Security Update: [CSSA-2002-048.0] Linux: wwwoffled remote access vulnerability

[security () caldera com]

To: bugtraq () securityfocus com announce () lists caldera com security-alerts () linuxsecurity com full-disclosure () 
lists netsys com


______________________________________________________________________________

                        SCO Security Advisory

Subject:                Linux: wwwoffled remote access vulnerability 
Advisory number:        CSSA-2002-048.0
Issue date:             2002 November 18
Cross reference:
______________________________________________________________________________


1. Problem Description

        wwwoffled allows remote attackers to cause a denial of service
        and possibly execute arbitrary code via a negative Content-Length
        value.


2. Vulnerable Supported Versions

        System                          Package
        ----------------------------------------------------------------------

        OpenLinux 3.1.1 Workstation     prior to wwwoffle-2.6b-3MR.i386.rpm

        OpenLinux 3.1 Workstation       prior to wwwoffle-2.6b-3MR.i386.rpm


3. Solution

        The proper solution is to install the latest packages. Many
        customers find it easier to use the Caldera System Updater, called
        cupdate (or kcupdate under the KDE environment), to update these
        packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Workstation

        4.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-048.0/RPMS

        4.2 Packages

        d54de95d9db4d19501e6b50ef63f2e31        wwwoffle-2.6b-3MR.i386.rpm

        4.3 Installation

        rpm -Fvh wwwoffle-2.6b-3MR.i386.rpm

        4.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-048.0/SRPMS

        4.5 Source Packages

        1e8f25979fdc99dc6b3652927fa1a98a        wwwoffle-2.6b-3MR.src.rpm


5. OpenLinux 3.1 Workstation

        5.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-048.0/RPMS

        5.2 Packages

        c75848533ab650ef06bb7910eca73946        wwwoffle-2.6b-3MR.i386.rpm

        5.3 Installation

        rpm -Fvh wwwoffle-2.6b-3MR.i386.rpm

        5.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-048.0/SRPMS

        5.5 Source Packages

        9b8e3cf1987bc4d08cf9782eea2e2c9e        wwwoffle-2.6b-3MR.src.rpm


6. References

        Specific references for this advisory:
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0818

        SCO security resources:
                http://www.sco.com/support/security/index.html

        This security fix closes SCO incidents sr867510, fz525781,
        erg501645.


7. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers intended
        to promote secure installation and use of SCO products.

______________________________________________________________________________

Attachment: _bin
Description: