-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

________________________________________________________________________
______

SCO Security Advisory

Subject: OpenLinux: util-linux could leak sensitive data
Advisory number: CSSA-2004-016.0
Issue date: 2004 March 30
Cross reference: sr889555 fz528943 erg712558 CAN-2004-0080
________________________________________________________________________
______

1. Problem Description

The login program in util-linux 2.11 and earlier uses a pointer
after it has been freed and reallocated, which could cause login
to leak sensitive data.

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2004-0080 to this issue.

2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------
OpenLinux 3.1.1 Server prior to util-linux-2.12-1.i386.rpm
OpenLinux 3.1.1 Workstation prior to util-linux-2.12-1.i386.rpm

3. Solution

The proper solution is to install the latest packages. Unix
users with Linux Kernel Personality can use the Caldera System
Updater, called cupdate (or kcupdate under the KDE environment),
to update these packages rather than downloading and installing
them by hand.

4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/RPM
S

4.2 Packages

43420f997baa5875bba02bc8df410f88 util-linux-2.12-1.i386.rpm

4.3 Installation

rpm -Fvh util-linux-2.12-1.i386.rpm

4.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-016.0/SRP
MS

4.5 Source Packages

7a014652e2029b4dda3209b62e1ba375 util-linux-2.12-1.src.rpm

5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.
0/RPMS

5.2 Packages

cff227fcbc2d7e121e2134927b86a125 util-linux-2.12-1.i386.rpm

5.3 Installation

rpm -Fvh util-linux-2.12-1.i386.rpm

5.4 Source Package Location

ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-016.
0/SRPMS

5.5 Source Packages

24c22395492db21fbd62d4c0419ec524 util-linux-2.12-1.src.rpm

6. References

Specific references for this advisory:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0080

SCO security resources:
http://www.sco.com/support/security/index.html

This security fix closes SCO incidents sr889555 fz528943
erg712558.

7. Disclaimer

SCO is not responsible for the misuse of any of the information
we provide on this website and/or through our security
advisories. Our advisories are a service to our customers intended
to promote secure installation and use of SCO products.

8. Acknowledgements

SCO would like to thank Red Hat

________________________________________________________________________
______

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (SCO/UNIX_SVR5)

iD8DBQFAaicYbluZssSXDTERAiYeAKCHSVw69wPHlur/nqPZsza0udGKYwCgjDSp
qC3DOMlPqfQ9oF7NMT69ci0=
=Mr4Z
-----END PGP SIGNATURE-----

[ reply ]