SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Dtlogin Vendors:   Caldera/SCO
(Caldera Issues Fix) Caldera UnixWare Dtlogin Utility Error File Permission Flaw Lets Local Users Overwrite Critical Files on the Server and May Allow a Local Users to Obtain Elevated Privileges
SecurityTracker Alert ID:  1004248
SecurityTracker URL:  http://securitytracker.com/id/1004248
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  May 8 2002
Impact:   Modification of system information, Modification of user information, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A vulnerability was reported in Caldera's (SCO) UnixWare dtlogin utility. A local user may be able to cause files on the host to be overwritten.

It was originally reported that Dtlogin apparently writes error log entries to the file /var/dt/Xerrors. The default configuration permissions on /var/dt are '777' (global read, write, and execute). As a result, a remote user can create a symbolic link (symlink) from /var/dt/Xerrors to a critical file and then use dtlogin in a manner that will create an error condition to cause the dtlogin process to write error log entries to the linked file.

Caldera reports that this was caused by the dt/config/Xsession.d/0030.dttmpdir script, which was creating the following dt directories with 0777 perms:

/var/dt/
/var/dt/appconfig
/var/dt/appconfig/appmanager
/var/dt/tmp

In addition, Caldera states that libDtLogin.so was checking the permissions of /var/dt and, if found to be other than 0777, was changing them back to 0777.

Impact:   A local user may be able to cause critical files to be overwritten, possibly with user-specified data. It may be possible for the local user to obtain elevated privileges, but that has not been confirmed.
Solution:   The vendor has released a fix.

For Open UNIX 8.0.0:

Location of Fixed Binaries:

ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.18

The verification checksum is:

MD5 (erg711939.pkg.Z) = 513c98dedb5d2cff437e0e330e96d94e

Upgrade the affected binaries with the following commands:

Download erg711939.pkg.Z to the /var/spool/pkg directory

# uncompress /var/spool/pkg/erg711939.pkg.Z
# pkgadd -d /var/spool/pkg/erg711939.pkg


For UnixWare 7.1.1:

Location of Fixed Binaries:

ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.18

The verification checksum is:

MD5 (erg711939.pkg.Z) = 513c98dedb5d2cff437e0e330e96d94e

Upgrade the affected binaries with the following commands:

Download erg711939.pkg.Z to the /var/spool/pkg directory

# uncompress /var/spool/pkg/erg711939.pkg.Z
# pkgadd -d /var/spool/pkg/erg711939.pkg

Vendor URL:  www.caldera.com/ (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  UNIX (Open UNIX-SCO)
Underlying OS Comments:  7.1.1, 8.0.0

Message History:   This archive entry is a follow-up to the message listed below.
Jan 11 2002 Caldera UnixWare Dtlogin Utility Error File Permission Flaw Lets Local Users Overwrite Critical Files on the Server and May Allow a Local Users to Obtain Elevated Privileges



 Source Message Contents

Subject:  Security Update: [CSSA-2002-SCO.18] Open UNIX 8.0.0 UnixWare 7.1.1 : CDE /var/dt and subdirectories are writable by world



To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Open UNIX 8.0.0 UnixWare 7.1.1 : CDE /var/dt and subdirectories are writable by world
Advisory number: 	CSSA-2002-SCO.18
Issue date: 		2002 May 08
Cross reference:
______________________________________________________________________________


1. Problem Description

	 The dt/config/Xsession.d/0030.dttmpdir script was creating
	 the following dt directories with 0777 perms:

	 	/var/dt/
		/var/dt/appconfig
		/var/dt/appconfig/appmanager
		/var/dt/tmp

	 In addition, libDtLogin.so was checking the permissions of
	 /var/dt. If found to be other than 0777, it was changing them
	 back to 0777.

	 This update fixes the above problems, and also changes the
	 permissions of the offending directories on the system to
	 close the vulnerability.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	Open UNIX 8.0.0			/usr/dt/config/Xsession.d/0030.dttmpdir
					/usr/dt/lib/libDtLogin.so.1

	UnixWare 7.1.1			/usr/dt/config/Xsession.d/0030.dttmpdir
					/usr/dt/lib/libDtLogin.so.1

3. Solution

	The proper solution is to install the latest packages.


4. Open UNIX 8.0.0

	4.1 Location of Fixed Binaries

	ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.18


	4.2 Verification

	MD5 (erg711939.pkg.Z) = 513c98dedb5d2cff437e0e330e96d94e

	md5 is available for download from
		ftp://stage.caldera.com/pub/security/tools/


	4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	Download erg711939.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg711939.pkg.Z
	# pkgadd -d /var/spool/pkg/erg711939.pkg


5. UnixWare 7.1.1

	5.1 Location of Fixed Binaries

	ftp://stage.caldera.com/pub/security/openunix/CSSA-2002-SCO.18


	5.2 Verification

	MD5 (erg711939.pkg.Z) = 513c98dedb5d2cff437e0e330e96d94e

	md5 is available for download from
		ftp://stage.caldera.com/pub/security/tools/


	5.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	Download erg711939.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg711939.pkg.Z
	# pkgadd -d /var/spool/pkg/erg711939.pkg


6. References

	Specific references for this advisory:
		none

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr858543, fz519804
	and erg711939.


7. Disclaimer

	Caldera International, Inc. is not responsible for the
	misuse of any of the information we provide on this website
	and/or through our security advisories. Our advisories are
	a service to our customers intended to promote secure
	installation and use of Caldera products.


8. Acknowledgements

	Caldera wishes to thank jGgM (jggm@mail.com) for discovering
	and researching this vulnerability.

______________________________________________________________________________




 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC