`

---------------------------------------------------------------------
                   Red Hat, Inc. Security Advisory

Synopsis:          Updated tcsh packages are now available for Red Hat Linux.
Advisory ID:       RHSA-2000:121-04
Issue date:        2000-11-30
Updated on:        2000-12-01
Product:           Red Hat Linux
Keywords:          tcsh symlink vulnerability
Cross references:  N/A
---------------------------------------------------------------------

1. Topic:

Updated tcsh packages are now available for Red Hat Linux 5.2, 6.x, and 7.

2. Relevant releases/architectures:

Red Hat Linux 5.2 - i386, alpha, sparc
Red Hat Linux 6.0 - i386, alpha, sparc
Red Hat Linux 6.1 - i386, alpha, sparc
Red Hat Linux 6.2 - i386, alpha, sparc
Red Hat Linux 6.2EE - i386, alpha, sparc
Red Hat Linux 7.0 - i386, alpha
Red Hat Linux 7.0J - i386, alpha

3. Problem description:

Versions 6.09 and below of tcsh are vulnerable to a symbolic link attack. 
This attack can be used to cause users to destroy the contents of any file
to which they have write access.

4. Solution:

For each RPM for your particular architecture, run:

rpm -Fvh [filename]

where filename is the name of the RPM.

5. Bug IDs fixed  ( for more info):

20679 - tcsh '<<' security issue


6. RPMs required:

Red Hat Linux 5.2:

alpha: 

sparc: 

i386: 

sources: 

Red Hat Linux 6.0:

sparc: 

i386: 

alpha: 

sources: 

Red Hat Linux 6.1:

alpha: 

sparc: 

i386: 

sources: 

Red Hat Linux 6.2:

alpha: 

sparc: 

i386: 

sources: 

Red Hat Linux 7.0:

alpha: 

i386: 

sources: 

7. Verification:

MD5 sum                           Package Name
--------------------------------------------------------------------------
ef09e7d86a3ea3805fed90b4e409ce78  5.2/SRPMS/tcsh-6.10-0.5.x.src.rpm
871a2d33370517380173c327d91deb83  5.2/alpha/tcsh-6.10-0.5.x.alpha.rpm
e228b2179d2917067a2267d08eb4f9f1  5.2/i386/tcsh-6.10-0.5.x.i386.rpm
8c839a90f05ab9acb4b83dc620aee644  5.2/sparc/tcsh-6.10-0.5.x.sparc.rpm
4eb03f6ac99e3e6f15fa8e0a7f680530  6.0/SRPMS/tcsh-6.10-0.6.x.src.rpm
1a05f99e1fe6d5ec091160ee8012cd07  6.0/alpha/tcsh-6.10-0.6.x.alpha.rpm
6c66a718122e2a0f79bb0f6218082ebc  6.0/i386/tcsh-6.10-0.6.x.i386.rpm
eda7e5af943795c2c85050724d8f5deb  6.0/sparc/tcsh-6.10-0.6.x.sparc.rpm
4eb03f6ac99e3e6f15fa8e0a7f680530  6.1/SRPMS/tcsh-6.10-0.6.x.src.rpm
1a05f99e1fe6d5ec091160ee8012cd07  6.1/alpha/tcsh-6.10-0.6.x.alpha.rpm
6c66a718122e2a0f79bb0f6218082ebc  6.1/i386/tcsh-6.10-0.6.x.i386.rpm
eda7e5af943795c2c85050724d8f5deb  6.1/sparc/tcsh-6.10-0.6.x.sparc.rpm
4eb03f6ac99e3e6f15fa8e0a7f680530  6.2/SRPMS/tcsh-6.10-0.6.x.src.rpm
1a05f99e1fe6d5ec091160ee8012cd07  6.2/alpha/tcsh-6.10-0.6.x.alpha.rpm
6c66a718122e2a0f79bb0f6218082ebc  6.2/i386/tcsh-6.10-0.6.x.i386.rpm
eda7e5af943795c2c85050724d8f5deb  6.2/sparc/tcsh-6.10-0.6.x.sparc.rpm
8237e14a4430f4ca48dd4421a049bf3d  7.0/SRPMS/tcsh-6.10-1.src.rpm
c4ce83f418496f40e3e802da03db3e6f  7.0/alpha/tcsh-6.10-1.alpha.rpm
1fee54c9b1fc394c03a8d960937a9747  7.0/i386/tcsh-6.10-1.i386.rpm

These packages are GPG signed by Red Hat, Inc. for security.  Our key
is available at:
     
You can verify each package with the following command:
    rpm --checksig  

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the md5sum with the following command:
    rpm --checksig --nogpg 

8. References:
 


Copyright(c) 2000 Red Hat, Inc.


`

Redhat: 'tcsh' symlink vulnerability

Versions 6.09 and below of tcsh are vulnerable to a symbolic link attack.

Summary



Summary

Versions 6.09 and below of tcsh are vulnerable to a symbolic link attack. This attack can be used to cause users to destroy the contents of any fileto which they have write access.


Solution

For each RPM for your particular architecture, run:
rpm -Fvh [filename]
where filename is the name of the RPM.
5. Bug IDs fixed ( for more info):
20679 - tcsh '<<' security issue

6. RPMs required:
Red Hat Linux 5.2:
alpha:
sparc:
i386:
sources:
Red Hat Linux 6.0:
sparc:
i386:
alpha:
sources:
Red Hat Linux 6.1:
alpha:
sparc:
i386:
sources:
Red Hat Linux 6.2:
alpha:
sparc:
i386:
sources:
Red Hat Linux 7.0:
alpha:
i386:
sources:
7. Verification:
MD5 sum Package Name ef09e7d86a3ea3805fed90b4e409ce78 5.2/SRPMS/tcsh-6.10-0.5.x.src.rpm 871a2d33370517380173c327d91deb83 5.2/alpha/tcsh-6.10-0.5.x.alpha.rpm e228b2179d2917067a2267d08eb4f9f1 5.2/i386/tcsh-6.10-0.5.x.i386.rpm 8c839a90f05ab9acb4b83dc620aee644 5.2/sparc/tcsh-6.10-0.5.x.sparc.rpm 4eb03f6ac99e3e6f15fa8e0a7f680530 6.0/SRPMS/tcsh-6.10-0.6.x.src.rpm 1a05f99e1fe6d5ec091160ee8012cd07 6.0/alpha/tcsh-6.10-0.6.x.alpha.rpm 6c66a718122e2a0f79bb0f6218082ebc 6.0/i386/tcsh-6.10-0.6.x.i386.rpm eda7e5af943795c2c85050724d8f5deb 6.0/sparc/tcsh-6.10-0.6.x.sparc.rpm 4eb03f6ac99e3e6f15fa8e0a7f680530 6.1/SRPMS/tcsh-6.10-0.6.x.src.rpm 1a05f99e1fe6d5ec091160ee8012cd07 6.1/alpha/tcsh-6.10-0.6.x.alpha.rpm 6c66a718122e2a0f79bb0f6218082ebc 6.1/i386/tcsh-6.10-0.6.x.i386.rpm eda7e5af943795c2c85050724d8f5deb 6.1/sparc/tcsh-6.10-0.6.x.sparc.rpm 4eb03f6ac99e3e6f15fa8e0a7f680530 6.2/SRPMS/tcsh-6.10-0.6.x.src.rpm 1a05f99e1fe6d5ec091160ee8012cd07 6.2/alpha/tcsh-6.10-0.6.x.alpha.rpm 6c66a718122e2a0f79bb0f6218082ebc 6.2/i386/tcsh-6.10-0.6.x.i386.rpm eda7e5af943795c2c85050724d8f5deb 6.2/sparc/tcsh-6.10-0.6.x.sparc.rpm 8237e14a4430f4ca48dd4421a049bf3d 7.0/SRPMS/tcsh-6.10-1.src.rpm c4ce83f418496f40e3e802da03db3e6f 7.0/alpha/tcsh-6.10-1.alpha.rpm 1fee54c9b1fc394c03a8d960937a9747 7.0/i386/tcsh-6.10-1.i386.rpm
These packages are GPG signed by Red Hat, Inc. for security. Our key is available at:
You can verify each package with the following command: rpm --checksig
If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg

References

Copyright(c) 2000 Red Hat, Inc. `

Package List


Severity
Advisory ID: RHSA-2000:121-04
Issued Date: : 2000-11-30
Updated on: 2000-12-01
Product: Red Hat Linux
Keywords: tcsh symlink vulnerability
Cross references: N/A

Topic


Topic

Updated tcsh packages are now available for Red Hat Linux 5.2, 6.x, and 7.


 

Relevant Releases Architectures

Red Hat Linux 5.2 - i386, alpha, sparc

Red Hat Linux 6.0 - i386, alpha, sparc

Red Hat Linux 6.1 - i386, alpha, sparc

Red Hat Linux 6.2 - i386, alpha, sparc

Red Hat Linux 6.2EE - i386, alpha, sparc

Red Hat Linux 7.0 - i386, alpha

Red Hat Linux 7.0J - i386, alpha


Bugs Fixed


Related News

News

Powered By

Footer Logo

Linux Security - Your source for Top Linux News, Advisories, HowTo's and Feature Release.

Powered By

Footer Logo