Date: Sun, 28 Mar 1999 23:20:58 +0200 From: Marc Heuse To: BUGTRAQ@netspace.org Subject: SuSE Security Announcement - XFree86 -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ SuSE Security Announcement Package: xf86-3.3.3-5 Date: Sun Mar 28 12:26:39 CEST 1999 Affected: unix operating systems using xfree86 ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Thanks to the people from bugtraq for providing the details of this vulnerability and especially the XFree86 programmers who made a fix ready over the weekend. Please note, that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. ______________________________________________________________________________ 1. Problem Description XFree86 creates a directory in /tmp with the name .X11-unix for the X sockets and sets the directory to mode 1777. If an attacker creates a symlink with that filename and points it to another directory (e.g. /root), the permissions of the target directory is set to 1777. 2. Impact A local attacker may create files with any contents in any directory. 3. Solution Upgrade your XF86. As a temporary fix you can put these commands into /sbin/init.d/boot.local: /bin/rm -rf /tmp/.X11-unix mkdir -p -m 1777 /tmp/.X11-unix ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: glibc archives (SuSE 6.0): d2bb4132bc487debea45288f8199e1e7 x8514-3.3.3.1-13.i386.rpm 5f5b6a53027d54cb9df4cafcb284d720 xagx-3.3.3.1-13.i386.rpm 0c651985aa39750ed787df42c9dc49f7 xfbdev-3.3.3.1-13.i386.rpm 7353be5812375a350c7499e4bb4f7781 xglint-3.3.3.1-13.i386.rpm 88182f0e22ed3f4f564d0f678dc37ffe xi128-3.3.3.1-13.i386.rpm 492ddd01dd10dcb83d2cbf5995b7396b xlkit-3.3.3.1-13.i386.rpm 5779042312519b30e214d8aa4b9c2313 xmach32-3.3.3.1-13.i386.rpm 9fee0e2a4bcf4fbaa91759bc004faf88 xmach64-3.3.3.1-13.i386.rpm 338041da9001b5e36c55f9ffa6209613 xmach8-3.3.3.1-13.i386.rpm 68124d6e36cc48396aad4e395cb9567b xmono-3.3.3.1-13.i386.rpm ea4c0301ee8f33339f5908d82a4b271d xp9k-3.3.3.1-13.i386.rpm d219a182a79723b258b28f87bc22ee68 xs3-3.3.3.1-13.i386.rpm d8ad0f9b0d57f887cc076e794a749738 xs3v-3.3.3.1-13.i386.rpm ff0c37343e5bd30261ab7f05604ea6e7 xsvga-3.3.3.1-13.i386.rpm e151bf1ed2d6c9824b2c521dcf2f7141 xvga16-3.3.3.1-13.i386.rpm 9099ebe5428098f8ffacd1ab691b5937 xw32-3.3.3.1-13.i386.rpm 5627fc4da2eab1f56a9e636374982ede xxprt-3.3.3.1-13.i386.rpm libc5 archives (SuSE <= 5.3): cfe392df95404f0a223b8c983ee51ce1 x8514-3.3.3.1-13.i386.rpm 4fd3a27e24b6947ef62231cc4b5630dd xagx-3.3.3.1-13.i386.rpm 71e1f6bef32e321b997db67d87c3c20a xdevel-3.3.3.1-13.i386.rpm 944e63a37139bcaeffcfa85010567d39 xdoc-3.3.3.1-13.i386.rpm 0a6a5de750c11bf35b01744319abfd01 xextra-3.3.3.1-13.i386.rpm 324a7e56c0a46685fb26b802167d79d5 xf86-3.3.3.1-13.i386.rpm a8a337baf2a85195e981eca2eaf3c855 xfbdev-3.3.3.1-13.i386.rpm 67a410a1c051eb70fa3e59935b50ec75 xfnt100-3.3.3.1-13.i386.rpm 436ce9d44dd875235d5ffd6eb0d5d07c xfntbig-3.3.3.1-13.i386.rpm 21ce9773f7782680bd1142c884c5e77b xfntcyr-3.3.3.1-13.i386.rpm 0e04aed9a681d142a4a912d365e57471 xfntscl-3.3.3.1-13.i386.rpm 12ffe00734e870c0a9a54fe87b13406b xfsetup-3.3.3.1-13.i386.rpm 289216e84448c380341f44796e8e1338 