SuSE: 'traceroute' vulnerability

    Date16 Oct 2000
    CategorySuSE
    2886
    Posted ByLinuxSecurity Advisories
    Using a specially crafted sequence of characters on the commandline, it is possile to trick the traceroute program into running arbitrary code as root.
    
    ______________________________________________________________________________
    
                            SuSE Security Announcement
    
            Package:                traceroute
            Announcement-ID:        SuSE-SA:2000:041
            Date:                   Monday, October 16th, 2000 16:10 MEST
            Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
            Vulnerability Type:     local root compromise
            Severity (1-10):        6
            SuSE default package:   yes
            Other affected systems: Linux systems using the NANOG traceroute
    
        Content of this advisory:
            1) security vulnerability resolved: traceroute
               problem description, discussion, solution and upgrade information
            2) pending vulnerabilities, solutions, workarounds
            3) standard appendix (further information)
    
    ______________________________________________________________________________
    
    1)  problem description, brief discussion, solution, upgrade information
    
        The security problem in the traceroute program as shipped with SuSE 
        Linux distributions is completely different from the one reported on
        security mailing lists a few days ago (`traceroute -g 1 -g 1') by
        Pekka Savola <This email address is being protected from spambots. You need JavaScript enabled to view it.>. SuSE distributions do not contain
        this particular traceroute implementation.
        The problem in our traceroute was discovered independently and reported
        to us by H D Moore <This email address is being protected from spambots. You need JavaScript enabled to view it.>. The problem in the 
        implementation of traceroute that we ship is a format string parsing 
        bug in a routine that can be used to terminate a line in traceroute's
        output to easily embed the program in cgi scripts as used for web 
        frontends for traceroute.
        Using a specially crafted sequence of characters on the commandline,
        it is possile to trick the traceroute program into running arbitrary
        code as root.
    
        If you want to temporarily work around this security vulnerability,
        you can disable traceroute for normal users by clearing the suid bit on
        the file /usr/sbin/traceroute: chmod -s /usr/sbin/traceroute . Do not 
        forget to change the respective line in /etc/permissions to read:
            /usr/sbin/traceroute                   root.root        755
    
        We have prepared update packages on our ftp server that eliminate the
        vulnerability in the traceroute program. Note that the traceroute program
        is contained in the nkita or the nkitb package, depending on the
        distribution version.
    
        Download the update package from locations described below and install 
        the package with the command `rpm -Fhv file.rpm'. The md5sum for each
        file is in the line below. You can verify the integrity of the rpm
        files using the command
            `rpm --checksig --nogpg file.rpm',
        independently from the md5 signatures below.
    
    
        i386 Intel Platform:
    
        SuSE-7.0
         ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2000.10.4-0.i386.rpm
          6c8f713a071a96c287942f880cd5919c
        source rpm:
         ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
          c01db9ee70a9ac01cba1bace93cfdd16
    
        SuSE-6.4
         ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.7.11-0.i386.rpm
          118075b7fc295be86b3659bf9b3fa778
        source rpm:
         ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
          61aa9e2e4272606d2bd70828a72c957c
    
        SuSE-6.3
         ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/nkita-2000.10.4-0.i386.rpm
          6c5932e4083de6f499e4c77fcadbffc1
        source rpm:
         ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
          9debb8804293384057d69254614a1496
    
        SuSE-6.2
         ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm
          49269283c6d39a234f61303b2e918413
        source rpm:
         ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkita-2000.10.4-0.src.rpm
          1cc00eb9b37b37a51fc249db3b51f6e1
    
        SuSE-6.1
         ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/nkita-2000.10.4-0.i386.rpm
          2fe1c6d70fcf1272da95f33ad7ad1010
        source rpm:
         ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkita-2000.10.4-0.src.rpm
          74d6f2e623b7fcac1b0881b1bfbe0880
    
    
        SuSE-6.0
        Please use the update packages from the 6.1 distribution.
    
