Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2002.431 -- RHSA-2002:148-06 Updated Tcl/Tk packages fix local vulnerability 15 August 2002 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: expect itcl tcl tclX tix tk Vendor: Red Hat Operating System: Red Hat Linux 7.0 Red Hat Linux 7.1 Platform: Alpha i386 IA-32 Impact: Root Compromise Access Required: Existing Account - --------------------------BEGIN INCLUDED TEXT-------------------- - --------------------------------------------------------------------- Red Hat, Inc. Red Hat Security Advisory Synopsis: Updated Tcl/Tk packages fix local vulnerability Advisory ID: RHSA-2002:148-06 Issue date: 2002-07-22 Updated on: 2002-08-12 Product: Red Hat Linux Keywords: expect current directory /var/tmp Cross references: Obsoletes: CVE Names: CAN-2001-1374 CAN-2001-1375 - --------------------------------------------------------------------- 1. Topic: Updated Tcl/Tk packages for Red Hat Linux 7 and 7.1 fix two local vulnerabilities. 2. Relevant releases/architectures: Red Hat Linux 7.0 - alpha, i386 Red Hat Linux 7.1 - alpha, i386, ia64 3. Problem description: The Tcl/Tk development environment comprises a number of applications tcl, tk, tix, tclX, expect, and itcl. The expect application, prior to version 5.32, searched for its libraries in /var/tmp before searching in other directories. This behavior could allow local users to gain root privileges by writing a Trojan horse library and getting the root user to run mkpasswd. The tcl/tk package searched for its libraries in the current working directory before other directories, which could allow local users to execute arbitrary code by writing Trojan horse library that is under a user-controlled directory. These issues affect Red Hat Linux versions 7 and 7.1, they were fixed in later Red Hat releases. All users should upgrade to the errata packages which are not vulnerable to these issues. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. To update all RPMs for your particular architecture, run: rpm -Fvh [filenames] where [filenames] is a list of the RPMs you wish to upgrade. Only those RPMs which are currently installed will be updated. Those RPMs which are not installed but included in the list will not be updated. Note that you can also use wildcards (*.rpm) if your current directory *only* contains the desired RPMs. Please note that this update is also available via Red Hat Network. Many people find this an easier way to apply updates. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info): 22187 - Tcl/Tk build env doesn't work well with auto build environment 28224 - expect searches /var/tmp before /usr/lib 28226 - tcl looks in the current directory for libs 6. RPMs required: Red Hat Linux 7.0: SRPMS: ftp://updates.redhat.com/7.0/en/os/SRPMS/tcltk-8.3.3-69.src.rpm alpha: ftp://updates.redhat.com/7.0/en/os/alpha/expect-5.32.2-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/itcl-3.2-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/tcl-8.3.3-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/tcllib-1.0-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/tclx-8.3-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/tix-8.2.0b1-69.alpha.rpm ftp://updates.redhat.com/7.0/en/os/alpha/tk-8.3.3-69.alpha.rpm i386: ftp://updates.redhat.com/7.0/en/os/i386/expect-5.32.2-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/itcl-3.2-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/tcl-8.3.3-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/tcllib-1.0-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/tclx-8.3-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/tix-8.2.0b1-69.i386.rpm ftp://updates.redhat.com/7.0/en/os/i386/tk-8.3.3-69.i386.rpm Red Hat Linux 7.1: SRPMS: ftp://updates.redhat.com/7.1/en/os/SRPMS/tcltk-8.3.3-69.src.rpm alpha: ftp://updates.redhat.com/7.1/en/os/alpha/expect-5.32.2-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/itcl-3.2-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/tcl-8.3.3-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/tcllib-1.0-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/tclx-8.3-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/tix-8.2.0b1-69.alpha.rpm ftp://updates.redhat.com/7.1/en/os/alpha/tk-8.3.3-69.alpha.rpm i386: ftp://updates.redhat.com/7.1/en/os/i386/expect-5.32.2-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/itcl-3.2-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/tcl-8.3.3-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/tcllib-1.0-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/tclx-8.3-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/tix-8.2.0b1-69.i386.rpm