--zYM0uCDKw75PZbzx
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com
 security-alerts@linuxsecurity.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		Linux: REVISED: Race condition in fileutils
Advisory number: 	CSSA-2002-018.1
Issue date: 		2002 May 13
Cross reference:
______________________________________________________________________________


1. Problem Description

	A race condition in various utilities from the GNU fileutils
	package may cause a root user to delete the whole filesystem.

	This updates resolves a problem in the original fix that would
	cause an attempt to recursively remove a directory with
	trailing slashes to memory fault.


2. Vulnerable Supported Versions

	System				Package
	----------------------------------------------------------------------

	OpenLinux 3.1.1 Server		prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1.1 Workstation	prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1 Server		prior to fileutils-4.1-5.i386.rpm

	OpenLinux 3.1 Workstation	prior to fileutils-4.1-5.i386.rpm


3. Solution

	The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

	4.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

	4.2 Packages

	d01d42d41800d0b9c1d02c4fec07a79d	fileutils-4.1-5.i386.rpm

	4.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	4.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

	4.5 Source Packages

	ccb5269147321f8db75cf6f4758161bd	fileutils-4.1-5.src.rpm


5. OpenLinux 3.1.1 Workstation

	5.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

	5.2 Packages

	993d932af015edb5ad6e4d70db171492	fileutils-4.1-5.i386.rpm

	5.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	5.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

	5.5 Source Packages

	ccb5269147321f8db75cf6f4758161bd	fileutils-4.1-5.src.rpm


6. OpenLinux 3.1 Server

	6.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

	6.2 Packages

	79671c826786c29d2849fe14de4f79f1	fileutils-4.1-5.i386.rpm

	6.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	6.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

	6.5 Source Packages

	238ad9663d26b196eea92874a96b1c53	fileutils-4.1-5.src.rpm


7. OpenLinux 3.1 Workstation

	7.1 Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

	7.2 Packages

	79671c826786c29d2849fe14de4f79f1	fileutils-4.1-5.i386.rpm

	7.3 Installation

	rpm -Fvh fileutils-4.1-5.i386.rpm

	7.4 Source Package Location

	ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

	7.5 Source Packages

	01a126030929e44c83a473ee662fecb9	fileutils-4.1-5.src.rpm


8. References

	Specific references for this advisory:

		http://mail.gnu.org/pipermail/bug-fileutils/2002-March/002440.html
		http://isec.pl/vulnerabilities/0002.txt

	Caldera OpenLinux security resources:
		http://www.caldera.com/support/security/index.html

	Caldera UNIX security resources:
		http://stage.caldera.com/support/security/

	This security fix closes Caldera incidents sr862917, fz520627,
	erg712018.


9. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on this website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera products.


10. Acknowledgements

	Caldera would like to thank Vincent Danen at Mandrake
	for alerting us to the problems with the original fix.

	Wojciech Purczynski (iSEC Security Research, http://isec.pl)
	reported this vulnerability.

______________________________________________________________________________


--zYM0uCDKw75PZbzx
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjzhc20ACgkQbluZssSXDTHGSQCfbXNoVb8C99r92obDYevNMGtg
0TQAoIT5OPdottTSj6SIp4UiAArJtX+o
=eXHQ
-----END PGP SIGNATURE-----

--zYM0uCDKw75PZbzx--