Util-linux File Locking Race Condition Vulnerability

Util-linux File Locking Race Condition Vulnerability

Solution:
An unofficial source code patch is available. Red Hat has released fixes in bulletin RHSA-2002:132-14 (see references section).

Users of HP Secure OS Software for Linux Release 1.0 are advised to install the available Red Hat fixes.

SCO has released a security advisory. Fixes are available.

Fixes:

RedHat util-linux-2.10s-12.i386.rpm

Red Hat util-linux-2.11f-17.7.2.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/util-linux-2.11f-17.7.2.i386.r pm

RedHat util-linux-2.11n-12.i386.rpm

Red Hat util-linux-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/util-linux-2.11n-12.7.3.i386.r pm

RedHat util-linux-2.10m-12.i386.rpm

Red Hat util-linux-2.10m-12.7.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/util-linux-2.10m-12.7.0.i386.r pm

RedHat mount-2.11n-12.i386.rpm

Red Hat mount-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mount-2.11n-12.7.3.i386.rpm

RedHat util-linux-2.10f-7.i386.rpm

Red Hat util-linux-2.10f-7.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/util-linux-2.10f-7.6.2.i386.rp m

RedHat losetup-2.11n-12.i386.rpm

Red Hat losetup-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/losetup-2.11n-12.7.3.i386.rpm

MandrakeSoft Corporate Server 1.0.1

Mandrake util-linux-2.10o-6.1mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

Caldera OpenLinux Server 3.1

SCO util-linux-2.11l-5.1.i386.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-043.0/RPM S

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-043.0/SRP MS

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043. 0/SRPMS

Caldera OpenLinux Workstation 3.1

SCO util-linux-2.11l-5.1.i386.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043. 0/RPMS

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043. 0/SRPMS

Caldera OpenLinux Server 3.1.1

SCO util-linux-2.11l-5.1.i386.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-043.0/R PMS

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-043.0/S RPMS

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-043. 0/SRPMS

Caldera OpenLinux Workstation 3.1.1

SCO util-linux-2.11l-5.1.i386.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-04 3.0/RPMS

SCO util-linux-2.11l-5.1.src.rpm
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-04 3.0/SRPMS

Conectiva Linux 6.0

Conectiva util-linux-2.10o-2U60_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/util-linux-2.10o-2U60_1cl .i386.rpm

RedHat Linux 6.2

Red Hat util-linux-2.10f-7.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/util-linux-2.10f-7.6.2.i386.rp m

Red Hat util-linux-2.10f-7.6.2.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/util-linux-2.10f-7.6.2.src.rp m

RedHat Linux 6.2 alpha

Red Hat util-linux-2.10f-7.6.2.alpha.rpm
ftp://updates.redhat.com/6.2/en/os/alpha/util-linux-2.10f-7.6.2.alpha. rpm

Red Hat util-linux-2.10f-7.6.2.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/util-linux-2.10f-7.6.2.src.rp m

RedHat Linux 6.2 sparc

Red Hat util-linux-2.10f-7.6.2.sparc.rpm
ftp://updates.redhat.com/6.2/en/os/sparc/util-linux-2.10f-7.6.2.sparc. rpm

Red Hat util-linux-2.10f-7.6.2.src.rpm
ftp://updates.redhat.com/6.2/en/os/SRPMS/util-linux-2.10f-7.6.2.src.rp m

Conectiva Linux 7.0

Conectiva util-linux-2.10s-4U70_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/util-linux-2.10s-4U70_1cl .i386.rpm

RedHat Linux 7.0

Red Hat util-linux-2.10m-12.7.0.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/util-linux-2.10m-12.7.0.i386.r pm

Red Hat util-linux-2.10m-12.7.0.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/util-linux-2.10m-12.7.0.src.r pm

RedHat Linux 7.0 alpha

Red Hat util-linux-2.10m-12.7.0.alpha.rpm
ftp://updates.redhat.com/7.0/en/os/alpha/util-linux-2.10m-12.7.0.alpha .rpm

Red Hat util-linux-2.10m-12.7.0.src.rpm
ftp://updates.redhat.com/7.0/en/os/SRPMS/util-linux-2.10m-12.7.0.src.r pm

MandrakeSoft Linux Mandrake 7.1

Mandrake util-linux-2.10o-6.1mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

RedHat Linux 7.1 alpha

Red Hat util-linux-2.11f-17.7.2.alpha.rpm
ftp://updates.redhat.com/7.1/en/os/alpha/util-linux-2.11f-17.7.2.alpha .rpm

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

RedHat Linux 7.1 ia64

Red Hat util-linux-2.11f-17.7.2.ia64.rpm
ftp://updates.redhat.com/7.1/en/os/ia64/util-linux-2.11f-17.7.2.ia64.r pm

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

RedHat Linux 7.1

Red Hat util-linux-2.11f-17.7.2.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/util-linux-2.11f-17.7.2.i386.r pm

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.1/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

MandrakeSoft Linux Mandrake 7.2

Mandrake util-linux-2.10o-6.1mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

RedHat Linux 7.2 ia64

Red Hat util-linux-2.11f-17.7.2.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/util-linux-2.11f-17.7.2.ia64.r pm

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

RedHat Linux 7.2

Red Hat util-linux-2.11f-17.7.2.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/util-linux-2.11f-17.7.2.i386.r pm

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

MandrakeSoft Single Network Firewall 7.2

Mandrake util-linux-2.10o-6.1mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

RedHat Linux 7.2 alpha

Red Hat util-linux-2.11f-17.7.2.src.rpm
ftp://updates.redhat.com/7.2/en/os/SRPMS/util-linux-2.11f-17.7.2.src.r pm

RedHat Linux 7.3

Michal Zalewski setpwnam.patch
Unofficial source code patch. Applies to util-linux-2.11nn.
http://www.securityfocus.com/data/vulnerabilities/patches/setpwnam.pat ch

Red Hat losetup-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/losetup-2.11n-12.7.3.i386.rpm

Red Hat mount-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/mount-2.11n-12.7.3.i386.rpm

Red Hat util-linux-2.11n-12.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/util-linux-2.11n-12.7.3.i386.r pm

Red Hat util-linux-2.11n-12.7.3.src.rpm
ftp://updates.redhat.com/7.3/en/os/SRPMS/util-linux-2.11n-12.7.3.src.r pm

MandrakeSoft Linux Mandrake 8.0 ppc

Mandrake util-linux-2.11h-3.5mdk.ppc.rpm
http://www.mandrakesecure.net/en/ftp.php

Conectiva Linux 8.0

Conectiva util-linux-2.11n-4U80_1cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/util-linux-2.11n-4U80_1cl.i 386.rpm

MandrakeSoft Linux Mandrake 8.0

Mandrake util-linux-2.10s-3.2mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.1 ia64

Mandrake util-linux-2.11h-3.5mdk.ia64.rpm
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.1

Mandrake util-linux-2.11h-3.5mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.2

Mandrake losetup-2.11n-4.3mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

Mandrake mount-2.11n-4.3mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

Mandrake util-linux-2.11n-4.3mdk.i586.rpm
http://www.mandrakesecure.net/en/ftp.php

MandrakeSoft Linux Mandrake 8.2 ppc

Mandrake losetup-2.11n-4.3mdk.ppc.rpm
http://www.mandrakesecure.net/en/ftp.php

Mandrake mount-2.11n-4.3mdk.ppc.rpm
http://www.mandrakesecure.net/en/ftp.php

Mandrake util-linux-2.11n-4.3mdk.ppc.rpm
http://www.mandrakesecure.net/en/ftp.php