Date: Wed, 30 Aug 2000 12:27:08 -0600
From: Technical Support <support@phoenix.calderasystems.com>
To: announce@lists.calderasystems.com, bugtraq@securityfocus.com,
Subject: Security Update: /tmp file race in faxrunq


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
		   Caldera Systems, Inc.  Security Advisory

Subject:		/tmp file race in faxrunq
Advisory number: 	CSSA-2000-029.0
Issue date: 		2000 August, 30
Cross reference:
______________________________________________________________________________


1. Problem Description

   The mgetty package contains a number of tools for sending
   an receiving facsimiles. One of the tools, faxrunq,
   uses a marker file in a world-writable directory in an
   unsecure fashion. This bug allows malicious users to
   clobber files on the system owned by the user invoking
   faxrunq.
 
   On a default installation of OpenLinux, this utility
   is never used, so users should be safe unless they
   have manually configured mgetty to regularly run
   faxrunq (e.g. via the cron daemon).                                         

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        All packages previous to
   				mgetty-1.1.22_Aug17-2OL

   OpenLinux eServer 2.3        All packages previous to
   and OpenLinux eBuilder       mgetty-1.1.22_Aug17-2S

   OpenLinux eDesktop 2.4	All packages previous to
                                mgetty-1.1.22_Aug17-2

3. Solution

   Workaround:

   Unless you've manually configured mgetty for fax
   sending, no workaround is required. If you do use
   sendfax, upgrade to mgetty-1.1.22.                                           

   We recommend our users to upgrade to the new packages.

4. OpenLinux Desktop 2.3

   4.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

   4.2 Verification

   bd77ccb42f392969df0b4ccd4f15fd09  RPMS/mgetty-1.1.22_Aug17-2OL.i386.rpm
   a24e9ebd58c85bd14e5d454e5b2f5c20  SRPMS/mgetty-1.1.22_Aug17-2OL.src.rpm

   4.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  rpm -Fhv mgetty-*i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

   5.2 Verification

   4333586142d2f34f2f1889ca0bfd4805  RPMS/mgetty-1.1.22_Aug17-2S.i386.rpm
   7de5660745afabfff123c7cf3abd686c  SRPMS/mgetty-1.1.22_Aug17-2S.src.rpm

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  rpm -Fhv mgetty-*i386.rpm

6. OpenLinux eDesktop 2.4

   6.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

   6.2 Verification

   8448f67301c06baf05df34837fabd88d  RPMS/mgetty-1.1.22_Aug17-2.i386.rpm
   bd07601a9d24aad43f6fd2043822d8c8  SRPMS/mgetty-1.1.22_Aug17-2.src.rpm

   6.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  rpm -Fhv mgetty-*i386.rpm

7. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 7555.

8. Disclaimer

   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.0 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE5rNYR18sy83A/qfwRAroZAJ45lzWjn8J/lIxWQz+k7p/j0NdZ2gCgx3ai
vZXWjzwjytIJws7gg/UqsFM=
=qZ/7
-----END PGP SIGNATURE-----