Race Condition May Allow Local Users to Cause a Root User to Remove the Entire Filesystem
SecurityTracker Alert ID:  1004293
SecurityTracker URL:  http://securitytracker.com/id/1004293
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 15 2002
Impact:   Denial of service via local system, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.1 stable and 4.1.6 development version
Description:   A race condition vulnerability was reported in the GNU Fileutils package. A local user may be able to cause the entire filesystem to be removed by a root level user when the root user attempts to remove another directory (under certain conditions).

It is reported that a race condition exists in several components of the GNU fileutils package that may allow a local user to cause the root user to delete the entire filesystem.

According to the report, an insecure chdir("..") syscall is performed after removing the content of a subdirectory in order to get back to the upper directory during recursive removal of directory tree.

Condsider the following example of 'rm -fr /tmp/a' removing '/tmp/a/b/c' directory tree:

(strace output simplified for better readability)

chdir("/tmp/a") = 0
chdir("b") = 0
chdir("c") = 0
chdir("..") = 0
rmdir("c") = 0
chdir("..") = 0
rmdir("b") = 0
fchdir(3) = 0
rmdir("/tmp/a") = 0

In the above example, the race condition occurs after the current directory is changed to /tmp/a/b/c. If a local user then moves the /tmp/a/b/c directory to the /tmp/c directory, the two subsequent chdir("..") syscalls will apparently change to the root directory / and then rm will start removing files from the entire file system (if the calling user has sufficient privileges).
Impact:   A local user may be able to cause the entire filesystem to be removed by a root level user when the root user attempts to remove another directory (under certain conditions).
Solution:   Caldera has released a revised fix that resolves a problem in the original fix that would cause an attempt to recursively remove a directory with trailing slashes to memory fault.

For OpenLinux 3.1.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

Packages:

d01d42d41800d0b9c1d02c4fec07a79d fileutils-4.1-5.i386.rpm

To install:

rpm -Fvh fileutils-4.1-5.i386.rpm

For Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

Source Packages:

ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm


For OpenLinux 3.1.1 Workstation:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

Packages:

993d932af015edb5ad6e4d70db171492 fileutils-4.1-5.i386.rpm

To install:

rpm -Fvh fileutils-4.1-5.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

Source Packages:

ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm


For OpenLinux 3.1 Server:

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

Packages:

79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm

To install:

rpm -Fvh fileutils-4.1-5.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

Source Packages:

238ad9663d26b196eea92874a96b1c53 fileutils-4.1-5.src.rpm


For OpenLinux 3.1 Workstation

Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

Packages:

79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm

To install:

rpm -Fvh fileutils-4.1-5.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

Source Packages:

01a126030929e44c83a473ee662fecb9 fileutils-4.1-5.src.rpm
Vendor URL:  www.gnu.org/software/fileutils/fileutils.html (Links to External Site)
Cause:   State error
Underlying OS:   Linux (Caldera/SCO)

Message History:   This archive entry is a follow-up to the message listed below.
Mar 12 2002 GNU Fileutils Package Race Condition May Allow Local Users to Cause a Root User to Remove the Entire Filesystem


 Source Message Contents
Date:  Tue, 14 May 2002 13:28:29 -0700
Subject:  Security Update: [CSSA-2002-018.1] Linux: REVISED: Race condition in fileutils


--zYM0uCDKw75PZbzx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: REVISED: Race condition in fileutils
Advisory number: 	CSSA-2002-018.1
Issue date: 		2002 May 13
Cross reference:
______________________________________________________________________________


1. Problem Description

	A race condition in various utilities from the GNU fileutils
	package may cause a root user to delete the whole filesystem.

	This updates resolves a problem in the original fix that would
	cause an attempt to recursively remove a directory with
	trailing slashes to memory fault.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1 Server		prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1 Workstation	prior to fileutils-4.1-5.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	d01d42d41800d0b9c1d02c4fec07a79d	fileutils-4.1-5.i386.rpm

	4.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	ccb5269147321f8db75cf6f4758161bd	fileutils-4.1-5.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	993d932af015edb5ad6e4d70db171492	fileutils-4.1-5.i386.rpm

	5.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	ccb5269147321f8db75cf6f4758161bd	fileutils-4.1-5.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	79671c826786c29d2849fe14de4f79f1	fileutils-4.1-5.i386.rpm

	6.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	238ad9663d26b196eea92874a96b1c53	fileutils-4.1-5.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	79671c826786c29d2849fe14de4f79f1	fileutils-4.1-5.i386.rpm

	7.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	01a126030929e44c83a473ee662fecb9	fileutils-4.1-5.src.rpm


8. References

	Specific references for this advisory:

		http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html
		http://isec.pl/vulnerabilities/0002.txt

	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	This security fix closes Caldera incidents sr862917, fz520627,
	erg712018.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	Caldera would like to thank Vincent Danen at Mandrake
	for alerting us to the problems with the original fix.

	Wojciech Purczynski (iSEC Security Research, http://isec.pl)
	reported this vulnerability.

______________________________________________________________________________


--zYM0uCDKw75PZbzx
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjzhc20ACgkQbluZssSXDTHGSQCfbXNoVb8C99r92obDYevNMGtg
0TQAoIT5OPdottTSj6SIp4UiAArJtX+o
=eXHQ
-----END PGP SIGNATURE-----

--zYM0uCDKw75PZbzx--


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2013, SecurityGlobal.net LLC