SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Fileutils (GNU) Vendors:   [Multiple Authors/Vendors]
(Caldera Issues Fix for OpenLinux) Re: GNU Fileutils Package Race Condition May Allow Local Users to Cause a Root User to Remove the Entire Filesystem
SecurityTracker Alert ID:  1004183
SecurityTracker URL:  http://securitytracker.com/id/1004183
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Apr 30 2002
Impact:   Denial of service via local system, Modification of system information, Modification of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 4.1 stable and 4.1.6 development version
Description:   A race condition vulnerability was reported in the GNU Fileutils package. A local user may be able to cause the entire filesystem to be removed by a root level user when the root user attempts to remove another directory (under certain conditions).

It is reported that a race condition exists in several components of the GNU fileutils package that may allow a local user to cause the root user to delete the entire filesystem.

According to the report, an insecure chdir("..") syscall is performed after removing the content of a subdirectory in order to get back to the upper directory during recursive removal of directory tree.

Condsider the following example of 'rm -fr /tmp/a' removing '/tmp/a/b/c' directory tree:

(strace output simplified for better readability)

chdir("/tmp/a") = 0
chdir("b") = 0
chdir("c") = 0
chdir("..") = 0
rmdir("c") = 0
chdir("..") = 0
rmdir("b") = 0
fchdir(3) = 0
rmdir("/tmp/a") = 0

In the above example, the race condition occurs after the current directory is changed to /tmp/a/b/c. If a local user then moves the /tmp/a/b/c directory to the /tmp/c directory, the two subsequent chdir("..") syscalls will apparently change to the root directory / and then rm will start removing files from the entire file system (if the calling user has sufficient privileges).

Impact:   A local user may be able to cause the entire filesystem to be removed by a root level user when the root user attempts to remove another directory (under certain conditions).
Solution:   The vendor has issued a fix for OpenLinux Server and Workstation 3.1 and 3.1.1.

For OpenLinux 3.1.1 Server:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

Packages:

608a5485dd9a8799795254ba7d2089da fileutils-4.1-4.i386.rpm

To install:

rpm -Fvh fileutils-4.1-4.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

Source Packages:

c44a43f1ce810a01978ce2e8efadadbf fileutils-4.1-4.src.rpm


For OpenLinux 3.1.1 Workstation:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

Packages:

f10c905587b4221fc794cefaf262e9ee fileutils-4.1-4.i386.rpm

To install:

rpm -Fvh fileutils-4.1-4.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

Source Packages:

7e5519acdca5c17d12b3598847ec1ded fileutils-4.1-4.src.rpm


For OpenLinux 3.1 Server:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

Packages:

334154c1635b50ad81a2f1b841ccadd8 fileutils-4.1-4.i386.rpm

To install:

rpm -Fvh fileutils-4.1-4.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

Source Packages:

6a12bbcaefb252eac3fe4b79464881e4 fileutils-4.1-4.src.rpm


For OpenLinux 3.1 Workstation:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

Packages:

2db4e5565fc7d38ee5cdf3be57f86301 fileutils-4.1-4.i386.rpm

To install:

rpm -Fvh fileutils-4.1-4.i386.rpm

Source Package Location:

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

Source Packages:

1b5ef3933f229b68cd8e24fb75c5a0de fileutils-4.1-4.src.rpm

Vendor URL:  www.gnu.org/software/fileutils/fileutils.html (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Caldera/SCO)
Underlying OS Comments:  3.1, 3.1.1; OpenLinux Server and Workstation

Message History:   This archive entry is a follow-up to the message listed below.
Mar 12 2002 GNU Fileutils Package Race Condition May Allow Local Users to Cause a Root User to Remove the Entire Filesystem



 Source Message Contents

Subject:  Security Update: [CSSA-2002-018.0] Linux: Race condition in fileutils


--Kj7319i9nmIyA2yE
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: 8bit            

To: bugtraq@securityfocus.com announce@lists.caldera.com security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: Race condition in fileutils
Advisory number: 	CSSA-2002-018.0
Issue date: 		2002 April 26
Cross reference:
______________________________________________________________________________


1. Problem Description

	A race condition in various utilities from the GNU fileutils
	package may cause a root user to delete the whole filesystem.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to fileutils-4.1-4.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to fileutils-4.1-4.i386.rpm

	OpenLinux 3.1 Server		prior to fileutils-4.1-4.i386.rpm

	OpenLinux 3.1 Workstation	prior to fileutils-4.1-4.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	608a5485dd9a8799795254ba7d2089da	fileutils-4.1-4.i386.rpm

	4.3 Installation

	rpm -Fvh fileutils-4.1-4.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	c44a43f1ce810a01978ce2e8efadadbf	fileutils-4.1-4.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	f10c905587b4221fc794cefaf262e9ee	fileutils-4.1-4.i386.rpm

	5.3 Installation

	rpm -Fvh fileutils-4.1-4.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	7e5519acdca5c17d12b3598847ec1ded	fileutils-4.1-4.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	334154c1635b50ad81a2f1b841ccadd8	fileutils-4.1-4.i386.rpm

	6.3 Installation

	rpm -Fvh fileutils-4.1-4.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	6a12bbcaefb252eac3fe4b79464881e4	fileutils-4.1-4.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	2db4e5565fc7d38ee5cdf3be57f86301	fileutils-4.1-4.i386.rpm

	7.3 Installation

	rpm -Fvh fileutils-4.1-4.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	1b5ef3933f229b68cd8e24fb75c5a0de	fileutils-4.1-4.src.rpm


8. References

	Specific references for this advisory:

		http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html
		http://isec.pl/vulnerabilities/0002.txt Wojciech Purczynski (iSEC

	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	This security fix closes Caldera incidents sr862917, fz520627,
	erg712018.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	Wojciech Purczynski (iSEC Security Research, http://isec.pl)
	reported this vulnerability. 

______________________________________________________________________________

--Kj7319i9nmIyA2yE
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjzNzT4ACgkQbluZssSXDTFQiwCcCoAwLbU87GDlzBYSOfx3d1Do
J6sAoJw6pyluJ2wrIadDzOCy/o7b5uWC
=Mpr+
-----END PGP SIGNATURE-----

--Kj7319i9nmIyA2yE--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC