Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » CSSA-2002-018.1-REVISED: Race condition in fileutils

CSSA-2002-018.1-REVISED: Race condition in fileutils

by Nikola Strahija on May 15th, 2002 A race condition in various utilities from the GNU fileutils package may cause a root user to delete the whole filesystem. This updates resolves a problem in the original fix that would cause an attempt to recursively remove a directory with trailing slashes to memory fault.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------

OpenLinux 3.1.1 Server prior to fileutils-4.1-5.i386.rpm

OpenLinux 3.1.1 Workstation prior to fileutils-4.1-5.i386.rpm

OpenLinux 3.1 Server prior to fileutils-4.1-5.i386.rpm

OpenLinux 3.1 Workstation prior to fileutils-4.1-5.i386.rpm


3. Solution

The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

4.2 Packages

d01d42d41800d0b9c1d02c4fec07a79d fileutils-4.1-5.i386.rpm

4.3 Installation

rpm -Fvh fileutils-4.1-5.i386.rpm

4.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

4.5 Source Packages

ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm


5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

5.2 Packages

993d932af015edb5ad6e4d70db171492 fileutils-4.1-5.i386.rpm

5.3 Installation

rpm -Fvh fileutils-4.1-5.i386.rpm

5.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

5.5 Source Packages

ccb5269147321f8db75cf6f4758161bd fileutils-4.1-5.src.rpm


6. OpenLinux 3.1 Server

6.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

6.2 Packages

79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm

6.3 Installation

rpm -Fvh fileutils-4.1-5.i386.rpm

6.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

6.5 Source Packages

238ad9663d26b196eea92874a96b1c53 fileutils-4.1-5.src.rpm


7. OpenLinux 3.1 Workstation

7.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

7.2 Packages

79671c826786c29d2849fe14de4f79f1 fileutils-4.1-5.i386.rpm

7.3 Installation

rpm -Fvh fileutils-4.1-5.i386.rpm

7.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

7.5 Source Packages

01a126030929e44c83a473ee662fecb9 fileutils-4.1-5.src.rpm


8. References

Specific references for this advisory:

http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html
http://isec.pl/vulnerabilities/0002.txt

Caldera OpenLinux security resources:
http://www.caldera.com/support/security/index.html

Caldera UNIX security resources:
http://stage.caldera.com/support/security/

This security fix closes Caldera incidents sr862917, fz520627,
erg712018.


9. Disclaimer

Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.


10. Acknowledgements

Caldera would like to thank Vincent Danen at Mandrake
for alerting us to the problems with the original fix.

Wojciech Purczynski (iSEC Security Research, http://isec.pl)
reported this vulnerability.

______________________________________________________________________________



Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »