SuSE Linux: Critical SCCW Information Disclosure Threat

Warning: Undefined array key "advisoryid" in /var/www/www.linuxsecurity.com-443/html/tmp/regularlabs/custom_php/3401906_1edcd913e2b52798c5b9126b8927230e on line 19

______________________________________________________________________________

                        SuSE Security Announcement

        Package:  sccw-1.1 and earlier
        Date:     Mon Sep 20 23:40:09 CEST 1999
        Affected: all Linux distributions using sccw
_____________________________________________________________________________

A security hole was discovered in the package mentioned above.
Please update as soon as possible or disable the service if you are using
this software on your SuSE Linux installation(s).

Other Linux distributions or operating systems might be affected as
well, please contact your vendor for information about this issue.

Please note, that that we provide this information on as "as-is" basis only.
There is no warranty whatsoever and no liability for any direct, indirect or
incidental damage arising from this information or the installation of
the update package.
_____________________________________________________________________________

1. Problem Description

  The /usr/bin/sccw tool can be used to read any file on the system.

2. Impact

  An attacker can read e.g the /etc/shadow file or private email.

3. Solution

  Updated the sccw package from our FTP server.
______________________________________________________________________________

Here are the md5 checksums of the upgrade packages, please verify these
before installing the new packages:

  f70f788861bf0ee402405a7dc14431a  sccw-1.1-32.i386.rpm (6.2)

______________________________________________________________________________

You will find the update on our ftp-Server:

  
Webpage for patches:
  https://www.suse.com/de-de/

or try the following web pages for a list of mirrors:
  https://www.suse.com/de-de/
  
______________________________________________________________________________

SuSE has got two free security mailing list services to which any
interested party may subscribe:

suse-security@suse.com          - moderated and for general/linux/SuSE
                                  security discussions. All SuSE security
                                  announcements are send to this list.

suse-security-announce@suse.com - SuSE's announce-only mailing list.
                                  Only SuSE's security annoucements are sent
                                  to this list.

To subscribe, just send an emtpy message to suse-security-subscribe@suse.com
or suse-security-announce-subscribe@suse.com like this:

        echo | mail suse-security-subscribe@suse.com
or
        echo | mail suse-security-announce-subscribe@suse.com

______________________________________________________________________________