-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



- -----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1



______________________________________________________________________________

   Caldera Systems, Inc.  Security Advisory



Subject: mgetty /tmp problems

Advisory number: CSSA-2001-002.0

Issue date: 2001 January, 12

Cross reference:

______________________________________________________________________________





1. Problem Description



   There is a /tmp/ file problem in the fax reception code of mgetty

   which could allow determined attackers to overwrite system files.



2. Vulnerable Versions



   System                       Package

   -----------------------------------------------------------

   OpenLinux Desktop 2.3        All packages previous to

   mgetty-1.1.22_Aug17-9



   OpenLinux eServer 2.3.1      All packages previous to

   and OpenLinux eBuilder       mgetty-1.1.22_Aug17-9



   OpenLinux eDesktop 2.4 All packages previous to

                                mgetty-1.1.22_Aug17-9



3. Solution



   Workaround:



     none



   The proper solution is to upgrade to the fixed packages



4. OpenLinux Desktop 2.3



   4.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       http://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/



       The corresponding source code package can be found at:



       http://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS



   4.2 Verification



   ab0c2a2536d93e78da9e3dbad00358b4  RPMS/mgetty-1.1.22_Aug17-9.i386.rpm

   eb3a13c3898303078d18f6d6cf5b8ad6  SRPMS/mgetty-1.1.22_Aug17-9.src.rpm



   4.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm



5. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0



   5.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       http://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/



       The corresponding source code package can be found at:



       http://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS



   5.2 Verification



   e590735d575c46ab2035ff16dedafaa9  RPMS/mgetty-1.1.22_Aug17-9.i386.rpm

   eb3a13c3898303078d18f6d6cf5b8ad6  SRPMS/mgetty-1.1.22_Aug17-9.src.rpm



   5.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm



6. OpenLinux eDesktop 2.4



   6.1 Location of Fixed Packages



       The upgrade packages can be found on Caldera's FTP site at:



       http://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/



       The corresponding source code package can be found at:



       http://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS



   6.2 Verification



   8f229df2ee1cf6a95c632ed24750aab9  RPMS/mgetty-1.1.22_Aug17-9.i386.rpm

   eb3a13c3898303078d18f6d6cf5b8ad6  SRPMS/mgetty-1.1.22_Aug17-9.src.rpm



   6.3 Installing Fixed Packages



       Upgrade the affected packages with the following commands:



  rpm -Fhv mgetty-1.1.22_Aug17-9.i386.rpm



7. References



   This and other Caldera security resources are located at:



   http://www.calderasystems.com/support/security/index.html



   This security fix closes Caldera's internal Problem Report 8696.



8. Disclaimer



   Caldera Systems, Inc. is not responsible for the misuse of any of the

   information we provide on this website and/or through our security

   advisories. Our advisories are a service to our customers intended to

   promote secure installation and use of Caldera OpenLinux.



9. Acknowledgements



   Caldera Systems, Inc. wishes to thank the Team at Immunix, Greg KH

   at Wirex and Gert Doering for their cooperation.



______________________________________________________________________________

- -----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.1 (GNU/Linux)

Comment: For info see http://www.gnupg.org



iD8DBQE6X3iM18sy83A/qfwRAnxaAJ9iGQVbUuRWWxiu5ftHCP/xfryCDQCdF0jn

cpYrw95B6rAoEeBB0RGmN7M=

=GbIo

- -----END PGP SIGNATURE-----

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.0.1 (GNU/Linux)

Comment: For info see http://www.gnupg.org



iEYEARECAAYFAjpjPBAACgkQ18sy83A/qfxxTQCgjyscEDL7ezHRIGrj6lJ67Xfq

tIUAnR175xeQvoFNihEQtoyG0IHc/sFq

=TDOH

-----END PGP SIGNATURE-----