Utempter symlink attack
| utemper-symlink (15904) |  Medium Risk |
Description:
Utempter could allow a local attacker to launch a symlink attack. A local attacker could exploit this vulnerability to overwrite arbitrary files on the system.
Consequences:
File Manipulation
Remedy:
For Mandrake Linux:
Upgrade to the latest utempter package, as listed below. Refer to MandrakeSoft Security Advisory MDKSA-2004:031 : utempter for more information. See References.
Mandrake Linux 9.1: 0.5.2-10.1.91mdk or later
Mandrake Linux 9.2: 0.5.2-10.1.91mdk or later
Mandrake Linux Multi Network Firewall 8.2: 0.5.2-5.1.M82mdk or later
Mandrake Linux Corporate Server 2.1: 0.5.2-11.1.C21mdk or later
Mandrake Linux 10.0: 0.5.2-12.1.100mdk or later
For Slackware Linux:
Upgrade to the latest utempter package, as listed below. Refer to slackware-security Mailing List, Mon, 19 Apr 2004 14:18:23 -0700 (PDT) for more information. See References.
Slackware Linux 9.1 and -current: 1.1.1-i486-1 or later
For Red Hat Linux 9:
Upgrade to the latest utempter package (0.5.5-2.RHL9.0 or later), as listed in RHSA-2004:175-05. See References.
For Red Hat Linux:
Upgrade to the latest utempter package, as listed below. Refer to RHSA-2004:174-09 for more information. See References.
Red Hat Enterprise Linux AS (v. 2.1), ES (v. 2.1), WS (v. 2.1), and Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor: 0.5.5-1.2.1EL.0 or later
Red Hat Enterprise Linux AS (v. 3), ES (v. 3), WS (v. 3), Desktop: 0.5.5-1.3EL.0.x86_64 or later
For Gentoo Linux:
Upgrade to the latest version of utempter (0.5.5.4 or later), as listed in GLSA 200405-05. See References.
For Sun JDS:
Apply the appropriate patch for your system, as listed below. Refer to Sun Alert ID: 57658 for more information. See References.
Linux:
Sun Java Desktop System (JDS) 2003 with the updated RPMs (patch-8934)
Sun Java Desktop System (JDS) Release 2 with the updated RPMs (patch-8934)
For other distributions:
Contact your vendor for upgrade or patch information.
References:
- CIAC Information Bulletin O-133: 'utempter' Package Vulnerability [REVISED 23 Jun 2004].
- CIAC Information Bulletin O-133: Red Hat utempter Package Vulnerability.
- GLSA 200405-05: Utempter symlink vulnerability.
- slackware-security Mailing List, Mon, 19 Apr 2004 14:18:23 -0700 (PDT): utempter security update (SSA:2004-110-01).
- Sun Alert ID: 57658: Security Vulnerabilities Involving the utempter(8) Utility.
- BID-10178: UTempter Multiple Local Vulnerabilities
- CVE-2004-0233: Utempter allows device names that contain .. (dot dot) directory traversal sequences, which allows local users to overwrite arbitrary files via a symlink attack on device names in combination with an application that trusts the utmp or wtmp files.
- GLSA-200405-05: Utempter symlink vulnerability
- MDKSA-2004:031: Updated utempter packages fix several vulnerabilities
- MDKSA-2004:031-1: Updated utempter packages fix several vulnerabilities
- RHSA-2004-174: utempter security update
- RHSA-2004-175: Updated utempter package fixes vulnerability
Platforms Affected:
- Gentoo Linux
- MandrakeSoft Mandrake Linux 10.0
- MandrakeSoft Mandrake Linux 10.0 AMD64
- MandrakeSoft Mandrake Linux 9.1 PPC
- MandrakeSoft Mandrake Linux 9.1
- MandrakeSoft Mandrake Linux 9.2 AMD64
- MandrakeSoft Mandrake Linux 9.2
- MandrakeSoft Mandrake Linux Corporate Server 2.1 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 2.1
- MandrakeSoft Mandrake Multi Network Firewall 8.2
- RedHat Enterprise Linux 2.1 AW
- RedHat Enterprise Linux 2.1 WS
- RedHat Enterprise Linux 2.1 ES
- RedHat Enterprise Linux 2.1 AS
- RedHat Enterprise Linux 3 ES
- RedHat Enterprise Linux 3 AS
- RedHat Enterprise Linux 3 Desktop
- RedHat Enterprise Linux 3 WS
- RedHat Linux 9.0
- RedHat Linux Advanced Workstation 2.1 Itanium
- Slackware Slackware Linux 9.1
- Slackware Slackware Linux current
- Sun JDS 2003
- Sun JDS Release 2
Reported:
Apr 19, 2004
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net