Red Hat Linux Security Advisory

Red Hat, Inc. Security Advisory Synopsis Updated mailx and perl packages are now available. Advisory ID RHSA-2000:048-03 Issue Date 2000-08-07 Updated On 2000-08-30 Product Red Hat Linux Keywords perl suid Cross References N/A 1. Topic: Updated perl and mailx package are now available which fix a potential exploit made possible by incorrect assumptions made in suidperl. 2. Problem description: Under certain conditions, suidperl will attempt to send mail to the local superuser account using /bin/mail. A properly formatted exploit script can use this facility, along with mailx's tendency to inherit settings from the environment, to gain local root access. This update changes suidperl's behavior to use syslog instead of mail, and restricts the list of variables /bin/mail will read from the environment. 3. Bug IDs fixed: (see bugzilla for more information) 15625 - Root exploit alread posted on bugtraq 15630 - Root exploit in sperl 15641 - suidperl has a major problem 4. Relevant releases/architectures: Red Hat Linux 5.0 - i386, alpha, sparc Red Hat Linux 5.1 - i386, alpha, sparc Red Hat Linux 5.2 - i386, alpha, sparc Red Hat Linux 6.0 - i386, alpha, sparc Red Hat Linux 6.1 - i386, alpha, sparc Red Hat Linux 6.2 - i386, alpha, sparc Red Hat Linux 6.2E - i386 5. RPMs required: Red Hat Linux 5.0, 5.1, 5.2: sparc: ftp://updates.redhat.com/5.2/en/os/sparc/mailx-8.1.1-16.sparc.rpm ftp://updates.redhat.com/5.2/en/os/sparc/perl-5.004m7-2.sparc.rpm alpha: ftp://updates.redhat.com/5.2/en/os/alpha/mailx-8.1.1-16.alpha.rpm ftp://updates.redhat.com/5.2/en/os/alpha/perl-5.004m7-2.alpha.rpm i386: ftp://updates.redhat.com/5.2/en/os/i386/mailx-8.1.1-16.i386.rpm ftp://updates.redhat.com/5.2/en/os/i386/perl-5.004m7-2.i386.rpm sources: ftp://updates.redhat.com/5.2/en/os/SRPMS/mailx-8.1.1-16.src.rpm ftp://updates.redhat.com/5.2/en/os/SRPMS/perl-5.004m7-2.src.rpm Red Hat Linux 6.0, 6.1, 6.2: sparc: ftp://updates.redhat.com/6.2/en/os/sparc/mailx-8.1.1-16.sparc.rpm ftp://updates.redhat.com/6.2/en/os/sparc/perl-5.00503-12.sparc.rpm i386: ftp://updates.redhat.com/6.2/en/os/i386/mailx-8.1.1-16.i386.rpm ftp://updates.redhat.com/6.2/en/os/i386/perl-5.00503-12.i386.rpm alpha: ftp://updates.redhat.com/6.2/en/os/alpha/mailx-8.1.1-16.alpha.rpm ftp://updates.redhat.com/6.2/en/os/alpha/perl-5.00503-12.alpha.rpm sources: ftp://updates.redhat.com/6.2/en/os/SRPMS/mailx-8.1.1-16.src.rpm ftp://updates.redhat.com/6.2/en/os/SRPMS/perl-5.00503-12.src.rpm 6. Solution: First download and install the newest RPM errata. It will be needed to properly install the umb-scheme package. See the following errata update for more information on upgrading RPM: RHEA-2000:051-01 Then, for each RPM for your particular architecture, run: rpm -Fvh [filename] where filename is the name of the RPM. 7. Verification: MD5 sum Package Name ------------------------------------------------------------------------- 7440313c13c65142c75e35d32b5807c3 5.2/en/os/SRPMS/perl-5.004m7-2.src.rpm 876b94f7d4fd4d92142f44de51045591 5.2/en/os/alpha/perl-5.004m7-2.alpha.rpm 0a1f47cacb891c03b351211d4fe825ed 5.2/en/os/i386/perl-5.004m7-2.i386.rpm 24e61c42e5a22dbbc929264a1ddc3869 5.2/en/os/sparc/perl-5.004m7-2.sparc.rpm 8d54d1db44d485efdcfb4d858fae30b6 6.2/en/os/SRPMS/perl-5.00503-12.src.rpm a7fd33fe3375b27197f184e9ad8d3c15 6.2/en/os/i386/perl-5.00503-12.i386.rpm a427968de08a254dfb453d20d7c1637f 6.2/en/os/alpha/perl-5.00503-12.alpha.rpm fbd5a523fbfc8103792368317753cf35 6.2/en/os/sparc/perl-5.00503-12.sparc.rpm c514911db4ce13fc32af5b59233d5dc9 5.2/en/os/SRPMS/mailx-8.1.1-16.src.rpm 430fca595dd42648239b8ad475032c9c 5.2/en/os/alpha/mailx-8.1.1-16.alpha.rpm fd9d44b8aeadc36bd871dd8e2d6211c4 5.2/en/os/i386/mailx-8.1.1-16.i386.rpm 376f28398c607b4af12d06babbd7e098 5.2/en/os/sparc/mailx-8.1.1-16.sparc.rpm 30d2f82abfba4ac2c770b66c591d528f 6.2/en/os/SRPMS/mailx-8.1.1-16.src.rpm c121c2076bae78f42afcf9f0357549b9 6.2/en/os/i386/mailx-8.1.1-16.i386.rpm 25497e13b1d30f3dcff365602f78208a 6.2/en/os/alpha/mailx-8.1.1-16.alpha.rpm 6464e30268ba05a2ca938b38805a9256 6.2/en/os/sparc/mailx-8.1.1-16.sparc.rpm These packages are GPG signed by Red Hat, Inc. for security. Our key is available at: http://www.redhat.com/about/contact.html You can verify each package with the following command: rpm --checksig filename If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nogpg filename Note that you need RPM >= 3.0 to check GnuPG keys. 8. References: http://www.securityfocus.com/vdb/bottom.html?vid=1547 http://bugs.perl.org/perlbug.cgi?req=tidmids&tidmids=20000806.001