OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
From: Daniel Ahlberg (aliz_at_gentoo.org)
Date: Wed Oct 30 2002 - 08:09:20 CST

  • Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - - --------------------------------------------------------------------
    GENTOO LINUX SECURITY ANNOUNCEMENT 200210-012
    - - --------------------------------------------------------------------

    PACKAGE : sharutils
    SUMMARY : inadequate checks on user-specified output files
    DATE    : 2002-10-30 14:10 UTC
    EXPLOIT : local

    - - --------------------------------------------------------------------

    The uudecode utility would create an output file without checking
    to see if it was about to write to a symlink or a pipe. If a
    user uses uudecode to extract data into open shared directories,
    such as /tmp, this vulnerability could be used by a local attacker
    to overwrite files or lead to privilege escalation.

    Read the full advisory at
    http://www.kb.cert.org/vuls/id/336083

    SOLUTION

    It is recommended that all Gentoo Linux users who are running
    sys-apps/sharutils-4.2.1-r5 and earlier update their systems as follows:

    emerge rsync
    emerge sharutils
    emerge clean

    - - --------------------------------------------------------------------
    alizgentoo.org - GnuPG key is available at www.gentoo.org/~aliz
    - - --------------------------------------------------------------------
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.0.7 (GNU/Linux)

    iD8DBQE9v+gPfT7nyhUpoZMRAvONAKCEtURIf7x9ywYgn5bk3bXGRgtFYwCgulgp
    pN2sMd4yQUooVdzqeu4OmNY=
    =DcXc
    -----END PGP SIGNATURE-----