______________________________________________________________________________

                        SuSE Security Announcement

        Package:  i4l (xmonisdn)
        Date:     Wed Aug 18 10:39:00 CEST 1999
        Affected: all Linux distributions using xmonisdn in conjunction
                  with old libc

______________________________________________________________________________

A security hole was discovered in the package mentioned above.
Please update as soon as possible or disable the service if you are using
this software on your SuSE Linux installation(s).

Other Linux distributions or operating systems might be affected as
well, please contact your vendor for information about this issue.

Please note, that that we provide this information on as "as-is" basis only.
There is no warranty whatsoever and no liability for any direct, indirect or
incidental damage arising from this information or the installation of
the update package.

______________________________________________________________________________

1. Problem Description

    xmonisdn which is part of the i4l package is installed setuid root
    by default.
    To control and display the status of the ISDN network connections
    xmonisdn uses external programs, which are executed by the system()
    systemcall, without taking care of a safe environment.
    The problem arises by old libc, that don't overwrite the IFS environment
    variable.

2. Impact

    By manipulating the IFS (or PATH) environment variable an attacker is
    able to execute his own programs with root privileges.

3. Solution

    A temporary fix:
      /bin/chmod u-s /usr/bin/xmonisdn

    Install the updated package, as soon as it is available from our
    ftp server.

______________________________________________________________________________

Webpage for patches:
        http://www.suse.de/patches/index.html

or try the following web pages for a list of mirrors:

        http://www.suse.de/ftp.html
        
______________________________________________________________________________