Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 554
Alerts This Week
Warning Icon 1 554

Red Hat Linux RHSA-2000:009-02 Critical Gpm-Root Escalation Risk

red hat
Calendar Grey April 12, 2000
Dist Redhat Esm H88
The gpm-root privilege exploit in Red Hat Linux lets unauthorized users execute commands. To mitigate this risk, implement strict user access controls and regularly patch systems.
gpm-root (part of the gpm packge) fails to drop gid 0 priviledges when executing user commands.

Solution


For each RPM for your particular architecture, run:

rpm -Uvh filename

where filename is the name of the RPM.

9. Verification:

 MD5 sum                           Package Name

b8278a5d0a867a2fd8e6ac4a927627cb  4.2/alpha/gpm-1.19.1-0.4.2.alpha.rpm
c5075756a0f74c36a94c78ccda496412  4.2/sparc/gpm-1.19.1-0.4.2.sparc.rpm
b3d87c92880a9bf80d0fd3ff944e907b  4.2/SRPMS/gpm-1.19.1-0.4.2.src.rpm
7112c804fd008e137f8d6551460c10d7  4.2/i386/gpm-1.19.1-0.4.2.i386.rpm
79ebec95b2d6e48f60d4e34cfdee6f93  5.2/i386/gpm-1.19.1-0.5.2.i386.rpm
c4cdced5149e773733458c234ede2ac7  5.2/SRPMS/gpm-1.19.1-0.5.2.src.rpm
330e555a09e7b5c85187d348dbf453e6  5.2/alpha/gpm-1.19.1-0.5.2.alpha.rpm
5ceda554f2549c100a88d6370e45e2f6  5.2/sparc/gpm-1.19.1-0.5.2.sparc.rpm
867c4316ec0645fd8e51b674646ef44d  6.2/alpha/gpm-1.19.1-1.alpha.rpm
fbeb89d319776e7eb3af1db15679e93f  6.2/sparc/gpm-1.19.1-1.sparc.rpm
86a800ce94206877edc4f6e88272deee  6.2/i386/gpm-1.19.1-1.i386.rpm
8dedce47f4e6aa7bbfb36d9630561cd4  6.2/SRPMS/gpm-1.19.1-1.src.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
About

You can verify each package with the following command: rpm --checksig filename

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg filename

Note that you need RPM >= 3.0 to check GnuPG keys.


Summary

Topics%20covered

Topics Covered

security advisory Red Hat Linux critical privilege escalation gpm-root gpm package

References

;msg=20000322182143.4498.qmail@securityfocus.com

Thanks also go to Egmont Koblinger and the members of the Bugtraq list.



Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Topic

Topics%20covered

Topics Covered

security advisory Red Hat Linux critical privilege escalation gpm-root gpm package

Relevant Releases Architectures

5. Obsoleted by:

N/A

6. Conflicts with:

N/A

7. RPMs required:

Red Hat Linux 4.2:

    intel:

    alpha:

    sparc:

    sources:

Red Hat Linux 5.2:

Red Hat Linux 6.0, 6.1, 6.2:

    Intel:

    Alpha:


    SPARC:


    Source:

Bugs Fixed

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.