Alerts This Week
Warning Icon 1 535
Alerts This Week
Warning Icon 1 535

Stay Secure with the Latest Linux Advisories

Filter Icon Refine advisories
X Clear Filters
X Clear Filters
View More

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Loading...

Explore Latest Linux Security advisories

We found -5 articles for you...
89

Fedora Core 3: 2005-208 Moderate: PAM Authentication Check Update

o Added check in at(1) to verify if atd PAM authentication will succeed; Job submission will be denied if atd PAM authentication fails. o Fixed PAM authentication in atd (bug 150131).. ---------------------------------------------------------------------Fedora Update Notification FEDORA-2005-208 2005-03-11 ---------------------------------------------------------------------Product : Fedora Core 3 Name : at Version : 3.1.8 Release : 68_FC3 Summary : Job spooling tools. Description : At and batch read commands from standard input or from a specified file. At allows you to specify that a command will be run at a particular time. Batch will execute commands when the system load levels drop to a particular level. Both commands use /bin/sh. You should install the at package if you need a utility for time-oriented job control. Note: If it is a recurring job that will need to be repeated at the same time every day/week, etc. you should use crontab instead. ---------------------------------------------------------------------Update Information: o Added check in at(1) to verify if atd PAM authentication will succeed; Job submission will be denied if atd PAM authentication fails. o Fixed PAM authentication in atd (bug 150131). ---------------------------------------------------------------------* Tue Mar 8 2005 Jason Vas Dias 3.1.8-68 - Put PAM authentication check in 'check_permissions()', so - user can know when using at(1) if PAM permission is denied. * Tue Mar 8 2005 Jason Vas Dias 3.1.8-67 - better fix for bug 150131: change DAEMON_USERNAME and - DAEMON_GROUPNAME to 'root' . * Mon Mar 7 2005 Jason Vas Dias 3.1.8-66 - fix bug 150131: atd should not relinquish root privilege if - doing su(1) equivalent with PAM . * Tue Jan 25 2005 Jason Vas Dias 3.1.8-64 - bugs 5160/146132: add PAM authentication control to atd * Tue Oct 5 2004 Jason Vas Dias 3.1.8-60 - fix bug 131510:no_export env. var. blacklisting should not - remove 'SHELL' when only 'SHELLOPTS' is blacklisted. - at(1) man-page should not say 'commands are run with /bin/sh' - and should explain usage of SHELL environement variable and - details of blacklisted variables. * Tue Sep 28 2004 Rik van Riel 3.1.8-58 - fix typo in man page, bug 112303 - (regenerated at-3.1.8-man-timespec-path.patch with fix) * Tue Aug 3 2004 Jason Vas Dias - fixed bug 125634 - made usage() agree with manpage * Thu Jul 29 2004 Jason Vas Dias - Added POSIX.2 -t option for RFE 127485 * Thu Jul 29 2004 Jason Vas Dias - Had to disable the 'make test' for the build BEFORE - any changes were made (building on FC2 - perl issue?) - test.pl generates these 'errors' for what looks like - valid output to me: - $ ./test.pl 2> &1 | egrep -v '(^ok$)|(time_only)' - 1..3656 - not ok - 'Monday - 1 month': 'Fri Jul 2 18:29:00 2004' =? 'Sat Jul 3 18:29:00 2004' - not ok - 'Monday - 10 months': 'Thu Oct 2 18:29:00 2003' =? 'Fri Oct 3 18:29:00 2003' - not ok - 'next week - 1 month': 'Mon Jul 5 18:29:00 2004' =? 'Tue Jul 6 18:29:00 2004' - not ok - 'next week - 10 months': 'Sun Oct 5 18:29:00 2003' =? 