![[LWN Logo]](/images/lwn.banner.gif)
Date: Tue, 27 Apr 1999 11:06:23 -0600 From: Caldera Systems Information <info@calderasystems.com> To: caldera-announce@rim.caldera.com Subject: SECURITY [CSSA-1999:008.0] -- bash -----BEGIN PGP SIGNED MESSAGE----- ______________________________________________________________________________ Caldera Systems, Inc. Security Advisory Subject: bash Advisory number: CSSA-1999:008.0 Issue date: 1999 04 26 Cross reference: ______________________________________________________________________________ 1. Problem Description Commands in directory names may get executed via the prompt string 2. Vulnerable Versions Systems: OpenLinux 1.0, 1.1, 1.2, 1.3, 2.2. Packages: previous to bash-1.14.7-10 3. Solutions The proper solution is to upgrade to the bash-1.14.7-10 package. 4. Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.calderasystems.com/pub/OpenLinux/updates/2.2/current/RPMS/ The corresponding source code package can be found at: ftp://ftp.calderaystems.com/pub/OpenLinux/updates/2.2/current/SRPMS 5. Installing Fixed Packages Upgrade the affected packages with the following commands: rpm -q bash && rpm -i bash-1.14.7-10.i386.rpm 6. Verification The MD5 checksums (from the "md5sum" command) for these packages are: bda0872dcdb51e12ef8ccd10b201936d README 06fe5807ce8873b424738078f1dedf3f RPMS/bash-1.14.7-10.i386.rpm 46c483b3ecbd0ee3cc6ae1387ab7f12b SRPMS/bash-1.14.7-10.src.rpm 7. References This and other Caldera security resources are located at: http://www.calderasystems.com/news/security/index.html Additional documentation on this problem can be found in: This security fix closes Caldera's internal Problem Report 4532. 8. Disclaimer Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQCVAwUBNySBOOn+9R4958LpAQEKsAP/QM1oFEM/+6SSsP4qNE2gGsR82m5nu2r0 KsXTUeObBTweu5kMJpPaG9BsqX7Iohs/IcoQeIRJTrwVW9LF/IILMmP/tYkGNv71 o71YoTgAYFh0Xgni7mV5RACvcsnwJpQXDQOA1BCqNcTCA37pq6DXgWC95HgwLzwJ EAY8FF8pU+w= =Nstg -----END PGP SIGNATURE----- - Notes: To learn how to use this list server, email a "help" command to majordomo@rim.caldera.com.