    
        Sparc Platform:
    
        SuSE-7.0
         ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2000.10.4-0.sparc.rpm
          e9bc3512b6182f540e74308c02d81f65
        source rpm:
         ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
          8fba03e9cef63ae076b10fb61c800e39
    
    
    
        AXP Alpha Platform:
    
        SuSE-6.4
         ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2000.10.4-0.alpha.rpm
          7850969c7b3beaf3fd1ce8b2a9246be0
        source rpm:
         ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
          6e5a964177b6cf87524119c747f0220b
    
        SuSE-6.3
         ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/nkita-2000.10.4-0.alpha.rpm
          6440a6a7da903829cff57a5f8c7cda91
        source rpm:
         ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
          53bf05462378c384e8a46f3c6c368c67
    
    
    
        PPC Power PC Platform:
    
        SuSE-7.0
         ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2000.10.5-0.ppc.rpm
          407d1c6731228f5d3e9addd108d31224
         ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2000.10.5-0.src.rpm
          8fba03e9cef63ae076b10fb61c800e39
    
        SuSE-6.4
         ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2000.10.4-0.ppc.rpm
          c432a5b8d37640be6e325ef9603f9cba
        source rpm:
         ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
          edf24c1989c85616d1caf53872e61f17
    
    ______________________________________________________________________________
    
    2)  Pending vulnerabilities in SuSE Distributions and Workarounds:
    
        A set of security announcements is following this advisory.
    ______________________________________________________________________________
    
    3)  standard appendix:
    
        SuSE runs two security mailing lists to which any interested party may
        subscribe:
    
        This email address is being protected from spambots. You need JavaScript enabled to view it.
            -   general/linux/SuSE security discussion. 
                All SuSE security announcements are sent to this list.
                To subscribe, send an email to 
                    <This email address is being protected from spambots. You need JavaScript enabled to view it.>.
    
        This email address is being protected from spambots. You need JavaScript enabled to view it.
            -   SuSE's announce-only mailing list.
                Only SuSE's security annoucements are sent to this list.
                To subscribe, send an email to
                    <This email address is being protected from spambots. You need JavaScript enabled to view it.>.
    
        For general information or the frequently asked questions (faq) 
        send mail to:
            <This email address is being protected from spambots. You need JavaScript enabled to view it.> or
            <This email address is being protected from spambots. You need JavaScript enabled to view it.> respectively.
    
        ===============================================
        SuSE's security contact is <This email address is being protected from spambots. You need JavaScript enabled to view it.>.
        ===============================================
    
    Regards,
    Roman Drahtmüller.
    - - -- 
     -                                                                      -
    | Roman Drahtmüller      <This email address is being protected from spambots. You need JavaScript enabled to view it.> //          "Caution: Cape does |
      SuSE GmbH - Security           Phone: //       not enable user to fly."
    | Nürnberg, Germany     +49-911-740530 // (Batman Costume warning label) |
     -                                                                      -
    ______________________________________________________________________________
    
        The information in this advisory may be distributed or reproduced,
        provided that the advisory is not modified in any way.
        SuSE GmbH makes no warranties of any kind whatsoever with respect 
        to the information contained in this security advisory.
    
    Type Bits/KeyID    Date       User ID
    pub  2048/3D25D3D9 1999/03/06 SuSE Security Team <This email address is being protected from spambots. You need JavaScript enabled to view it.>
    
    - -----BEGIN PGP PUBLIC KEY BLOCK-----
    Version: 2.6.3i
    
    mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
    BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
    JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
    1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
    P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
    cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
    VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
    yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
    tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
    xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
    Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
    choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
    BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
    v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
    x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
    Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
    MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
    saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
    L0oixF12Cg==
    =pIeS
    - -----END PGP PUBLIC KEY BLOCK-----
    
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"23","type":"x","order":"1","pct":53.49,"resources":[]},{"id":"88","title":"Should be more technical","votes":"5","type":"x","order":"2","pct":11.63,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"15","type":"x","order":"3","pct":34.88,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.