[Full-disclosure] SCOSA-2006.2 OpenServer 5.0.7 OpenServer 6.0.0 : cpio Multiple Vulnerabilities

[security@xxxxxxx]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________

                        SCO Security Advisory

Subject:                OpenServer 5.0.7 OpenServer 6.0.0 : cpio Multiple 
Vulnerabilities
Advisory number:        SCOSA-2006.2
Issue date:             2006 January 03
Cross reference:        sr893933 fz532332 erg712853
                        sr894845 fz532911 erg712912
                        CVE-2005-1111 CVE-2005-1229
______________________________________________________________________________


1. Problem Description

        A race condition in cpio allows local users to modify
        permissions of arbitrary files via a hard link attack on a file
        while it is being decompressed, whose permissions are changed by
        cpio after the decompression is complete.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CVE-2005-1111 to this issue.

        A directory traversal vulnerability allows remote attackers to
        write to arbitrary directories via a .. (dot dot) in a cpio
        file.

        The Common Vulnerabilities and Exposures project (cve.mitre.org)
        has assigned the name CVE-2005-1229 to this issue


2. Vulnerable Supported Versions

        System                          Binaries
        ----------------------------------------------------------------------
        OpenServer 5.0.7                /usr/gnu/bin/gcpio
        OpenServer 6.0.0                /usr/bin/cpio, /usr/bin/cpio.osr5


3. Solution

        The proper solution is to install the latest packages.


4. OpenServer 5.0.7

        4.1 Location of Fixed Binaries

        ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2


    4.2 Verification

        MD5 (p532332.507_vol.tar) = 416ce0e1f6ba629eadc883ca1283fba7

        md5 is available for download from
                ftp://ftp.sco.com/pub/security/tools


    4.3 Installing Fixed Binaries

        Upgrade the affected binaries with the following sequence:

        1) Download p532332.507_vol.tar file to a directory.

        2) Extract VOL* files.

           # tar xvf p532332.507_vol.tar

        3) Run the custom command, specify an install from media images,
           and specify the directory as the location of the images.


5. OpenServer 6.0.0

        5.1 Location of Fixed Binaries

        ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.2


    5.2 Verification

        MD5 (p532911.600_vol.tar) = 2224558523782dbae0b529fb0cf0ff37

        md5 is available for download from
                ftp://ftp.sco.com/pub/security/tools


    5.3 Installing Fixed Binaries

        Upgrade the affected binaries with the following sequence:

        1) Download p532911.600_vol.tar file to a directory.

        2) Extract VOL* files.

           # tar xvf p532911.600_vol.tar

        3) Run the custom command, specify an install from media images,
           and specify the directory as the location of the images.


6. References

        Specific references for this advisory:
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1111
                http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1229
                http://xforce.iss.net/xforce/xfdb/20204

        SCO security resources:
                http://www.sco.com/support/security/index.html

        SCO security advisories via email
                http://www.sco.com/support/forums/security.html

        This security fix closes SCO incidents sr893933 fz532332
        erg712853 sr894845 fz532911 erg712912.


7. Disclaimer

        SCO is not responsible for the misuse of any of the information
        we provide on this website and/or through our security
        advisories. Our advisories are a service to our customers
        intended to promote secure installation and use of SCO
        products.


8. Acknowledgments

        The SCO Group would like to thank Imran Ghory for the initial
        report.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (UnixWare)

iD8DBQFDutvSaqoBO7ipriERAotsAJ93QFuCrfqnGpo9ZI/0WrAZY2QESwCeMB0P
/k50mfVF8FuQU7x/P0lHfyo=
=RLvy
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/