SuSE alert: traceroute

Posted by dave on Oct 16, 2000 6:16 AM EDT
Mailing list
Mail this story
Print this story

The security problem in the traceroute program as shipped with SuSE Linux distributions is completely different from the one reported on security mailing lists a few days ago (`traceroute -g 1 -g 1') by Pekka Savola <pekkas@netcore.fi>. SuSE distributions do not contain this particular traceroute implementation. The problem in our traceroute was discovered independently and reported to us by H D Moore <hdm@secureaustin.com>. The problem in the implementation of traceroute that we ship is a format string parsing bug in a routine that can be used to terminate a line in traceroute's output to easily embed the program in cgi scripts as used for web frontends for traceroute. Using a specially crafted sequence of characters on the commandline, it is possile to trick the traceroute program into running arbitrary code as root.

-----BEGIN PGP SIGNED MESSAGE-----

______________________________________________________________________________

                        SuSE Security Announcement

        Package: traceroute
        Announcement-ID: SuSE-SA:2000:041
        Date: Monday, October 16th, 2000 16:10 MEST
        Affected SuSE versions: 6.0, 6.1, 6.2, 6.3, 6.4, 7.0
        Vulnerability Type: local root compromise
        Severity (1-10): 6
        SuSE default package: yes
        Other affected systems: Linux systems using the NANOG traceroute

    Content of this advisory:
        1) security vulnerability resolved: traceroute
           problem description, discussion, solution and upgrade information
        2) pending vulnerabilities, solutions, workarounds
        3) standard appendix (further information)

______________________________________________________________________________

1) problem description, brief discussion, solution, upgrade information

    The security problem in the traceroute program as shipped with SuSE
    Linux distributions is completely different from the one reported on
    security mailing lists a few days ago (`traceroute -g 1 -g 1') by
    Pekka Savola <pekkas@netcore.fi>. SuSE distributions do not contain
    this particular traceroute implementation.
    The problem in our traceroute was discovered independently and reported
    to us by H D Moore <hdm@secureaustin.com>. The problem in the
    implementation of traceroute that we ship is a format string parsing
    bug in a routine that can be used to terminate a line in traceroute's
    output to easily embed the program in cgi scripts as used for web
    frontends for traceroute.
    Using a specially crafted sequence of characters on the commandline,
    it is possile to trick the traceroute program into running arbitrary
    code as root.

    If you want to temporarily work around this security vulnerability,
    you can disable traceroute for normal users by clearing the suid bit on
    the file /usr/sbin/traceroute: chmod -s /usr/sbin/traceroute . Do not
    forget to change the respective line in /etc/permissions to read:
        /usr/sbin/traceroute root.root 755

    We have prepared update packages on our ftp server that eliminate the
    vulnerability in the traceroute program. Note that the traceroute program
    is contained in the nkita or the nkitb package, depending on the
    distribution version.

    Download the update package from locations described below and install
    the package with the command `rpm -Fhv file.rpm'. The md5sum for each
    file is in the line below. You can verify the integrity of the rpm
    files using the command
        `rpm --checksig --nogpg file.rpm',
    independently from the md5 signatures below.

    i386 Intel Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/a1/nkitb-2000.10.4-0.i386.rpm
      6c8f713a071a96c287942f880cd5919c
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
      c01db9ee70a9ac01cba1bace93cfdd16

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/nkitb-2000.7.11-0.i386.rpm
      118075b7fc295be86b3659bf9b3fa778
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
      61aa9e2e4272606d2bd70828a72c957c

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/n1/nkita-2000.10.4-0.i386.rpm
      6c5932e4083de6f499e4c77fcadbffc1
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
      9debb8804293384057d69254614a1496

    SuSE-6.2
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/n1/nkita-2000.10.4-0.i386.rpm
      49269283c6d39a234f61303b2e918413
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.2/zq1/nkita-2000.10.4-0.src.rpm
      1cc00eb9b37b37a51fc249db3b51f6e1

    SuSE-6.1
    ftp://ftp.suse.com/pub/suse/i386/update/6.1/n1/nkita-2000.10.4-0.i386.rpm
      2fe1c6d70fcf1272da95f33ad7ad1010
    source rpm:
    ftp://ftp.suse.com/pub/suse/i386/update/6.1/zq1/nkita-2000.10.4-0.src.rpm
      74d6f2e623b7fcac1b0881b1bfbe0880

    SuSE-6.0
    Please use the update packages from the 6.1 distribution.

    Sparc Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/sparc/update/7.0/a1/nkitb-2000.10.4-0.sparc.rpm
      e9bc3512b6182f540e74308c02d81f65
    source rpm:
    ftp://ftp.suse.com/pub/suse/sparc/update/7.0/zq1/nkitb-2000.10.4-0.src.rpm
      8fba03e9cef63ae076b10fb61c800e39

    AXP Alpha Platform:

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/a1/nkitb-2000.10.4-0.alpha.rpm
      7850969c7b3beaf3fd1ce8b2a9246be0
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
      6e5a964177b6cf87524119c747f0220b

    SuSE-6.3
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/n1/nkita-2000.10.4-0.alpha.rpm
      6440a6a7da903829cff57a5f8c7cda91
    source rpm:
    ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/nkita-2000.10.4-0.src.rpm
      53bf05462378c384e8a46f3c6c368c67

    PPC Power PC Platform:

    SuSE-7.0
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/a1/nkitb-2000.10.5-0.ppc.rpm
      407d1c6731228f5d3e9addd108d31224
    ftp://ftp.suse.com/pub/suse/ppc/update/7.0/zq1/nkitb-2000.10.5-0.src.rpm
      8fba03e9cef63ae076b10fb61c800e39

    SuSE-6.4
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/a1/nkitb-2000.10.4-0.ppc.rpm
      c432a5b8d37640be6e325ef9603f9cba
    source rpm:
    ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/nkitb-2000.10.4-0.src.rpm
      edf24c1989c85616d1caf53872e61f17

______________________________________________________________________________

2) Pending vulnerabilities in SuSE Distributions and Workarounds:

    A set of security announcements is following this advisory.
______________________________________________________________________________

3) standard appendix:

    SuSE runs two security mailing lists to which any interested party may
    subscribe:

    suse-security@suse.com
        - general/linux/SuSE security discussion.
            All SuSE security announcements are sent to this list.
            To subscribe, send an email to
                <suse-security-subscribe@suse.com>.

    suse-security-announce@suse.com
        - SuSE's announce-only mailing list.
            Only SuSE's security annoucements are sent to this list.
            To subscribe, send an email to
                <suse-security-announce-subscribe@suse.com>.

    For general information or the frequently asked questions (faq)
    send mail to:
        <suse-security-info@suse.com> or
        <suse-security-faq@suse.com> respectively.

    ===============================================
    SuSE's security contact is <security@suse.com>.
    ===============================================

Regards,
Roman Drahtmüller.
- - --
 - -
| Roman Drahtmüller <draht@suse.de> // "Caution: Cape does |
  SuSE GmbH - Security Phone: // not enable user to fly."
| Nürnberg, Germany +49-911-740530 // (Batman Costume warning label) |
 - -
______________________________________________________________________________

    The information in this advisory may be distributed or reproduced,
    provided that the advisory is not modified in any way.
    SuSE GmbH makes no warranties of any kind whatsoever with respect
    to the information contained in this security advisory.

Type Bits/KeyID Date User ID
pub 2048/3D25D3D9 1999/03/06 SuSE Security Team <security@suse.de>

- -----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA
BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz
JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh
1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U
P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+
cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg
VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b
yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7
tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ
xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63
Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo
choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI
BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u
v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+
x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0
Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq
MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2
saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o
L0oixF12Cg==
=pIeS
- -----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBOesNgHey5gA9JdPZAQGk/wf+Jkjci3YR373FXlRomv2gy+fvhlHsQI8t
wQSqlzOSPUHUlPWnxWRxOLx+tLjGX0I69lR5i2PKIFDiudBBKbiZR4pb4LGux8dk
ekhs/pxfDgk9J+RBreEBdcKb4YirGWjMVVWfBydMOp0Atp4wNQ+Ab3hyxunKxr4p
3J+c8z8FwFGfEr7piHZMkRP/cP3S5CYrLe856yea2Unn6B4EoKBhBdL/AAfKPsUD
o6JsUzm5hcYeFd2XJfnuIWceNvr8uQZxltqx8EqCmtFKfSSbDIHv3/Rq+fd9rQ8Z
qERcmDuZRh8d7+VTM0QELuQWxCSICM/pUHk+9xYO5u+OtmomXe/EkA==
=kQe2
-----END PGP SIGNATURE-----



This archive was generated by hypermail 2.1.0 : Mon Jun 04 2001 - 18:25:15 PDT

  Nav
» Read more about: Story Type: Security; Groups: SUSE

« Return to the newswire homepage

This topic does not have any threads posted yet!

You cannot post until you login.