'Mon Oct 6 18:29:00 2003' - will investigate and fix for next release. * Tue Jun 15 2004 Elliot Lee - rebuilt * Wed May 12 2004 Thomas Woerner - 3.1.8-54 - fixed pie patch: at is pie, now - added build requires for libselinux-devel * Tue May 4 2004 Dan Walsh - 3.1.8-53 - Add fileentrypoint check * Thu Apr 15 2004 Dan Walsh - 3.1.8-52 - Fix SELinux patch * Mon Feb 23 2004 Tim Waugh - Use ':' instead of '.' as separator for chown. * Fri Feb 13 2004 Elliot Lee - 3.1.8-50 - rebuilt * Tue Dec 9 2003 Jens Petersen - 3.1.8-49 - replace at-3.1.8-SHELL-91233.patch by at-3.1.8-SHELL-111386.patch which now executes $SHELL directly in the at shell script after all the variables have been setup with /bin/sh (#91233) [suggested by GöranUddeborg] - this changelog is now in utf-8 * Fri Nov 7 2003 Jens Petersen - 3.1.8-48 - add at-3.1.8-pie.patch to build atd as pie (#108415) [Ulrich Drepper] * Fri Oct 31 2003 Dan Walsh - 3.1.8-47.sel * Fri Jun 20 2003 Jens Petersen - 3.1.8-46 - add at-3.1.8-atrun.8-typo-97697.patch to fix typo in atrun.8 (#97697) - update at.1 description of shell behaviour (#91233) * Tue Jun 17 2003 Jens Petersen - 3.1.8-45 - make the job shell default to SHELL instead of "/bin/sh" (#91233) * Wed Jun 4 2003 Elliot Lee - 3.1.8-44 - rebuilt * Tue Jun 3 2003 Jens Petersen - 3.1.8-43 - Replace redundant at-3.1.7-paths.patch by at-3.1.8-man-timespec-path.patch to fix timespec path * Tue Jun 3 2003 Jens Petersen - 3.1.8-41 - update source to at_3.1.8-11 from debian upstream - update source url - at-debian.patch no longer needed - at-3.1.7-paths.patch: the patch to "at.1.in" no longer needed - replace at-3.1.8-lexer.patch with at-3.1.8-11-lexer-parser.diff - at-3.1.8-dst.patch no longer needed - at-3.1.8-lsbdoc.patch no longer needed - at-3.1.8-o_excl.patch no longer needed - bump release number - at-3.1.8-test.patch: move out test.pl to a separate source file - apply at-3.1.8-test-fix.patch to it and drop patch - at-3.1.8-shell.patch: drop (#22216,#91233) - run "make test" after building - add "--without check" rpmbuild option - fix autoconf comment to point to right patch - use _sysconfdir, _sbindir, _bindir, and _localstatedir * Wed Jan 22 2003 Tim Powers 3.1.8-33 - rebuilt * Wed Nov 27 2002 Tim Powers 3.1.8-32 - remove unpackaged files from the buildroot * Thu Jul 25 2002 Bill Huang - Fixed delaying job execution and missing starting jobs..(bug#69595) (Thanks Bujor D Silaghi for his patch.) * Fri Jul 19 2002 Bill Huang - Fixed cleaning atq and multiple atd daemon.(bug#67414) (Thanks Bujor D Silaghi for his patch.) * Fri Jul 19 2002 Bill Huang - Fixed error message output in atd.c * FriJun 21 2002 Tim Powers - automated rebuild * Mon May 27 2002 Bill Huang - Rebuild for Milan * Thu May 23 2002 Tim Powers - automated rebuild * Fri Feb 1 2002 Bernhard Rosenkraenzer 3.1.8-25 - Require smtpdaemon rather than sendmail - postfix works just as well. * Thu Jan 31 2002 Bill Nottingham 3.1.8-24 - rebuild in new env. * Thu Jan 17 2002 Trond Eivind Glomsrød 3.1.8-23 - s/Copyright/License/ * Mon Jan 14 2002 Adrian Havill 3.1.8-21 - fix man page (#51253) - fix env prop problem (#49491) - .SEQ should not be executable (#52626) - beefed up file creation perms against symlink exploits (O_EXCL) * Thu Aug 2 2001 Crutcher Dunnavant 3.1.8-20 - updated patch update, still bug #46546 * Wed Jul 18 2001 Crutcher Dunnavant - applied enrico.scholz@informatik.tu-chemnitz.de's change to the env patch to - address bug #46546 * Mon Jun 25 2001 Crutcher Dunnavant - changed atd.init to start at 95, stop at 5, closing #15915 - applied mailto:wp@supermedia.pl's environment patch * Sun Jun 24 2001 Elliot Lee - Bump release + rebuild. * Wed Apr 4 2001 Crutcher Dunnavant - much love to David Kilzer - who nailed UTC, Leap year, DST, and some other edge cases down - he also wrote a test harness in perl - bug #28448 * Fri Feb 2 2001 Trond Eivind Glomsrød - i18nize initscript * Tue Dec 12 2000 Bill Nottingham - fix documentation of which shell commands will be run with (#22216) * Wed Aug 23 2000 Crutcher Dunnavant - Well, we will likely never really close the UTC issues, - because of 1) fractional timezones, and 2) daylight savigns time. - but there is a slight tweak to the handling of dst in the UTC patch. * Wed Aug 23 2000 Crutcher Dunnavant - fixed bug #15685 - which had at miscaluclating UTC times. * Sat Jul 15 2000 Bill Nottingham - move initscript back * Wed Jul 12 2000 Prospector - automatic rebuild * Thu Jul 6 2000 Bill Nottingham - prereq /etc/init.d *Sat Jul 1 2000 Nalin Dahyabhai - fix syntax error in init script * Tue Jun 27 2000 Preston Brown - don't prereq, only require initscripts * Mon Jun 26 2000 Preston Brown - move init script - add condrestart directive - fix post/preun/postun scripts - prereq initscripts > = 5.20 * Sat Jun 17 2000 Bill Nottingham - fix verify of /var/spool/at/.SEQ (#12262) * Mon Jun 12 2000 Nalin Dahyabhai - fix status checking and syntax error in init script * Fri Jun 9 2000 Bill Nottingham - fix for long usernames (#11321) - add some bugfixes from debian * Mon May 8 2000 Bernhard Rosenkraenzer - 3.1.8 * Wed Mar 1 2000 Bill Nottingham - fix a couple of more typos, null-terminate some strings * Thu Feb 10 2000 Bill Nottingham - fix many-years-old typo in atd.c * Thu Feb 3 2000 Bill Nottingham - handle compressed man pages * Mon Aug 16 1999 Bill Nottingham - initscript munging, build as non-root user * Sun Jun 13 1999 Jeff Johnson - correct perms for /var/spool/at after defattr. * Mon May 24 1999 Jeff Johnson - reset SIGCHLD before exec (#3016). * Sun Mar 21 1999 Cristian Gafton - auto rebuild in the new build environment (release 8) * Thu Mar 18 1999 Cristian Gafton - fix handling the 12:00 time * Wed Jan 13 1999 Bill Nottingham - configure fix for arm * Wed Jan 6 1999 Cristian Gafton - build for glibc 2.1 * Tue May 5 1998 Prospector System - translations modified for de, fr, tr * Wed Apr 22 1998 Michael K. Johnson - enhanced initscript * Sun Nov 9 1997 Michael K. Johnson - learned to spell * Wed Oct 22 1997 Michael K. Johnson - updated to at version 3.1.7 - updated lock and sequence file handling with %ghost - Use chkconfig and atd, now conflicts with old crontabs packages * Thu Jun 19 1997 Erik Troan - built against glibc ---------------------------------------------------------------------This update can be downloaded from: 6298f4951df74da90f772aea459eac49 SRPMS/at-3.1.8-68_FC3.src.rpm c22b420912cd79ddec719b0fedc9ba87 x86_64/at-3.1.8-68_FC3.x86_64.rpm 90d0fe3286862af9bcf222040083077e x86_64/debug/at-debuginfo-3.1.8-68_FC3.x86_64.rpm 024298e264411999e41bc47a268f2a7d i386/at-3.1.8-68_FC3.i386.rpm 2ebb87cb03de380e44f0d10ea69e223b i386/debug/at-debuginfo-3.1.8-68_FC3.i386.rpm This update can also be installed with the Update Agent; you can launch the Update Agent with the 'up2date' command. -----------------------------------------------------------------------fedora-announce-list mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Fedora Core 4 released with enhanced security protocols and revisions to cron scheduling tasks for more efficient job handling.. Fedora Core,PAM Authentication Fix,Job Scheduling,Task Management. . LinuxSecurity.com Team

Calendar 2 Mar 11, 2005 Fedora
98

Red Hat Linux 6.2: RHSA-2002:015-15 Critical: At Heap Corruption

This updated at package fixes two minor problems and one majorproblem where the environment can get wiped out prior to the execution of ascheduled command.. ` --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated at package available Advisory ID: RHSA-2002:015-15 Issue date: 2002-01-15 Updated on: 2002-02-07 Product: Red Hat Linux Keywords: at security heap corruption environment Cross references: Obsoletes: --------------------------------------------------------------------- 1. Topic: This updated at package fixes two minor problems and one major problem where the environment can get wiped out prior to the execution of a scheduled command. For versions of Red Hat Linux prior to 7.2, this package also fixes a potential security vulnerability which can result in heap corruption (Red Hat Linux 7.2 is not vulnerable to this security exploit). Update 2002-02-01: The package for Red Hat Linux 6.2 tried to source a file in /etc/init.d, which doesn't exist on a standard system. 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - alpha, i386, ia64 Red Hat Linux 7.2 - i386, ia64 3. Problem description: A server running the latest version of at could have commands that depend on the current environment (for example, the PATH) which would then fail or run incorrectly because the environment would not be accessible when the command was executed at a later time. Additionally, in versions of Red Hat Linux prior to 7.2 a malicious local user could specify an execution time is in a carefully drafted format causing a heap corruption bug. Since the at command is installed as setuid root this bug can be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0004 to this issue. Thanks to zen-parse for reporting this vulnerability. Inaddition to the fixed heap corruption, file handling security on all versions of at has been improved by adding the O_EXCL (exclusive) option to an open system call. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed ( for more info): 49491 - all environment is wiped out prior to executing user command 51253 - Wrong pointer to time syntax in man page 52626 - "at" RPM says that /var/spool/at/.SEQ should be executable 6. RPMs required: Red Hat Linux 6.2: SRPMS: alpha: i386: sparc: Red Hat Linux 7.0: SRPMS: alpha: i386: Red Hat Linux 7.1: SRPMS: alpha: i386: ia64: Red Hat Linux 7.2: SRPMS: i386: ia64: 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- beab8c80838d3920d758a2e8e5b5e3b2 6.2/en/os/SRPMS/at-3.1.8-22.2.src.rpm 31a1aac9c620778fe24a5d9c73b468c6 6.2/en/os/alpha/at-3.1.8-22.2.alpha.rpm a5ea88124398a0b937dd93e93d62c3bd 6.2/en/os/i386/at-3.1.8-22.2.i386.rpm 3ee8b5c53f23d0eae9bd78c69621ff78 6.2/en/os/sparc/at-3.1.8-22.2.sparc.rpm b1f62f4b41e12a54a1f73d639363a638 7.0/en/os/SRPMS/at-3.1.8-23.src.rpm 97e27a1d2dc0f08d8f118209a891689a7.0/en/os/alpha/at-3.1.8-23.alpha.rpm ea793fd803f10c8fa66abb8191fefb9b 7.0/en/os/i386/at-3.1.8-23.i386.rpm b1f62f4b41e12a54a1f73d639363a638 7.1/en/os/SRPMS/at-3.1.8-23.src.rpm 97e27a1d2dc0f08d8f118209a891689a 7.1/en/os/alpha/at-3.1.8-23.alpha.rpm ea793fd803f10c8fa66abb8191fefb9b 7.1/en/os/i386/at-3.1.8-23.i386.rpm 8fed88d53824e98f509289c42ea01237 7.1/en/os/ia64/at-3.1.8-23.ia64.rpm b1f62f4b41e12a54a1f73d639363a638 7.2/en/os/SRPMS/at-3.1.8-23.src.rpm ea793fd803f10c8fa66abb8191fefb9b 7.2/en/os/i386/at-3.1.8-23.i386.rpm 8fed88d53824e98f509289c42ea01237 7.2/en/os/ia64/at-3.1.8-23.ia64.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: About You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: CVE -CVE-2002-0004 Copyright(c) 2000, 2001 Red Hat, Inc. `. SUSE has released an updated 'em' module that addresses a significant memory overflow flaw, safeguarding against possible information leaks or system outages while performing operations.. Heap Corruption Fix, Red Hat Linux Security, At Command Update. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Feb 08, 2002 Critical Red Hat
98

