Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Red Hat Linux 6.2/7.0: RHSA-2000:115-01 Critical: Ncurses Setuid Exploit

red hat
Calendar Grey November 26, 2000
Dist Redhat Esm H88
A significant vulnerability in ncurses could allow local privilege escalation, jeopardizing setuid applications. Secure your systems by updating promptly.
If you are any setuid applications that use ncurses and its cursor movementfunctionality, local users may gain access to the program's privileges.

Solution

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

5. Bug IDs fixed ( for more info):

20809 - ncurses allows local privilege escalation


6. RPMs required:

Red Hat Linux 6.2:

alpha:


sparc:


i386:


sources:

Red Hat Linux 7.0:

i386:


sources:

7. Verification:

MD5 sum Package Name 268df5613b61b146b8cae1c59369c0b7 6.2/SRPMS/ncurses-5.0-12.src.rpm 1decbd07374fd9fb7ae5a12641d2667b 6.2/alpha/ncurses-5.0-12.alpha.rpm ed52d2bad06cee2cec081bb889a5e363 6.2/alpha/ncurses-devel-5.0-12.alpha.rpm d401a0317132c114a75dfeefb881f66c 6.2/i386/ncurses-5.0-12.i386.rpm bc84ee23b1b8f960a0911a5388c52d24 6.2/i386/ncurses-devel-5.0-12.i386.rpm 654eca10b3b44afef783c39da3b254dc 6.2/sparc/ncurses-5.0-12.sparc.rpm e273dd6e88899781bcc7441e7505de5c 6.2/sparc/ncurses-devel-5.0-12.sparc.rpm 4444a46c15c28db246b191daf4f3dfde 7.0/SRPMS/ncurses-5.2-2.src.rpm 9affe6c75ae33d616ea695766c10e44e 7.0/i386/ncurses-5.2-2.i386.rpm a555ec460de5650c4a2c42abc5de838c 7.0/i386/ncurses-devel-5.2-2.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:

You can verify each package with the following command: rpm --checksig

If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg

Summary

Topics%20covered

Topics Covered

security advisory Red Hat Linux critical local privilege escalation setuid application ncurses exploit

References

N/A Copyright(c) 2000 Red Hat, Inc. `

Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2000:115-01
Issue date: 2000-11-23
Updated on: 2000-11-23
Product: Red Hat Linux
Keywords: ncurses buffer overrun exploit setuid
Cross references: N/A

Topic

Topics%20covered

Topics Covered

security advisory Red Hat Linux critical local privilege escalation setuid application ncurses exploit

Relevant Releases Architectures

Red Hat Linux 6.2 - i386, alpha, sparc

Red Hat Linux 6.2EE - i386, alpha, sparc

Red Hat Linux 7.0 - i386

Bugs Fixed

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here