SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Kdeconfig Vendors:   Caldera/SCO
Caldera OpenLinux 'kdeconfig' Package LD_LIBRARY_PATH Configuration Error May Let Local Users Obtain Elevated Privileges
SecurityTracker Alert ID:  1003935
SecurityTracker URL:  http://securitytracker.com/id/1003935
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 1 2002
Impact:   Execution of arbitrary code via local system, Root access via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to kdeconfig-20011203-2
Description:   Caldera reported a vulnerability in the kdeconfig package distributed with Caldera OpenLinux. A problem in the processing of the LD_LIBRARY_PATH environment variable may allow local users to obtain elevated privileges on the system.

It is reported that in OpenLinux 3.1.1, the startkde script will set the LD_LIBRARY_PATH environment variable to "/opt/kde2/lib:" which includes the current working directory in the library search path. This allows a local user to specify certain library files that may be invoked by a privileged application, allowing the local user to potentially execute arbitrary code with elevated privileges.

Impact:   A local user could cause a privileged application to execute arbitrary code on the system, giving the user elevated privileges on the system. This could include root level privileges.
Solution:   The vendor has released a fix.

For OpenLinux 3.1.1 Server:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

The corresponding source code package can be found at:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

The verification checksums are:

080998dc9e5fc03b7b20f3644ae8b31b RPMS/kdeconfig-20011203-2.i386.rpm
c7c9874846b6ca77678274c759ffce77 SRPMS/kdeconfig-20011203-2.src.rpm

Upgrade the affected packages with the following commands:

rpm -Fvh kdeconfig-20011203-2.i386.rpm


For OpenLinux 3.1.1 Workstation:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

The corresponding source code package can be found at:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

The verification checksums are:

080998dc9e5fc03b7b20f3644ae8b31b RPMS/kdeconfig-20011203-2.i386.rpm
c7c9874846b6ca77678274c759ffce77 SRPMS/kdeconfig-20011203-2.src.rpm

Upgrade the affected packages with the following commands:

rpm -Fvh kdeconfig-20011203-2.i386.rpm

Vendor URL:  www.calderasystems.com/support/security/ (Links to External Site)
Cause:   Configuration error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  OpenLinux Server and Workstation version 3.1.1

Message History:   None.


 Source Message Contents

Subject:  Security Update: [CSSA-2002-005.0] Linux - LD_LIBRARY_PATH problem in KDE sessions


--PNTmBPCT7hxwcZjr
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: 8bit            

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________
		   Caldera International, Inc.  Security Advisory

Subject:		Linux - LD_LIBRARY_PATH problem in KDE sessions
Advisory number: 	CSSA-2002-005.0
Issue date: 		2002, February 05
Cross reference:
______________________________________________________________________________


1. Problem Description

   In OpenLinux 3.1.1, the startkde script will set the LD_LIBRARY_PATH
   environment variable to " /opt/kde2/lib:" which includes the current
   working directory in the library search path. This exposes users to
   shared library attacks.


2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux 2.3                 not vulnerable                
   
   OpenLinux eServer 2.3.1       not vulnerable                
   and OpenLinux eBuilder                                      
   
   OpenLinux eDesktop 2.4        not vulnerable                
   
   OpenLinux Server 3.1          not vulnerable                
   
   OpenLinux Workstation 3.1     not vulnerable                
   
   OpenLinux 3.1 IA64            not vulnerable                
   
   OpenLinux Server 3.1.1        All packages previous to      
                                 kdeconfig-20011203-2          
   
   OpenLinux Workstation         All packages previous to      
   3.1.1                         kdeconfig-20011203-2          
   


3. Solution

   Workaround

     none

   The proper solution is to upgrade to the latest packages.

4. OpenLinux 2.3

    not vulnerable

5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

    not vulnerable

6. OpenLinux eDesktop 2.4

    not vulnerable

7. OpenLinux 3.1 Server

    not vulnerable

8. OpenLinux 3.1 Workstation

    not vulnerable

9. OpenLinux 3.1 IA64

    not vulnerable

10. OpenLinux 3.1.1 Server

    10.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

   10.2 Verification

       080998dc9e5fc03b7b20f3644ae8b31b  RPMS/kdeconfig-20011203-2.i386.rpm
       c7c9874846b6ca77678274c759ffce77  SRPMS/kdeconfig-20011203-2.src.rpm
       

   10.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

         rpm -Fvh kdeconfig-20011203-2.i386.rpm
         

11. OpenLinux 3.1.1 Workstation

    11.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

       The corresponding source code package can be found at:

       ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

   11.2 Verification

       080998dc9e5fc03b7b20f3644ae8b31b  RPMS/kdeconfig-20011203-2.i386.rpm
       c7c9874846b6ca77678274c759ffce77  SRPMS/kdeconfig-20011203-2.src.rpm
       

   11.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

         rpm -Fvh kdeconfig-20011203-2.i386.rpm
         


12. References

   This and other Caldera security resources are located at:

   http://www.caldera.com/support/security/index.html


13. Disclaimer

   Caldera International, Inc. is not responsible for the misuse of
   any of the information we provide on this website and/or through our
   security advisories. Our advisories are a service to our customers
   intended to promote secure installation and use of Caldera OpenLinux.
______________________________________________________________________________

--PNTmBPCT7hxwcZjr
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjyk9uwACgkQbluZssSXDTGuDgCg+XKYk9PD7pfsYnxbXLoEMjLS
9YgAoPYYd1OfnCjaX19cAjHNcT90tIh4
=RrqS
-----END PGP SIGNATURE-----

--PNTmBPCT7hxwcZjr--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC