A buffer overflow has been found in libtermcap's tgetent() function. If a setuid root program uses this function, the user could execute arbitrary code. SuSE Linux 6.0, 6.1 and 6.2 are not affected, since the only program using libtermcap is bc. This program is not setuid root. . ______________________________________________________________________________ SuSE Security Announcement Package: termcap-2.0.8-x Date: Tue Aug 24 20:08:11 CEST 1999 Affected: all Linux distributions using libtermcap ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description A buffer overflow has been found in libtermcap's tgetent() function. If a setuid root program uses this function, the user could execute arbitrary code. SuSE Linux 6.0, 6.1 and 6.2 are not affected, since the only program using libtermcap is bc. This program is not setuid root. 2. Impact If you install a third party product, which is setuid root and linked against libtermcap, a user could use this buffer overflow to gain root privileges by supplying his own termcap file. 3. Solution Updated the termcap package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installingthe new packages: 8a66d699a86d656f56841b2c597a8ef9 termcap-2.0.8-80.alpha.rpm 662c6bacad9e9eedfa9333afada4d338 termcap-2.0.8-80.i386.rpm (6.1) 1ccf4946caa99e0ffbed5fab6a0e768c termcap-2.0.8-80.i386.rpm (6.2) ______________________________________________________________________________ You will find the update on our ftp-Server: Webpage for patches: https://www.suse.com/de-de/ or try the following web pages for a list of mirrors: https://www.suse.com/de-de/ ______________________________________________________________________________ . Critical security alert for all operating systems utilizing libtermcap: potential buffer overflow vulnerability may enable remote code execution.. Buffer Overflow, Libtermcap, Code Execution Risk. . Severity: Critical. LinuxSecurity.com Team
A buffer overflow has been fixed in the tgetent() function of libtermcap. . Red Hat, Inc. Security Advisory Package libtermcap Synopsis Buffer overflow in libtermcap tgetent() Advisory ID RHSA-1999:028-01 Issue Date 1999-08-17 Updated on Keywords termcap xterm 1. Topic: A buffer overflow has been fixed in the tgetent() function of libtermcap. 2. Bug IDs fixed: 4538 3. Relevant releases/architectures: Red Hat Linux 6.0, all architectures 4. Obsoleted by: None 5. Conflicts with: None 6. RPMs required: Intel: libtermcap-2.0.8-15.i386.rpm libtermcap-devel-2.0.8-15.i386.rpm Alpha: libtermcap-2.0.8-15.alpha.rpm libtermcap-devel-2.0.8-15.alpha.rpm SPARC: libtermcap-2.0.8-15.sparc.rpm libtermcap-devel-2.0.8-15.sparc.rpm Source: libtermcap-2.0.8-15.src.rpm Architecture neutral: 7. Problem description: A buffer overflow existed in libtermcap's tgetent() function, which could cause the user to execute arbitrary code if they were able to supply their own termcap file. Under Red Hat Linux 5.2 and 4.2, this could lead to local users gaining root privileges, as xterm (as well as other possibly setuid programs) are linked against libtermcap. Under Red Hat Linux 6.0, xterm is not setuid root. Thanks go to Kevin Vajk and the Linux Security Audit team for noting and providing a fix for this vulnerability. 8. Solution: For each RPM for your particular architecture, run: rpm -Uvh filename where filename is the name of the RPM. 9. Verification: MD5 sum Package Name ------------------------------------------------------------------------- 4995cf0a7c181abe56565d82f12c7819 i386/libtermcap-2.0.8-15.i386.rpm 59d18de3f22abe5674575961b1390177 i386/libtermcap-devel-2.0.8-15.i386.rpm 611cdfb7f167242e7d3b2eaac866705a alpha/libtermcap-2.0.8-15.alpha.rpm 76098235237b5f051ad1266193d7b259 alpha/libtermcap-devel-2.0.8-15.alpha.rpm 846ad7a73b25d3eceab1949322337e14 sparc/libtermcap-2.0.8-15.sparc.rpm 6ddde808ec8b5bc7960851ef3188a6dd sparc/libtermcap-devel-2.0.8-15.sparc.rpm 6a29851494601540d642ff557bd590d6 SRPMS/libtermcap-2.0.8-15.src.rpm These packages are also PGP signed by Red Hat Inc. for security. Our key is available at: You can verify each package with the following command: rpm --checksig filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp filename 10. References: . Ubuntu release note: security patch applied in libselinux setfiles, vital for protecting user data.. Red Hat Advisory, Libtermcap Fix, Security Advisory. . Severity: Critical. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.