OpenPKG Alert: OpenPKG Security Advisory (libtool)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

________________________________________________________________________

OpenPKG Security Advisory The OpenPKG Project http://www.openpkg.org/security.html http://www.openpkg.org [e-mail:openpkg-security@openpkg.org] [e-mail:openpkg@openpkg.org] OpenPKG-SA-2004.004 08-Mar-2004 ________________________________________________________________________

Package: libtool Vulnerability: insecure creation of temporary directory OpenPKG Specific: no

Affected Releases: Affected Packages: Corrected Packages: OpenPKG CURRENT <= libtool-1.5.2-20040207 >= libtool-1.5.2-20040308 OpenPKG 2.0 <= libtool-1.5.2-2.0.0 >= libtool-1.5.2-2.0.1 OpenPKG 1.3 <= libtool-1.5-1.3.0 >= libtool-1.5-1.3.1

Dependent Packages: none

Description: According to a posting on Bugtraq [0], an issue regarding the insecure creation of a temporary directory exists in GNU libtool [1] versions before 1.5.2. Use of mkdir(1) along with option "-p" makes libtool vulnerable to symlink attacks. Stefan Nordhausen commited a fix that removes the use of option "-p" in version 1.5.2. Discussion on Bugtraq further indicates that an additional race condition issue exists in the same context using chmod(1), reported by Joseph S. Myers back in March 2000 [2]. The updated OpenPKG versions of libtool contain fixes for both issues.

Please check whether you are affected by running "/bin/rpm -q libtool". If you have the "libtool" package installed and its version is affected (see above), we recommend that you immediately upgrade it (see Solution). [3][4]

Solution: Select the updated source RPM appropriate for your OpenPKG release [5][6], fetch it from the OpenPKG FTP service [7][8] or a mirror location, verify its integrity [9], build a corresponding binary RPM from it [3] and update your OpenPKG installation by applying the binary RPM [4]. For the current release OpenPKG 2.0, perform the following operations to permanently fix the security problem (for other releases adjust accordingly).

$ ftp http://ftp.openpkg.org ftp> bin ftp> cd release/2.0/UPD ftp> get libtool-1.5.2-2.0.1.src.rpm ftp> bye $ /bin/openpkg rpm -v --checksig libtool-1.5.2-2.0.1.src.rpm $ /bin/openpkg rpm --rebuild libtool-1.5.2-2.0.1.src.rpm $ su - # /bin/openpkg rpm -Fvh /RPM/PKG/libtool-1.5.2-2.0.1.*.rpm ________________________________________________________________________

References: [0] http://marc.theaimsgroup.com/?l=bugtraq&m=107577516526919&w=4 [1] http://www.gnu.org/software/libtool/ [2] http://www.geocrawler.com/mail/msg.php3?msg_id=3438808&list=405 [3] http://www.openpkg.org/tutorial.html#regular-source [4] http://www.openpkg.org/tutorial.html#regular-binary [5] ftp://ftp.openpkg.org/release/1.3/UPD/libtool-1.5-1.3.1.src.rpm [6] ftp://ftp.openpkg.org/release/2.0/UPD/libtool-1.5.2-2.0.1.src.rpm [7] ftp://ftp.openpkg.org/release/1.3/UPD/ [8] ftp://ftp.openpkg.org/release/2.0/UPD/ [9] http://www.openpkg.org/security.html#signature ________________________________________________________________________

For security reasons, this advisory was digitally signed with the OpenPGP public key "OpenPKG " (ID 63C4CB9F) of the OpenPKG project which you can retrieve from http://pgp.openpkg.org and hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/ for details on how to verify the integrity of this advisory. ________________________________________________________________________

-----BEGIN PGP SIGNATURE----- Comment: OpenPKG

iD8DBQFATIP9gHWT4GPEy58RAo6FAKCnG7b3CxcdfRAKsUufQMg1YxcWAQCgjO5a syMZ6CTgVMFNKv1D/eTbN/4= =kQMN -----END PGP SIGNATURE----- ______________________________________________________________________ The OpenPKG Project http://www.openpkg.org Project Announcement List [e-mail:openpkg-announce@openpkg.org]