-----BEGIN PGP SIGNED MESSAGE-----



______________________________________________________________________________



                        SuSE Security Announcement



        Package:                perl, all versions

        Date:                   Thursday, August 10th, 2000

        Affected SuSE versions: 6.0-6.4, 7.0

        Vulnerability Type:     local root compromise

        Severity (1-10):        5

        SuSE default package:   yes, but not configured exploitable.

        Other affected systems: all linux systems using this package



    Content of this advisory:

        1) security vulnerability resolved: suidperl (local root compromise)

           problem description, discussion, solution and upgrade information

        2) pending vulnerabilities, temporary workarounds

           (Netscape)

        3) standard appendix (further information)





______________________________________________________________________________



1)  problem description, brief discussion, solution, upgrade information



    suidperl is the perl interpreter for suid perl scripts, a part of the

    perl package. A maliciously implemented feature causes the interpreter

    to spawn the /bin/mail program to inform the superuser of its usage,

    thereby passing on untrusted environment that causes /bin/mail to 

    execute arbitrary commands as user root. 



    SuSE distributions are not susceptible to this problem because 

    /usr/bin/suidperl is mode 755 (not suid) by default. Administrators

    must explicitly have enabled suidperl by changing the permission modes

    of the interpreter to 4755 root.root (suid root) for the exploit 

    mechanism to work.

    In SuSE-Linux, activating suidperl is done by changing one of the 

    files /etc/permissions.(easy|secure) and running SuSEconfig or

    `chkstat -set /etc/permissions.(easy|secure)', alternatively, 

    depending on the setting of PERMISSION_SECURITY in /etc/rc.config.

    If SuSEconfig is turned off completely, the administrator of the 

    system is obliged to change the permission modes by hand.

    The decision to not activate suidperl has been made because

    security problems were expected in the wild.

    O/S vendors have provided updated packages for both suidperl and

    mailx, the package containing /bin/mail. Basically, /bin/mail's

    fetures are not the origin of the security hole because the

    hostile environment is passed on by the suidperl interpreter,

    despite the fact that the interpreter runs suid root.



    Note: The upcoming SuSE-7.0 distribution _is_ vulnerable to the 

          problem of this advisory if /usr/bin/suidperl is setuid root.

          However, suidperl is installed with mode 755 after the

          installation like in older SuSE Linux distributions and 

          therefore can't be exploited without prior manual activation

          of suidperl by the system administrator.



    SuSE provides an updated package for the vulnerable software. It is

    strongly recommended to upgrade to the latest version found on our

    ftp server as described below. The package removes the mail 

    notification and uses the syslog facility (priority warning) instead.



    Chose one of the following paths to download the package from our 

    ftp server and install the package with the command `rpm -Fhv file.rpm'.

    The md5sum for each file is in the line below.

    You can verify the integrity of the rpm files using the command

        `rpm --checksig --nogpg file.rpm', independently from the md5 

    signatures below.



    i386 Intel Platform:



      SuSE-7.0

      http://ftp.suse.com/pub/suse/i386/update/7.0/a1/perl.rpm

        01c855f752b835536403c7bcc74d8114

      source rpm:

      http://ftp.suse.com/pub/suse/i386/update/7.0/zq1/perl.spm

        16c850efed03cc5bd5b9bff3910dd6e4



      SuSE-6.4

      http://ftp.suse.com/pub/suse/i386/update/6.4/a1/perl.rpm

        0640e11ba0b87f0d8a01b4b5dedbb8eb

      source rpm:

      http://ftp.suse.com/pub/suse/i386/update/6.4/zq1/perl.spm

        a68ade45a65e73805b2276ad35266d46



      SuSE-6.3

      http://ftp.suse.com/pub/suse/i386/update/6.3/a1/perl.rpm

        7a3c2adae0c556a7ccb647eaca34e6c7

      source rpm:

      http://ftp.suse.com/pub/suse/i386/update/6.3/zq1/perl.spm

        6bc207d360a1349f8f8067a83061f848



      SuSE-6.2

      http://ftp.suse.com/pub/suse/i386/update/6.2/a1/perl.rpm

        6403b21d3795def485ad4a577a38c3be

      source rpm:

      http://ftp.suse.com/pub/suse/i386/update/6.2/zq1/perl.spm

        47760a9798dc1489ca9fd2ee3a1756f6



      SuSE-6.1

      http://ftp.suse.com/pub/suse/i386/update/6.1/a1/perl.rpm

        ac14b4fccfb10e5465f377b095621730

      source rpm:

      http://ftp.suse.com/pub/suse/i386/update/6.1/zq1/perl.spm

        7d3aec7879fabcac3d2b7e4996340c31



    AXP Alpha Platform:

      SuSE-6.4

      http://ftp.suse.com/pub/suse/axp/update/6.4/a1/perl.rpm

        47853649c4683748558dbb72f759d739

      source rpm:

      http://ftp.suse.com/pub/suse/axp/update/6.4/zq1/perl.spm

        5949a68b6126afdca98224cd6ed4be74

      SuSE-6.3

      http://ftp.suse.com/pub/suse/axp/update/6.3/a1/perl.rpm

        994804e426adf718df64162c92a1ce84

      source rpm:

      http://ftp.suse.com/pub/suse/axp/update/6.3/zq1/perl.spm

        879238a9e443bbe32cc4d421ed9a5d28

      SuSE-6.1

      http://ftp.suse.com/pub/suse/axp/update/6.1/a1/perl.rpm

        cf2d763fb562a75395c5e613704cbd10

      source rpm:

      http://ftp.suse.com/pub/suse/axp/update/6.1/zq1/perl.spm

        e0aa5d0c91f474592e56eed2a8b3fae0



    PPC Power PC Platform:

