Specifications
SAFER – Vol. 3, Issue 6 7 © 2000 The Relay Group
-
SECURITY ALERTS
We try to inform you of vulnerabilities as soon as they become a threat to your resources, not when
the vendors decide to report them.
Initialized Data Overflow in Xlock
Released May 29, 2000
Affects All systems running xlock
Reference http://www.nai.com/covert
Problem
- An implementation vulnerability in xlock allows global variables in the initialized data section of
memory to be overwritten.
- This creates the potential for local users to view the contents of xlock's memory, including the
shadowed password file, after root privileges have been dropped.
SAFER
- Patches for most UNIX distributions (and source code) have been released.
Linux cdrecord Buffer Overflow Vulnerability
Released May 27, 2000
Affects Linux Mandrake 7.0
Reference http://www.securityfocus.com/bid/1265
Problem
- The linux cdrecorder binary is vulnerable to a locally exploitable buffer overflow attack. When
installed in a Mandrake 7.0 linux distribution, it is by default setgid "cdburner" (which is a group,
gid: 80, that is created for the application). The overflow condition is the result of no bounds
checking on the 'dev=' argument passed to cdburner at execution time.
- This vulnerability can be exploited to execute arbitrary commands with egid "cdburner". cdburner
has been verified (by the writers of the exploit) to be exploitable on an Intel linux system running
Mandrake 7.0. Other distributions of linux may be vulnerable to this problem as well.
- If system has SCSI hard disks, user might be able to gain access to raw disk device and gain root
privileges or render system unstable.
SAFER
- A workaround (until an official patch is released) is to remove the setgid bit from the cdburner
binary.
KDE kdesud DISPLAY Environment Variable Overflow
Released May 27, 2000
Affects KDE 1.2, 1.1.2, 1.1.1, 1.1
Reference http://www.securityfocus.com/bid/1274
Problem
- /usr/bin/kdesud has a DISPLAY environment variable overflow which could allow for the execution
of arbitrary code.
SAFER
- Patch has been released.