OpenLinux: util-linux could leak sensitive data

[please_reply_to_security@xxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


______________________________________________________________________________

                        SCO Security Advisory

Subject:                OpenLinux: util-linux could leak sensitive data
Advisory number:        CSSA-2004-016.0
Issue date:             2004 March 30
Cross reference:        sr889555 fz528943 erg712558 CAN-2004-0080
______________________________________________________________________________


1. Problem Description

        The login program in util-linux 2.11 and earlier uses a pointer
        after it has been freed and reallocated, which could cause login
        to leak sensitive data. 

        The Common Vulnerabilities and Exposures project (cve.mitre.org) 
        has assigned the name CAN-2004-0080 to this issue.


2. Vulnerable Supported Versions

        System                          Package
        ----------------------------------------------------------------------
        OpenLinux 3.1.1 Server          prior to util-linux-2.12-1.i386.rpm
        OpenLinux 3.1.1 Workstation     prior to util-linux-2.12-1.i386.rpm


3. Solution

        The proper solution is to install the latest packages. Unix
        users with Linux Kernel Personality can use the Caldera System
        Updater, called cupdate (or kcupdate under the KDE environment),
        to update these packages rather than downloading and installing
        them by hand.


4. OpenLinux 3.1.1 Server

        4.1 Package Location

        
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/RPMS

        4.2 Packages

        43420f997baa5875bba02bc8df410f88        util-linux-2.12-1.i386.rpm

        4.3 Installation

        rpm -Fvh util-linux-2.12-1.i386.rpm

        4.4 Source Package Location

        
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/SRPMS

        4.5 Source Packages

        7a014652e2029b4dda3209b62e1ba375        util-linux-2.12-1.src.rpm


5. OpenLinux 3.1.1 Workstation

        5.1 Package Location

        
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/RPMS

        5.2 Packages

        cff227fcbc2d7e121e2134927b86a125        util-linux-2.12-1.i386.rpm

        5.3 Installation

        rpm -Fvh util-linux-2.12-1.i386.rpm

        5.4 Source Package Location

        
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.0/SRPMS

        5.5 Source Packages

        24c22395492db21fbd62d4c0419ec524        util-linux-2.12-1.src.rpm


6. References

        Specific references for this advisory:
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0080

        SCO security resources:
                http://www.sco.com/support/security/index.html

        This security fix closes SCO incidents sr889555 fz528943
        erg712558.


7. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers intended
        to promote secure installation and use of SCO products.


8. Acknowledgements

        SCO would like to thank Red Hat

______________________________________________________________________________

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFAaicYbluZssSXDTERAiYeAKCHSVw69wPHlur/nqPZsza0udGKYwCgjDSp
qC3DOMlPqfQ9oF7NMT69ci0=
=Mr4Z
-----END PGP SIGNATURE-----