Red Hat Linux: RHSA-2002:015-13 Critical Heap Corruption in At Command

This updated at package fixes two minor problems and one majorproblem where the environment can get wiped out prior to the execution of ascheduled command.. ` --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated at package available Advisory ID: RHSA-2002:015-13 Issue date: 2002-01-15 Updated on: 2002-01-22 Product: Red Hat Linux Keywords: at security heap corruption environment Cross references: Obsoletes: --------------------------------------------------------------------- 1. Topic: This updated at package fixes two minor problems and one major problem where the environment can get wiped out prior to the execution of a scheduled command. For versions of Red Hat Linux prior to 7.2, this package also fixes a potential security vulnerability which can result in heap corruption (Red Hat Linux 7.2 is not vulnerable to this security exploit). 2. Relevant releases/architectures: Red Hat Linux 6.2 - alpha, i386, sparc Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - alpha, i386, ia64 Red Hat Linux 7.2 - i386, ia64 3. Problem description: A server running the latest version of at could have commands that depend on the current environment (for example, the PATH) which would then fail or run incorrectly because the environment would not be accessible when the command was executed at a later time. Additionally, in versions of Red Hat Linux prior to 7.2 a malicious local user could specify an execution time is in a carefully drafted format causing a heap corruption bug. Since the at command is installed as setuid root this bug can be exploited. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2002-0004 to this issue. Thanks to zen-parse for reporting this vulnerability. In addition to the fixed heap corruption, file handling security on all versions of at has been improved by adding the O_EXCL (exclusive)option to an open system call. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed ( for more info): 49491 - all environment is wiped out prior to executing user command 51253 - Wrong pointer to time syntax in man page 52626 - "at" RPM says that /var/spool/at/.SEQ should be executable 6. RPMs required: Red Hat Linux 6.2: SRPMS: alpha: i386: sparc: Red Hat Linux 7.0: SRPMS: alpha: i386: Red Hat Linux 7.1: SRPMS: alpha: i386: ia64: Red Hat Linux 7.2: SRPMS: i386: ia64: 7. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 5b1f2e0e4550656350e4b62dfe8ef81a 6.2/en/os/SRPMS/at-3.1.8-22.1.src.rpm 80d3f915ed8a399e410bbf67ce0ec2c1 6.2/en/os/alpha/at-3.1.8-22.1.alpha.rpm bd561541cff149adfd32e5a10d668a8f 6.2/en/os/i386/at-3.1.8-22.1.i386.rpm 4addbc688eb427e6b311aed8fb10f07e 6.2/en/os/sparc/at-3.1.8-22.1.sparc.rpm b1f62f4b41e12a54a1f73d639363a638 7.0/en/os/SRPMS/at-3.1.8-23.src.rpm 97e27a1d2dc0f08d8f118209a891689a 7.0/en/os/alpha/at-3.1.8-23.alpha.rpm ea793fd803f10c8fa66abb8191fefb9b 7.0/en/os/i386/at-3.1.8-23.i386.rpm b1f62f4b41e12a54a1f73d639363a6387.1/en/os/SRPMS/at-3.1.8-23.src.rpm 97e27a1d2dc0f08d8f118209a891689a 7.1/en/os/alpha/at-3.1.8-23.alpha.rpm ea793fd803f10c8fa66abb8191fefb9b 7.1/en/os/i386/at-3.1.8-23.i386.rpm 8fed88d53824e98f509289c42ea01237 7.1/en/os/ia64/at-3.1.8-23.ia64.rpm b1f62f4b41e12a54a1f73d639363a638 7.2/en/os/SRPMS/at-3.1.8-23.src.rpm ea793fd803f10c8fa66abb8191fefb9b 7.2/en/os/i386/at-3.1.8-23.i386.rpm 8fed88d53824e98f509289c42ea01237 7.2/en/os/ia64/at-3.1.8-23.ia64.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: About You can verify each package with the following command: rpm --checksig If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg 8. References: CVE -CVE-2002-0004 Copyright(c) 2000, 2001, 2002 Red Hat, Inc. `. A critical security advisory for Red Hat Linux addressing heap corruption in the at command to prevent local exploits.. Red Hat, Heap Corruption, At Command, Linux Update, Package Management. . Severity: Critical. LinuxSecurity.com Team

Calendar 2 Jan 23, 2002 Critical Red Hat
100

SuSE: 2002:003 Moderate: At Command Heap Corruption Severity

The at command may crash as a result of a surplus call to free(). The cause of the crash is a heap corruption that is exploitable under certain circumstances since the /usr/bin/at command is installed setuid root.. ______________________________________________________________________________ SuSE Security Announcement Package: at Announcement-ID: SuSE-SA:2002:003 Date: Wednesday, Jan 16th 2001 16:00 MET Affected SuSE versions: 6.4, 7.0, 7.1, 7.2, 7.3 Vulnerability Type: local privilege escalation Severity (1-10): 5 SuSE default package: yes Other affected systems: most Linux systems with the at package installed Content of this advisory: 1) security vulnerability resolved: at problem description, discussion, solution and upgrade information 2) pending vulnerabilities, solutions, workarounds 3) standard appendix (further information) ______________________________________________________________________________ 1) problem description, brief discussion, solution, upgrade information The 'at' command reads commands from standard input for execution at a later time specified on the command line. If such an execution time is given in a carefully drafted (but wrong) format, the at command may crash as a result of a surplus call to free(). The cause of the crash is a heap corruption that is exploitable under certain circumstances since the /usr/bin/at command is installed setuid root. A temporary workaround against the bug is to disable the at command for non-root users by removing the setuid-bit from the /usr/bin/at command. As a permanent solution it is recommended to install the update packages as listed for download below. In addition to the fixed heap corruption, file handling security has been improved by adding the O_EXCL (exclusive) option to an open(2) system call inside the at(1) code. We thank zen-parse for reporting this vulnerability. Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement. Then, install the package using the command "rpm -Fhv file.rpm" to apply the update. i386 Intel Platform: SuSE-7.3 db3d2bd38f81667dcece38d1c4a86725 source rpm: 82701057fc8ea3217800b0ab1e2e544b SuSE-7.2 91b759e6a8d433273c5567ed26735690 source rpm: 3df6d6d708d4ef90515f6f1fbbdea5bf SuSE-7.1 73eb22d5c958c17e264fd31ec339b763 source rpm: 1303a1328f31313a62f5645f7cb476ef SuSE-7.0 3179e64f87371d7864d1956ceb9bd020 source rpm: 67efafe83908ac53fc54acac9a0f056b SuSE-6.4 aaffed7c302b9ec42885087296c6f0a1 source rpm: 374cf4374fbe1e66ab2e685aa0449034 Sparc Platform: SuSE-7.3 ec76d45245ef917e22f5f1a863a89988 source rpm: 40de9490a06bd294ad6a7f90e682c0cd SuSE-7.1 27f575762c0b1643008968a167324347 source rpm: 66546dc729e071039595a13d01feacfb SuSE-7.0 98007292769f55e4239b6922157bfa13 source rpm: 2d20cdbb10680282596677aac3106f30 AXP Alpha Platform: SuSE-7.1 df71ebf25a2252637ee1421d08779b8d source rpm: b8b3a4f80e0d19e0211131ca58c1e0fe SuSE-7.0 0bc21b9ddc12746a17592fa74473bbf6 source rpm: 4d93aa10b426224936e3de357540ea49 SuSE-6.4 aeb76c2eb37f7e442c49c7ba3c5e44a5 source rpm: 6d783c34eb0b855a96736e58d67bc053 PPC Power PC Platform: SuSE-7.3 111bd6e813ef33265035b21d19776b49 source rpm: fa2ee9aca5b73009b1d9c90731265a19 SuSE-7.1 868a1662f751823432d3d881edd371cd source rpm: d759233bfc2ce230e1c46d2ec0f15a73 SuSE-7.0 7b12fe4b5f31434eb7cf3c0caae75811 source rpm: 4c6e2724bb76e08be66831ed85c60f85 SuSE-6.4 7ebc9a1fde97f5ac8226b9e17621a40b source rpm: fa3c5e08703eb54b4f493de56ec837bb ______________________________________________________________________________ 2) Pending vulnerabilities in SuSE Linux Distributions and Workarounds: - clanlib This email address is being protected from spambots. You need JavaScript enabled to view it. reported an environment variable copying buffer overflow in the clanlib package. If a program that is linked against the clanlib shared library is installed setuid or setgid, this error may lead to elevated privileges. In the case of SuSE Linux distributions, this is only the case for the methane package: It comes installed with a setgid bit to group "game", which is used to store highscores in group- writeable files. This setgid bit will be cleared in future releases of the SuSE Linux distribution. For already installed "methane" packages, we recommend to remove the setgid bit with the command chmod -s /usr/X11R6/bin/methane The methane package is not installed on SuSE systems by default, nor is the defective library "clanlib". - thttpd The thttpd daemon contained several off-by-one overflows. Due to internal organization of the variables affected by these overflows, they seem not exploitable. However, these bugs have been fixed. Please update to the newest thttpd packages. - pine The popular mail client "pine" was found vulnerable to an attack where shell metacharacters inside an URL could be used to execute arbitrary commands if pine passes the URL to an external viewer on the commandline. The pine packages on SuSE products are not vulnerable to this weakness because they contain a patch that works around this problem since it is not new. - xchat We are working on updates for the xchat packages in the SuSE Linux 7.0 and 7.1 distributionsthat are vulnerable to an encoding bug while receiving and decoding ctcp datagrams. This bug can lead an xchat IRC client to execute IRC protocol specific commands to an IRC server such as channel mode changes. ______________________________________________________________________________ 3) standard appendix: authenticity verification, additional information - Package authenticity verification: SuSE update packages are available on many mirror ftp servers all over the world. While this service is being considered valuable and important to the free and open source software community, many users wish to be sure about the origin of the package and its content before installing the package. There are two verification methods that can be used independently from each other to prove the authenticity of a downloaded file or rpm package: 1) md5sums as provided in the (cryptographically signed) announcement. 2) using the internal gpg signatures of the rpm package. 1) execute the command md5sum after you downloaded the file from a SuSE ftp server or its mirrors. Then, compare the resulting md5sum with the one that is listed in the announcement. Since the announcement containing the checksums is cryptographically signed (usually using the key This email address is being protected from spambots. You need JavaScript enabled to view it. ), the checksums show proof of the authenticity of the package. We disrecommend to subscribe to security lists which cause the email message containing the announcement to be modified so that the signature does not match after transport through the mailing list software. Downsides: You must be able to verify the authenticity of the announcement in the first place. If RPM packages are being rebuilt and a new version of a package is published on the ftp server, all md5 sums for the files are useless. 2) rpm package signatures provide an easy way to verify the authenticity of an rpm package. Use thecommand rpm -v --checksig to verify the signature of the package, where is the filename of the rpm package that you have downloaded. Of course, package authenticity verification can only target an uninstalled rpm package file. Prerequisites: a) gpg is installed b) The package is signed using a certain key. The public part of this key must be installed by the gpg program in the directory ~/.gnupg/ under the user's home directory who performs the signature verification (usually root). You can import the key that is used by SuSE in rpm packages for SuSE Linux by saving this announcement to a file ("announcement.txt") and running the command (do "su -" to be root): gpg --batch; gpg < announcement.txt | gpg --import SuSE Linux distributions version 7.1 and thereafter install the key " This email address is being protected from spambots. You need JavaScript enabled to view it. " upon installation or upgrade, provided that the package gpg is installed. The file containing the public key is placed at the toplevel directory of the first CD (pubring.gpg) and at . - SuSE runs two security mailing lists to which any interested party may subscribe: This email address is being protected from spambots. You need JavaScript enabled to view it. - general/linux/SuSE security discussion. All SuSE security announcements are sent to this list. To subscribe, send an email to . This email address is being protected from spambots. You need JavaScript enabled to view it. - SuSE's announce-only mailing list. Only SuSE's security annoucements are sent to this list. To subscribe, send an email to . For general information or the frequently asked questions (faq) send mail to: or respectively. ==================================================================== SuSE's security contact is or . The public key is listed below. ====================================================================______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, it is desired that the cleartext signature shows proof of the authenticity of the text. SuSE GmbH makes no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.0.6 (GNU/Linux) Comment: For info see The GNU Privacy Guard mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohc BBMRAgAcBQI57vSBBQkDwmcABAsKAwQDFQMCAxYCAQIXgAAKCRCoTtronIAKyl8s AJ98BgD40zw0GHJHIf6dNfnwI2PAsgCgjH1+PnYEl7TFjtZsqhezX7vZvYCIRgQQ EQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lxyoAejACe OO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWnB/9An5vf iUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDVwM2OgSEI SZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVhUzneOA9g TPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF5Yryk23p QUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3D3EN8C1y PqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGuzgpJt9IX SzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd9DYJ8UUT mIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Via5/gO7fJ EpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13CNZZNZfD qnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp271hhQBe RmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlEt5ucTXst Zy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMGB/9g+9V3 ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZwrbSTM5Lp C/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6TtIJlGG6pq UN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFLrWn7mfoG x6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5HRKMWpO+M 9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMag8zFbpeq PQUsDv9V7CAJ1dbriEwEGBECAAwFAjnu9JIFCQPCZwAACgkQqE7a6JyACspLIgCb BQd/++0pB9yZWDhqxHtTpdCXRsAAnik7bYHlTxQfohiXYsEJcWrDn7l8 =ojbD -----END PGP PUBLIC KEY BLOCK----- . SuSE Security Advisory regarding the 'at' command, emphasizing risks associated with local privilege escalation while providing detailed solutions to mitigate these issues.. local privilege escalation, SuSE updates, at command fix. . LinuxSecurity.com Team

Calendar 2 Jan 16, 2002 SuSE
News Add Esm H240

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Community Poll

What got you started with Linux?

No answer selected. Please try again.
Please select either existing option or enter your own, however not both.
Please select minimum {0} answer(s).
Please select maximum {0} answer(s).
/main-polls/150-what-got-you-started-with-linux?task=poll.vote&format=json
150
radio
0
[{"id":483,"title":"Self-taught through trial and error","votes":545,"type":"x","order":1,"pct":78.42,"resources":[]},{"id":484,"title":"Formal training or courses","votes":30,"type":"x","order":2,"pct":4.32,"resources":[]},{"id":485,"title":"A job that required it","votes":34,"type":"x","order":3,"pct":4.89,"resources":[]},{"id":486,"title":"Other","votes":86,"type":"x","order":4,"pct":12.37,"resources":[]}] ["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"] ["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"] 350
bottom 200
Your message here