SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Taylor UUCP Vendors:   Taylor, Ian Lance
(Red Hat Issues Fix) Taylor UUCP Input Validation Flaw Allows Local Users to Elevate Privileges
SecurityTracker Alert ID:  1003278
SecurityTracker URL:  http://securitytracker.com/id/1003278
CVE Reference:   CVE-2001-0873   (Links to External Site)
Date:  Jan 17 2002
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): uucp-1.06.1-25
Description:   A vulnerability was reported in Taylor UUCP. An argument handling flaw in a component of the Taylor UUCP package allows local users to obtain 'uucp' user and group privileges.

The uuxqt module (the UUCP execution daemon), which is designed to remove arguments that appear dangerous before execution, reportedly fails to remove long arguments. This allows a local user to cause cammands to be executed on the system with uucp privileges.

On OpenBSD 2.8 (and probably others), this reportedly indirectly allows root compromise. A local user can exploit the vulnerability to overwrite the uucp owned program /usr/bin/uustat, where arbitrary commands may be executed as part of the /etc/daily crontab script.

On Redhat 7.0 (and probably others), this reportedly indirectly allows a local user to create empty files as root execute commands as if logged in at the console.

Additional demonstration exploit information is provided in the Source Message.

Impact:   A local user can cause arbitrary commands to be executed on the system with 'uucp' user and group privileges, giving the local user 'uucp' level permissions on the system.
Solution:   The vendor has released a fix. Red Hat Linux 7.2 is not vulnerable to this bug.

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/uucp-1.06.1-31.6x.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/uucp-1.06.1-31.6x.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/uucp-1.06.1-31.6x.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/uucp-1.06.1-31.6x.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/uucp-1.06.1-31.7.1.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/uucp-1.06.1-32.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/uucp-1.06.1-32.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/uucp-1.06.1-32.ia64.rpm

The verification checksums are:

MD5 sum Package Name
--------------------------------------------------------------------------
ad99fe81ef219654509bed11a3d1d22a 6.2/en/os/SRPMS/uucp-1.06.1-31.6x.src.rpm
0f1100a60099c2c9e61dc8cfa81e8f74 6.2/en/os/alpha/uucp-1.06.1-31.6x.alpha.rpm
ca8e4e44be51262bcc942a2742b207a4 6.2/en/os/i386/uucp-1.06.1-31.6x.i386.rpm
0b3d52c4e33787746b4d22832dde9dd3 6.2/en/os/sparc/uucp-1.06.1-31.6x.sparc.rpm
315617605947efe0e7ac3f6ad7e9baac 7.0/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm
88c4667b09f2270db30e551950fe015a 7.0/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm
349267562cec736d6d24429a259cd296 7.0/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm
315617605947efe0e7ac3f6ad7e9baac 7.1/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm
88c4667b09f2270db30e551950fe015a 7.1/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm
349267562cec736d6d24429a259cd296 7.1/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm
049a28c7101a96b5a298d66fbb912237 7.1/en/os/ia64/uucp-1.06.1-31.7.1.ia64.rpm
8bc3e57f6436af2ea372712532580442 7.2/en/os/SRPMS/uucp-1.06.1-32.src.rpm
57c87d55396721e910fe89cf43bacac1 7.2/en/os/i386/uucp-1.06.1-32.i386.rpm
705756177aaf2719da845e666175c8b4 7.2/en/os/ia64/uucp-1.06.1-32.ia64.rpm

See the Source Message for the vendor's advisory containing directions on how to apply the appropriate fix.

Vendor URL:  www.airs.com/ian/ (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Red Hat Linux)

Message History:   This archive entry is a follow-up to the message listed below.
Sep 8 2001 Taylor UUCP Input Validation Flaw Allows Local Users to Elevate Privileges



 Source Message Contents

Subject:  [RHSA-2001:165-08] The uuxqt utility can be used to execute arbitrary commands as uucp.uucp


---------------------------------------------------------------------
                   Red Hat, Inc. Red Hat Security Advisory

Synopsis:          The uuxqt utility can be used to execute arbitrary commands as uucp.uucp
Advisory ID:       RHSA-2001:165-08
Issue date:        2001-12-06
Updated on:        2002-01-15
Product:           Red Hat Linux
Keywords:          uucp exploit uuxqt
Cross references:  
Obsoletes:         
---------------------------------------------------------------------

1. Topic:

uuxqt in Taylor UUCP package does not properly remove dangerous long
options, which allows local users to gain uid and gid uucp privileges by 
calling uux and specifying an alternate configuration file with the
--config option.

2. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc

Red Hat Linux 7.0 - alpha, i386

Red Hat Linux 7.1 - alpha, i386, ia64

Red Hat Linux 7.2 - i386, ia64

3. Problem description:

Please note Red Hat Linux 7.2 is not vulnerable to this bug.

Please also note that Red Hat Linux 7.2 uses a different locking scheme to
previous versions, and so the 7.2 packages should not be applied to Red Hat
Linux 7.0 or 7.1 systems.  Use the packages from this errata instead.

Conversely, the packages from this errata should not be applied to
a Red Hat Linux 7.2 system

The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2001-0873 to this issue.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade.  Only those
RPMs which are currently installed will be updated.  Those RPMs which are
not installed but included in the list will not be updated.  Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the
desired RPMs.

Please note that this update is also available via Red Hat Network.  Many
people find this an easier way to apply updates.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):



6. RPMs required:

Red Hat Linux 6.2:

SRPMS:
ftp://updates.redhat.com/6.2/en/os/SRPMS/uucp-1.06.1-31.6x.src.rpm

alpha:
ftp://updates.redhat.com/6.2/en/os/alpha/uucp-1.06.1-31.6x.alpha.rpm

i386:
ftp://updates.redhat.com/6.2/en/os/i386/uucp-1.06.1-31.6x.i386.rpm

sparc:
ftp://updates.redhat.com/6.2/en/os/sparc/uucp-1.06.1-31.6x.sparc.rpm

Red Hat Linux 7.0:

SRPMS:
ftp://updates.redhat.com/7.0/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm

alpha:
ftp://updates.redhat.com/7.0/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm

i386:
ftp://updates.redhat.com/7.0/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm

Red Hat Linux 7.1:

SRPMS:
ftp://updates.redhat.com/7.1/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm

alpha:
ftp://updates.redhat.com/7.1/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm

i386:
ftp://updates.redhat.com/7.1/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm

ia64:
ftp://updates.redhat.com/7.1/en/os/ia64/uucp-1.06.1-31.7.1.ia64.rpm

Red Hat Linux 7.2:

SRPMS:
ftp://updates.redhat.com/7.2/en/os/SRPMS/uucp-1.06.1-32.src.rpm

i386:
ftp://updates.redhat.com/7.2/en/os/i386/uucp-1.06.1-32.i386.rpm

ia64:
ftp://updates.redhat.com/7.2/en/os/ia64/uucp-1.06.1-32.ia64.rpm



7. Verification:

MD5 sum                          Package Name
--------------------------------------------------------------------------
ad99fe81ef219654509bed11a3d1d22a 6.2/en/os/SRPMS/uucp-1.06.1-31.6x.src.rpm
0f1100a60099c2c9e61dc8cfa81e8f74 6.2/en/os/alpha/uucp-1.06.1-31.6x.alpha.rpm
ca8e4e44be51262bcc942a2742b207a4 6.2/en/os/i386/uucp-1.06.1-31.6x.i386.rpm
0b3d52c4e33787746b4d22832dde9dd3 6.2/en/os/sparc/uucp-1.06.1-31.6x.sparc.rpm
315617605947efe0e7ac3f6ad7e9baac 7.0/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm
88c4667b09f2270db30e551950fe015a 7.0/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm
349267562cec736d6d24429a259cd296 7.0/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm
315617605947efe0e7ac3f6ad7e9baac 7.1/en/os/SRPMS/uucp-1.06.1-31.7.1.src.rpm
88c4667b09f2270db30e551950fe015a 7.1/en/os/alpha/uucp-1.06.1-31.7.1.alpha.rpm
349267562cec736d6d24429a259cd296 7.1/en/os/i386/uucp-1.06.1-31.7.1.i386.rpm
049a28c7101a96b5a298d66fbb912237 7.1/en/os/ia64/uucp-1.06.1-31.7.1.ia64.rpm
8bc3e57f6436af2ea372712532580442 7.2/en/os/SRPMS/uucp-1.06.1-32.src.rpm
57c87d55396721e910fe89cf43bacac1 7.2/en/os/i386/uucp-1.06.1-32.i386.rpm
705756177aaf2719da845e666175c8b4 7.2/en/os/ia64/uucp-1.06.1-32.ia64.rpm
 

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
    http://www.redhat.com/about/contact/pgpkey.html

You can verify each package with the following command:
    rpm --checksig  <filename>

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg <filename>

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0873
http://www.securityfocus.com/bid/3312


Copyright(c) 2000, 2001, 2002 Red Hat, Inc.



_______________________________________________
Redhat-watch-list mailing list
To unsubscribe, visit: https://listman.redhat.com/mailman/listinfo/redhat-watch-list

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC