OpenLinux: slocate local user buffer overflow

[please_reply_to_security () sco com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SCO Security Advisory

Subject:                OpenLinux: slocate local user buffer overflow
Advisory number:        CSSA-2004-001.0
Issue date:             2004 February 10
Cross reference:        sr886033 fz528414 erg712456
______________________________________________________________________________


1. Problem Description

        Heap-based buffer overflow in main.c of slocate 2.6, and possibly
        other versions, may allow local users to gain privileges via a
        modified slocate database that causes a negative "pathlen" value
        to be used. The Common Vulnerabilities and Exposures project
        (cve.mitre.org) has assigned the name CAN-2003-0848 to this issue.


2. Vulnerable Supported Versions

        System                          Package
        ----------------------------------------------------------------------
        OpenLinux 3.1.1 Server          prior to slocate-2.7-1.i386.rpm
        OpenLinux 3.1.1 Workstation     prior to slocate-2.7-1.i386.rpm


3. Solution

        The proper solution is to install the latest packages. Many
        customers find it easier to use the Caldera System Updater, called
        cupdate (or kcupdate under the KDE environment), to update these
        packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

        4.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/RPMS

        4.2 Packages

        fd4e0b81e27fd236fcf0e34c28dcca2c        slocate-2.7-1.i386.rpm

        4.3 Installation

        rpm -Fvh slocate-2.7-1.i386.rpm

        4.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-001.0/SRPMS

        4.5 Source Packages

        3a2adce6e30bdcba92fe6a7f70216461        slocate-2.7-1.src.rpm


5. OpenLinux 3.1.1 Workstation

        5.1 Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/RPMS

        5.2 Packages

        44f7234c2a58efada5512157bc421d78        slocate-2.7-1.i386.rpm

        5.3 Installation

        rpm -Fvh slocate-2.7-1.i386.rpm

        5.4 Source Package Location

        ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-001.0/SRPMS

        5.5 Source Packages

        e2f70c80ae832d1267ce22e62ea90d15        slocate-2.7-1.src.rpm


6. References

        Specific references for this advisory:
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0848
                http://marc.theaimsgroup.com/?l=bugtraq&m=106546447321274&w=2
                http://marc.theaimsgroup.com/?l=bugtraq&m=106589631819348&w=2
                http://www.ebitech.sk/patrik/SA/SA-20031006.txt
                http://www.ebitech.sk/patrik/SA/SA-20031006-A.txt

        SCO security resources:
                http://www.sco.com/support/security/index.html

        This security fix closes SCO incidents sr886033 fz528414
        erg712456.


7. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers intended
        to promote secure installation and use of SCO products.


8. Acknowledgements

        SCO would like to thank Patrik Hornik

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFAKY0fbluZssSXDTERAu6rAKC+SIPACchxNJ579hYlNnXz9jEOQwCg5w+c
DU21bhDCYBuhyJTHWipdffw=
=vPHf
-----END PGP SIGNATURE-----