xglint-3.3.3.1-13.i386.rpm 43b1a9da5447b4ac7eac5d2f1501b313 xi128-3.3.3.1-13.i386.rpm 6626e4404dc0d7bc2f88b3b83f8ce136 xlkit-3.3.3.1-13.i386.rpm ab461815a023185f6266d9901e92b6b8 xmach32-3.3.3.1-13.i386.rpm bf28d6eb8bd8a9a4b37e5fe0b71c4597 xmach64-3.3.3.1-13.i386.rpm b07d322b63b4dc1f0810612907caaaa0 xmach8-3.3.3.1-13.i386.rpm 7a56420b929cb1b3e8507d9b3b36b287 xman-3.3.3.1-13.i386.rpm 494687ca8adbebaf213eee10f4be290c xmono-3.3.3.1-13.i386.rpm 1cad4cdd644d4f17f4f936f5c2d95ff6 xp9k-3.3.3.1-13.i386.rpm 39683c93132a16f0e79fc414bfb338f1 xs3-3.3.3.1-13.i386.rpm 7a2707ff0cb3ee59d3695f01256c1484 xs3v-3.3.3.1-13.i386.rpm 5c0d05b4b1a53f039c35623c1669eb0f xshared-3.3.3.1-13.i386.rpm cb707a8c22b77478236a81bc58f5edfa xsvga-3.3.3.1-13.i386.rpm e1083e3e18f5a5aeb8de1aff93bd9026 xvga16-3.3.3.1-13.i386.rpm bb74f0e93121a8747e8c38bf1e0121e0 xw32-3.3.3.1-13.i386.rpm 1d38958dd9ac4fbdd1ccef960667ab45 xxprt-3.3.3.1-13.i386.rpm ______________________________________________________________________________ You will find the updates on our ftp-Server: SuSE 6.0: ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/XFree86-3.3.3.1-SuSE/glibc SuSE <= 5.3: ftp://ftp.suse.com/pub/SuSE-Linux/suse_update/XFree86-3.3.3.1-SuSE/libc5 Webpage for patches: http://www.suse.de/patches/index.html or try the following web pages for a list of mirrors: http://www.suse.de/ftp.html http://www.suse.com/ftp_new.html ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe: suse-security@suse.com - unmoderated and for general/linux/SuSE security discussions. All SuSE security announcements are send to this list. suse-security-announce@suse.com - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to majordomo@suse.com with the text subscribe suse-security or subscribe suse-security-announce in the body of the message. Or just issue a echo subscribe suse-security | mail majordomo@suse.com or echo subscribe suse-security-announce | mail majordomo@suse.com ______________________________________________________________________________ If you want to report *NEW* security bugs in the SuSE Linux Distribution please send an email to security@suse.de or call our support line. You may use pgp with the public key below to ensure confidentiality. ______________________________________________________________________________ This information is provided freely to everyone interested and may be redistributed provided that it is not altered in any way. Visit http://www.suse.de/security for our pgp finger print. Type Bits/KeyID Date User ID pub 2048/3D25D3D9 1999/03/06 SuSE Security Team - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12Cg== =pIeS - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBNv6bd3ey5gA9JdPZAQHwdwf8CCyu3rkMCANYtEozsy6RL9Sgo2hEoTp+ HIcNLnetVAEakLFBE+YaYO/b6P5ZU8ohqQ7Z+LAZkodDbh0+JtKvyWk6ugt+MxnN LywsPrvwvAyZadJYhp7KEgJwmGZVZ9/8fHJhWYgTLNJBj75o1LP9Cbb2e8b8ZRoM 70nETXVyuX9vz0gQVctS1RhPkqF7w/uJ72Q/1kFVr9jMzAVbYoYA9l1vaFdIjDhi CYokjKs2vfKeCNSD3xciVi+FSOUBVh8MRPRgoXnCrdm2UeRpeZoUKVhfzGPdXD0I VVIKzgEN83r/6CM9ZZskZMCdOKSN1HQPtcm3jfp/fOBQhZnYZQ9Muw== =cskZ -----END PGP SIGNATURE-----