Re: Local root exploit in SuSE Linux 8.2Pro

[Roman Drahtmueller <draht () suse de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


I am answering both mails from Stefan Nordhausen to bugtraq, about symlink
race conditions in the packages susewm (1) and javarunt (Java Runtime
Environment) (2).

> Affected:               SuSE Linux 8.2Pro
> Not affected:           SuSE Linux 7.3Pro, non-SuSE distributions
> Possibly affected:      other SuSE distributions
> Vulnerable package:     susewm
>
> Impact:                 Local user can gain root privileges
> Exploit type:           Symlink attack
> Release date:           October 6th 2003
> Vendor status:          SuSE was contacted on September 4th (> 1 month ago).
>                         No SuSE-patch yet.
>
>
> A symlink vulnerability exists in the shell script 
> /sbin/conf.d/SuSEconfig.susewm, line 86. This shell script is part of the 
> "susewm" package. This package is required by the package "kdebase3", so if 
> KDE3 is installed on your system(s), you should be vulnerable.

These bugs are confirmed and are being processed, according to their
severity. Which also means that these two bugs have been superseded by
more severe ones in our queue.
There will soon be update packages for the affected products, of course.

We thank Stefan Nordhausen for notifying these weaknesses to SuSE
Security.

Thanks,
Roman Drahtmüller,
SuSE Security.
- -- 
 -                                                                   -
| Roman Drahtmüller      <draht () suse de> //      Nail here            |
  SuSE Linux AG - Security       Phone: //       for a new            
| Nürnberg, Germany     +49-911-740530 //        monitor!     --> [x] |
 -                                                                   -
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: SuSE Security

iD8DBQE/gbNjnkDjEAAKq6QRAqL0AKDOFeRm053retTs93C6/c4/MrjEUQCgiFsP
9AsZLOeBHN+ihvMl7WOOuBE=
=rORi
-----END PGP SIGNATURE-----