sccw does insufficient bounds checking, trust it's environment and calls insecure system functions. On a default installation sccw is setuid root. . ______________________________________________________________________________ SuSE Security Announcement Package: sccw-1.x Date: Mon Sep 27 23:06:13 CEST 1999 Affected: all Linux distributions using sccw 1.x ______________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description sccw does insufficient bounds checking, trust it's environment and calls insecure system functions. On a default installation sccw is setuid root. 2. Impact These bugs lead to local root compromise. 3. Solution Updated the sccw package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: 3b2fc3d5025f1298e460ad26735af601 sccw-1.1-39.i386.rpm 373435f60b236c8d52ee535021471e4c sccw-1.1-39.src.rpm ______________________________________________________________________________ You will find the update on our ftp-Server: Webpage for patches: https://www.suse.com/de-de/ or try the following web pages for a list of mirrors: https://www.suse.com/de-de/ ______________________________________________________________________________ . Unearth a vital vulnerability in sccw: incorporate guidance for patching and effects on Unix systems featured.. sccw Security, Local Root Compromise, System Exploit, Update Instructions. . Severity: Critical. LinuxSecurity.com Team
The /usr/bin/sccw tool can be used to read any file on the system. . ______________________________________________________________________________ SuSE Security Announcement Package: sccw-1.1 and earlier Date: Mon Sep 20 23:40:09 CEST 1999 Affected: all Linux distributions using sccw _____________________________________________________________________________ A security hole was discovered in the package mentioned above. Please update as soon as possible or disable the service if you are using this software on your SuSE Linux installation(s). Other Linux distributions or operating systems might be affected as well, please contact your vendor for information about this issue. Please note, that that we provide this information on as "as-is" basis only. There is no warranty whatsoever and no liability for any direct, indirect or incidental damage arising from this information or the installation of the update package. _____________________________________________________________________________ 1. Problem Description The /usr/bin/sccw tool can be used to read any file on the system. 2. Impact An attacker can read e.g the /etc/shadow file or private email. 3. Solution Updated the sccw package from our FTP server. ______________________________________________________________________________ Here are the md5 checksums of the upgrade packages, please verify these before installing the new packages: f70f788861bf0ee402405a7dc14431a sccw-1.1-32.i386.rpm (6.2) ______________________________________________________________________________ You will find the update on our ftp-Server: Webpage for patches: https://www.suse.com/de-de/ or try the following web pages for a list of mirrors: https://www.suse.com/de-de/ ______________________________________________________________________________ SuSE has got two free security mailing list services to which any interested party may subscribe:
Get the latest Linux and open source security news straight to your inbox.