Originally Published: Thursday, 20 July 2000 Author: Alexander Reelsen
Published to: news_enhance_security/Security News Page: 1/1 - [Std View]

Caldera Systems Security Advisory - gpm

There are security problems within gpm (General Purpose Mouse support daemon) which allow removal of system files and also exhibit a local denial of service attack.

Date: Thu, 20 Jul 2000 10:27:35 -0600 From: Technical Support Subject: Security Update: DoS on gpm To: BUGTRAQ@SECURITYFOCUS.COM

______________________________________________________________________________ Caldera Systems, Inc. Security Advisory

Subject: DoS on gpm Advisory number: CSSA-2000-024.0 Issue date: 2000 July, 6 Cross reference: ______________________________________________________________________________

1. Problem Description

There are security problems within gpm (General Purpose Mouse support daemon) which allow removal of system files and also exhibit a local denial of service attack.

2. Vulnerable Versions

System Package ----------------------------------------------------------- OpenLinux Desktop 2.3 All packages previous to gpm-1.17.8-5

OpenLinux eServer 2.3 All packages previous to and OpenLinux eBuilder gpm-1.17.8-5

OpenLinux eDesktop 2.4 All packages previous to gpm-1.19.2-4

3. Solution

Workaround:

none

We recommend our users to upgrade to the new packages.

4. OpenLinux Desktop 2.3

4.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/OpenLinux/2.3/current/SRPMS

4.2 Verification

bdcc5caf3e4cf4abb3081ef6e2049a61 RPMS/gpm-1.17.8-5.i386.rpm 7436e49533e64d7a737c920bbc874299 RPMS/gpm-devel-1.17.8-5.i386.rpm f9c19f994238fa507d4e5505ebd78b59 RPMS/gpm-devel-static-1.17.8-5.i386.rpm c0c839fb697c10f5520bda679366135f SRPMS/gpm-1.17.8-5.src.rpm

4.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F gpm-*.i386.rpm

5. OpenLinux eServer 2.3 and OpenLinux eBuilder for ECential 3.0

5.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

5.2 Verification

061e6d50414c0c024547e29c3e1a0737 RPMS/gpm-1.17.8-5.i386.rpm 79633f3258b8bcbdff2fdd733e262e10 RPMS/gpm-devel-1.17.8-5.i386.rpm 0fa3527333421bf90f844376ff692d9d RPMS/gpm-devel-static-1.17.8-5.i386.rpm c0c839fb697c10f5520bda679366135f SRPMS/gpm-1.17.8-5.src.rpm

5.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F gpm-*.i386.rpm

6. OpenLinux eDesktop 2.4

6.1 Location of Fixed Packages

The upgrade packages can be found on Caldera's FTP site at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

The corresponding source code package can be found at:

ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

6.2 Verification

3f83840592100ea6a770070e11f4d9d9 RPMS/gpm-1.19.2-4.i386.rpm f223771658eef771a5f93b09dc50c281 RPMS/gpm-devel-1.19.2-4.i386.rpm 7a50dd9a854ed30365cf535850d39420 RPMS/gpm-devel-static-1.19.2-4.i386.rpm c43abbdd533ac0d9a247eb13dfbb5bb4 SRPMS/gpm-1.19.2-4.src.rpm

6.3 Installing Fixed Packages

Upgrade the affected packages with the following commands:

rpm -F gpm-*.i386.rpm

7. References

This and other Caldera security resources are located at:

http://www.calderasystems.com/support/security/index.html

This security fix closes Caldera's internal Problem Report 7297.

8. Disclaimer

Caldera Systems, Inc. is not responsible for the misuse of any of the information we provide on this website and/or through our security advisories. Our advisories are a service to our customers intended to promote secure installation and use of Caldera OpenLinux.

9. Acknowledgement

Caldera Systems wishes to thank Ian Zimmermann for providing the fix.