|
|
suidperl is the perl interpreter for suid perl scripts, a part of the perl package. A maliciously implemented feature causes the interpreter to spawn the /bin/mail program to inform the superuser of its usage, thereby passing on untrusted environment that causes /bin/mail to execute arbitrary commands as user root.
|
|
-----BEGIN PGP SIGNED MESSAGE-----
______________________________________________________________________________
SuSE Security Announcement
Package: perl, all versions
Date: Thursday, August 10th, 2000
Affected SuSE versions: 6.0-6.4, 7.0
Vulnerability Type: local root compromise
Severity (1-10): 5
SuSE default package: yes, but not configured exploitable.
Other affected systems: all linux systems using this package
Content of this advisory:
1) security vulnerability resolved: suidperl (local root compromise)
problem description, discussion, solution and upgrade information
2) pending vulnerabilities, temporary workarounds
(Netscape)
3) standard appendix (further information)
______________________________________________________________________________
1) problem description, brief discussion, solution, upgrade information
suidperl is the perl interpreter for suid perl scripts, a part of the
perl package. A maliciously implemented feature causes the interpreter
to spawn the /bin/mail program to inform the superuser of its usage,
thereby passing on untrusted environment that causes /bin/mail to
execute arbitrary commands as user root.
SuSE distributions are not susceptible to this problem because
/usr/bin/suidperl is mode 755 (not suid) by default. Administrators
must explicitly have enabled suidperl by changing the permission modes
of the interpreter to 4755 root.root (suid root) for the exploit
mechanism to work.
In SuSE-Linux, activating suidperl is done by changing one of the
files /etc/permissions.(easy|secure) and running SuSEconfig or
`chkstat -set /etc/permissions.(easy|secure)', alternatively,
depending on the setting of PERMISSION_SECURITY in /etc/rc.config.
If SuSEconfig is turned off completely, the administrator of the
system is obliged to change the permission modes by hand.
The decision to not activate suidperl has been made because
security problems were expected in the wild.
O/S vendors have provided updated packages for both suidperl and
mailx, the package containing /bin/mail. Basically, /bin/mail's
fetures are not the origin of the security hole because the
hostile environment is passed on by the suidperl interpreter,
despite the fact that the interpreter runs suid root.
Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the
problem of this advisory if /usr/bin/suidperl is setuid root.
However, suidperl is installed with mode 755 after the
installation like in older SuSE Linux distributions and
therefore can't be exploited without prior manual activation
of suidperl by the system administrator.
SuSE provides an updated package for the vulnerable software. It is
strongly recommended to upgrade to the latest version found on our
ftp server as described below. The package removes the mail
notification and uses the syslog facility (priority warning) instead.
Chose one of the following paths to download the package from our
ftp server and install the package with the command `rpm -Fhv file.rpm'.
The md5sum for each file is in the line below.
You can verify the integrity of the rpm files using the command
`rpm --checksig --nogpg file.rpm', independently from the md5
signatures below.
i386 Intel Platform:
SuSE-7.0
ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm
01c855f752b835536403c7bcc74d8114
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm
16c850efed03cc5bd5b9bff3910dd6e4
SuSE-6.4
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm
0640e11ba0b87f0d8a01b4b5dedbb8eb
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm
a68ade45a65e73805b2276ad35266d46
SuSE-6.3
ftp://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm
7a3c2adae0c556a7ccb647eaca34e6c7
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm
6bc207d360a1349f8f8067a83061f848
SuSE-6.2
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm
6403b21d3795def485ad4a577a38c3be
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm
47760a9798dc1489ca9fd2ee3a1756f6
SuSE-6.1
ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm
ac14b4fccfb10e5465f377b095621730
source rpm:
ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm
7d3aec7879fabcac3d2b7e4996340c31
AXP Alpha Platform:
SuSE-6.4
ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm
47853649c4683748558dbb72f759d739
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm
5949a68b6126afdca98224cd6ed4be74
SuSE-6.3
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm
994804e426adf718df64162c92a1ce84
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm
879238a9e443bbe32cc4d421ed9a5d28
SuSE-6.1
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm
cf2d763fb562a75395c5e613704cbd10
source rpm:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm
e0aa5d0c91f474592e56eed2a8b3fae0
PPC Power PC Platform:
SuSE-6.4
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm
828a210ef2b3aa462161010d4d19416a
source rpm:
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm
9253498d7c474ad2e9f8dabe576d2c96
______________________________________________________________________________
2) Pending vulnerabilities in SuSE Distributions and Workarounds
This section addresses currently known vulnerabilities in Linux/Unix
systems that have not been resolved up to the release date of this
advisory.
- Netscape, versions from 3.0 to 4.73:
The latest version of Netscape is currently being tested. SuSE
Netscape rpms contain efficient workarounds against some "morbid"
properties of Netscape in order to provide stable packages.
These additions are being reworked right now.
Also, cryprographical software export regulations require us to
wait for the permission to redistribute the netscape package from
our US-American ftp server.
There are currently two known vulnerabilities in Netscape versions
from 3.0 to 4.73:
a) a buffer overflow in the jpeg image handling code
b) a security flaw in Netscape's Java implementation
a) has been fixed in Netscape version 4.74. Updated packages
from SuSE will follow very soon.
Temporary fix/workaround:
problem a) Turn off automatic image loading and do not
click on images to trigger the download. This may
be a fairly unsatisfying solution.
problem b) Turn off Java and JavaScript.
- ntop
ntop is a network statistics visualization utility which offers
graphical analysis of network traffic and other statistics with
a web browser. By default, ntop listens on port 3000 and requires
no or a commonly known authentication password to view the data.
ntop is only installed in network server selections and is not
activated by default in SuSE Linux installations.
The ntop packages shipped with SuSE Linux did not exhibit the
unsafe behaviour when a file like /../../etc/passwd is referenced.
______________________________________________________________________________
3) standard appendix:
SuSE runs two security mailing lists to which any interested party may
subscribe:
suse-security@suse.com
- general/linux/SuSE security discussion.
All SuSE security announcements are sent to this list.
To subscribe, send an email to
<suse-security-subscribe@suse.com>.
suse-security-announce@suse.com
- SuSE's announce-only mailing list.
Only SuSE's security annoucements are sent to this list.
To subscribe, send an email to
<suse-security-announce-subscribe@suse.com>.
For general information or the frequently asked questions (faq)
send mail to:
<suse-security-info@suse.com> or
<suse-security-faq@suse.com> respectively.
===============================================
SuSE's security contact is <security@suse.com>.
===============================================
Regards,
Roman Drahtmüller.
- --
- -
| Roman Drahtmüller <draht@suse.de> // "Caution: Cape does |
SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
- -
______________________________________________________________________________
The information in this advisory may be distributed or reproduced,
provided that the advisory is not modified in any way.
SuSE GmbH makes no warranties of any kind whatsoever with respect
to the information contained in this security advisory.
Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de>
- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i
mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4
Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS
RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W
AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf
G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B
tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw==
=DQ80
-----END PGP SIGNATURE-----
This archive was generated by hypermail 2.1.0
: Mon Jun 04 2001 - 18:25:14 PDT
| 