ftp://updates.redhat.com/7.1/en/os/i386/tk-8.3.3-69.i386.rpm ia64: ftp://updates.redhat.com/7.1/en/os/ia64/expect-5.32.2-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/itcl-3.2-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/tcl-8.3.3-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/tcllib-1.0-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/tclx-8.3-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/tix-8.2.0b1-69.ia64.rpm ftp://updates.redhat.com/7.1/en/os/ia64/tk-8.3.3-69.ia64.rpm 7. Verification: MD5 sum Package Name - -------------------------------------------------------------------------- adec70c2d906c13782c9462835bcb568 7.0/en/os/SRPMS/tcltk-8.3.3-69.src.rpm 6e2a36672ceef7ecd9be90993d46679b 7.0/en/os/alpha/expect-5.32.2-69.alpha.rpm 32420f94e7876a8c1c46795f96d2b3f9 7.0/en/os/alpha/itcl-3.2-69.alpha.rpm c086576545a7b6789c95c23ecc9a44dd 7.0/en/os/alpha/tcl-8.3.3-69.alpha.rpm 647fc45508dc32e00eacfcc7f2ecb22a 7.0/en/os/alpha/tcllib-1.0-69.alpha.rpm 0bc39c958f673431649d5c36c227fdd6 7.0/en/os/alpha/tclx-8.3-69.alpha.rpm a6c34edcbc69746e48cff7576bd2f92e 7.0/en/os/alpha/tix-8.2.0b1-69.alpha.rpm 681916d751c2acea124b3e49a6a5b667 7.0/en/os/alpha/tk-8.3.3-69.alpha.rpm 17fc0a224980f80820d6072265a57944 7.0/en/os/i386/expect-5.32.2-69.i386.rpm bf38ebd1b1f2e61f7187c3556a6b3c67 7.0/en/os/i386/itcl-3.2-69.i386.rpm c1cfaad79572c2a52446b220405642a2 7.0/en/os/i386/tcl-8.3.3-69.i386.rpm d1f002a59db0fc345111b5a2ea2e45f9 7.0/en/os/i386/tcllib-1.0-69.i386.rpm 541717fae007069c1e3df90caaf8a390 7.0/en/os/i386/tclx-8.3-69.i386.rpm e83d7cfed36ab99faca57d7ae2dcc6d2 7.0/en/os/i386/tix-8.2.0b1-69.i386.rpm 40704d033da7dcdbbc5dbf1166d4f3b2 7.0/en/os/i386/tk-8.3.3-69.i386.rpm adec70c2d906c13782c9462835bcb568 7.1/en/os/SRPMS/tcltk-8.3.3-69.src.rpm 6e2a36672ceef7ecd9be90993d46679b 7.1/en/os/alpha/expect-5.32.2-69.alpha.rpm 32420f94e7876a8c1c46795f96d2b3f9 7.1/en/os/alpha/itcl-3.2-69.alpha.rpm c086576545a7b6789c95c23ecc9a44dd 7.1/en/os/alpha/tcl-8.3.3-69.alpha.rpm 647fc45508dc32e00eacfcc7f2ecb22a 7.1/en/os/alpha/tcllib-1.0-69.alpha.rpm 0bc39c958f673431649d5c36c227fdd6 7.1/en/os/alpha/tclx-8.3-69.alpha.rpm a6c34edcbc69746e48cff7576bd2f92e 7.1/en/os/alpha/tix-8.2.0b1-69.alpha.rpm 681916d751c2acea124b3e49a6a5b667 7.1/en/os/alpha/tk-8.3.3-69.alpha.rpm 17fc0a224980f80820d6072265a57944 7.1/en/os/i386/expect-5.32.2-69.i386.rpm bf38ebd1b1f2e61f7187c3556a6b3c67 7.1/en/os/i386/itcl-3.2-69.i386.rpm c1cfaad79572c2a52446b220405642a2 7.1/en/os/i386/tcl-8.3.3-69.i386.rpm d1f002a59db0fc345111b5a2ea2e45f9 7.1/en/os/i386/tcllib-1.0-69.i386.rpm 541717fae007069c1e3df90caaf8a390 7.1/en/os/i386/tclx-8.3-69.i386.rpm e83d7cfed36ab99faca57d7ae2dcc6d2 7.1/en/os/i386/tix-8.2.0b1-69.i386.rpm 40704d033da7dcdbbc5dbf1166d4f3b2 7.1/en/os/i386/tk-8.3.3-69.i386.rpm 91c7536265c60db657d451a04ab25f4a 7.1/en/os/ia64/expect-5.32.2-69.ia64.rpm b9c7f8fa6afce2180b2fdf0b216bf7ba 7.1/en/os/ia64/itcl-3.2-69.ia64.rpm 2690748c462c2f22df37f2a1804e16b1 7.1/en/os/ia64/tcl-8.3.3-69.ia64.rpm 7134aff4dfc015140db686ea59d83ca4 7.1/en/os/ia64/tcllib-1.0-69.ia64.rpm 1c8c775ecff0a9798cef15f936bdbd22 7.1/en/os/ia64/tclx-8.3-69.ia64.rpm 261c381cb2b0f6fb632e7a5e29afb548 7.1/en/os/ia64/tix-8.2.0b1-69.ia64.rpm d1b2e5cca077041312ca64b9d38c9e8e 7.1/en/os/ia64/tk-8.3.3-69.ia64.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/about/contact/pgpkey.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg <filename> 8. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1374 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-1375 Copyright(c) 2000, 2001, 2002 Red Hat, Inc. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to use any or all of this information is the responsibility of each user or organisation, and should be done so in accordance with site policies and procedures. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the original authors to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/Information/advisories.html If you believe that your system has been compromised, contact AusCERT or your representative in FIRST (Forum of Incident Response and Security Teams). Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key iQCVAwUBPVuVbSh9+71yA2DNAQFkZAP9F6ejI6ein5Dro8VdjeLyu+d1FF4R19KL w3wVRRL5UkBUqt/JBBYLOavTwjstnph1nzYm73OjFQ2zTrWB1s2+ngQXsWad17xX mkAdhWrEsSfyvb8V4OijrcBVVgSj0suMCv+8WXdvNKBrvnpJAEfYOH5g21Fibfkp JPkDfVYBznU= =gxI5 -----END PGP SIGNATURE-----