      SuSE-6.4

      http://ftp.suse.com/pub/suse/ppc/update/6.4/a1/perl.rpm

        828a210ef2b3aa462161010d4d19416a

      source rpm:

      http://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/perl.spm

        9253498d7c474ad2e9f8dabe576d2c96



______________________________________________________________________________



2)  Pending vulnerabilities in SuSE Distributions and Workarounds



    This section addresses currently known vulnerabilities in Linux/Unix

    systems that have not been resolved up to the release date of this

    advisory.



    - Netscape, versions from 3.0 to 4.73:



        The latest version of Netscape is currently being tested. SuSE 

        Netscape rpms contain efficient workarounds against some "morbid"

        properties of Netscape in order to provide stable packages.

        These additions are being reworked right now. 

        Also, cryprographical software export regulations require us to 

        wait for the permission to redistribute the netscape package from 

        our US-American ftp server. 

        There are currently two known vulnerabilities in Netscape versions

        from 3.0 to 4.73:

            a) a buffer overflow in the jpeg image handling code

            b) a security flaw in Netscape's Java implementation

        a) has been fixed in Netscape version 4.74. Updated packages 

        from SuSE will follow very soon.

        Temporary fix/workaround:

            problem a) Turn off automatic image loading and do not

                       click on images to trigger the download. This may

                       be a fairly unsatisfying solution.

            problem b) Turn off Java and JavaScript.



    - ntop



        ntop is a network statistics visualization utility which offers

        graphical analysis of network traffic and other statistics with

        a web browser. By default, ntop listens on port 3000 and requires

        no or a commonly known authentication password to view the data.

        ntop is only installed in network server selections and is not 

        activated by default in SuSE Linux installations.

        The ntop packages shipped with SuSE Linux did not exhibit the 

        unsafe behaviour when a file like /../../etc/passwd is referenced.

______________________________________________________________________________



3)  standard appendix:



    SuSE runs two security mailing lists to which any interested party may

    subscribe:



    suse-security@suse.com

        -   general/linux/SuSE security discussion. 

            All SuSE security announcements are sent to this list.

            To subscribe, send an email to 

                .



    suse-security-announce@suse.com

        -   SuSE's announce-only mailing list.

            Only SuSE's security annoucements are sent to this list.

            To subscribe, send an email to

                .



    For general information or the frequently asked questions (faq) 

    send mail to:

         or

         respectively.



    ===============================================

    SuSE's security contact is .

    ===============================================



Regards,

Roman Drahtmüller.

- -- 

 -                                                                      -

| Roman Drahtmüller       //          "Caution: Cape does |

  SuSE GmbH - Security           Phone: //       not enable user to fly."

| Nürnberg, Germany     +49-911-740530 // (Batman Costume warning label) |

 -                                                                      -

______________________________________________________________________________



    The information in this advisory may be distributed or reproduced,

    provided that the advisory is not modified in any way.

    SuSE GmbH makes no warranties of any kind whatsoever with respect 

    to the information contained in this security advisory.



Type Bits/KeyID    Date       User ID

pub  2048/3D25D3D9 1999/03/06 SuSE Security Team 



- -----BEGIN PGP PUBLIC KEY BLOCK-----

Version: 2.6.3i



mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA

BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz

JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh

1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U

P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+

cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg

VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b

yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7

tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ

xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63

Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo

choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI

BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u

v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+

x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0

Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq

MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2

saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o

L0oixF12Cg==

=pIeS

- -----END PGP PUBLIC KEY BLOCK-----



-----BEGIN PGP SIGNATURE-----

Version: 2.6.3i

Charset: noconv



iQEVAwUBOZKEsXey5gA9JdPZAQFC7QgAlEgNyaJD76ACM/at0kHGPwNTby2P3gr4

Z8eQwoQ6N4CCh6BaJV+3AWRx0EELOu+vJ4mD6HMwTZDYS5GKxsvquz3ZD7ygLYDS

RZnj9INehSp+LRdznqzE8LO0lHY3hy7budshTT4tLBrL90Ic6K3r76NokSH8Td6W

AJVXtDyzxfCUx5h8grrmalVAJVh9kqdwls8X0o+Vco3fGl1vYrQxz4tx9JQQ2Uuf

G4NNuD5fxs5fvYzpM5cpUggvbugTVzUQ+4eecGoE2A2pZWkLEtX8Dcogh08LOW7B

tydQ8ZCOEJP0mqLtX2tFjpuZZNjUHbqiVtufVstIGUW1vw/dccDAaw==

=DQ80

-----END PGP SIGNATURE-----





-- 

To unsubscribe, e-mail: suse-security-announce-unsubscribe@suse.com

For additional commands, e-mail: suse-security-announce-help@suse.com