Security bugs are reported here via bugzilla

[Seth Alan Woolley <seth AT positivism.org>]

There's a patch on the full-disclosure list. 

http://www.guninski.com/binls.html

Best patch I've seen so far is this:

http://mail.gnu.org/archive/html/bug-coreutils/2003-10/msg00076.html

It's also fixed in CVS, supposedly -- looks like they won't be releasing
a new version for it, so we may have to patch it.

Seth

On Wed, Nov 05, 2003 at 04:38:58PM +0000, Eric Sandall wrote:
> Do we need to look up these patches for our systems?
> 
> -sandalle
> 
> ----- Forwarded message from Eric Sandall <ispsysop AT yahoo.com> -----
>     Date: Wed, 5 Nov 2003 08:37:53 -0800 (PST)
>     From: Eric Sandall <ispsysop AT yahoo.com>
> Reply-To: Eric Sandall <ispsysop AT yahoo.com>
>  Subject: Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix ls
> vulnerabilities
>       To: eric AT sandall.us
> 
> 
> --- Red Hat Network Alert <dev-null AT rhn.redhat.com> wrote:
> > Date: Tue, 4 Nov 2003 16:49:31 -0500
> > Subject: RHN Errata Alert: Updated fileutils/coreutils package fix ls
> > vulnerabilities
> > From: Red Hat Network Alert <dev-null AT rhn.redhat.com>
> > To: ispsysop <ispsysop AT yahoo.com>
> > 
> > Red Hat Network has determined that the following advisory is
> > applicable to
> > one or more of the systems you have registered:
> > 
> > Complete information about this errata can be found at the following
> > location:
> >     
> > https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1865
> > 
> > Security Advisory - RHSA-2003:309-08
> >
> ------------------------------------------------------------------------------
> > Summary:
> > Updated fileutils/coreutils package fix ls vulnerabilities
> > 
> > Updated fileutils and coreutils packages that close a potential
> > denial of
> > service vulnerability are now available.
> > 
> > Description:
> > The fileutils package contains several basic system utilities. One of
> > these utilities is the "ls" program, which is used to list
> > information
> > about files and directories. In Red Hat Linux 9, the ls program is
> > part of
> > the coreutils package.
> > 
> > Georgi Guninski discovered a memory starvation denial of service
> > vulnerability in the ls program.  It is possible to make ls allocate
> > a
> > huge amount of memory by specifying certain command line arguments. 
> > This
> > vulnerability is remotely exploitable through services like wu-ftpd,
> > which
> > pass user arguments to ls.  The Common Vulnerabilities and Exposures
> > project (cve.mitre.org) has assigned the name CAN-2003-0854 to this
> > issue.
> > 
> > A non-exploitable integer overflow in ls has also been discovered. 
> > It is
> > possible to make ls crash by specifying certain command line
> > arguments. 
> > This vulnerability is remotely exploitable through services like
> > wu-ftpd,
> > which pass user arguments to ls.  The Common Vulnerabilities and
> > Exposures
> > project (cve.mitre.org) has assigned the name CAN-2003-0853 to this
> > issue.
> > 
> > This erratum contains new fileutils packages for Red Hat Linux
> > versions
> > 7.1, 7.2, 7.3, and 8.0.  It also contains new coreutils packages for
> > Red
> > Hat Linux 9.  These packages contain backported patches correcting
> > these
> > vulnerabilities.
> > 
> > The Red Hat Linux 7.2 and 7.3 packages also add support for the
> > O_DIRECT flag, which controls the use of synchronous I/O on file
> > systems
> > such as OCFS.
> >
> ------------------------------------------------------------------------------
> > 
> > -------------
> > Taking Action
> > -------------
> > You may address the issues outlined in this advisory in two ways:
> > 
> >      - select your server name by clicking on its name from the list
> >        available at the following location, and then schedule an
> >        errata update for it:
> >            https://rhn.redhat.com/network/systemlist/system_list.pxt
> > 
> >      - run the Update Agent on each affected server.
> > 
> > 
> > ---------------------------------
> > Changing Notification Preferences
> > ---------------------------------
> > To enable/disable your Errata Alert preferences globally please log
> > in to RHN
> > and navigate from "Your RHN" / "Your Account" to the "Preferences"
> > tab.
> > 
> >         URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt
> > 
> > You can also enable/disable notification on a per system basis by
> > selecting an
> > individual system from the "Systems List". From the individual system
> > view
> > click the "Details" tab.
> > 
> > 
> > ----------------
> > Affected Systems
> > ----------------
> > According to our records, this errata may apply to one or more of the
> > 
> > systems that you've profiled with Red Hat Network.  To see precisely
> > which 
> > systems are affected, please go to:
> >    
> > https://rhn.redhat.com/network/errata/systems_affected.pxt?eid=1865
> > 
> > 
> > 
> > The Red Hat Network Team
> > 
> > This message is being sent by Red Hat Network Alert to:
> >     RHN user login:        ispsysop
> >     Email address on file: <ispsysop AT yahoo.com>
> > 
> > If you lost your RHN password, you can use the information above to
> > retrieve it by email from the following address:
> >     https://rhn.redhat.com/forgot_password.pxt
> > 
> > To cancel these notices, go to:
> >     https://rhn.redhat.com/oo.pxt?uid=1027788&oid=1588450
> >     
> > 
> > 
> > 
> 
> 
> =====
> Eric Sandall                  * Computer Systems Administrator         
> Institute
> for Shock Physics   * Department of Physics                  Washington 
> State
> University   * P.O. Box 642816      
> Pullman, WA 99164-2816        * phone: (509) 335-5931
> e-mail: ispsysop AT yahoo.com
> "Adventure. Excitement. A sysop craves not these things." -Anonymous
> 
> "MS Windows is for those who want to use computers for work, Linux is for 
> those
> who want to work on their computers" -Eric S.
> 
> __________________________________
> Do you Yahoo!?
> Protect your identity with Yahoo! Mail AddressGuard
> http://antispam.yahoo.com/whatsnewfree
> 
> ----- End forwarded message -----
> 
> 
> -- 
> PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
> http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61
> 
> -----BEGIN GEEK CODE BLOCK-----
> Version: 3.12
> GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++ N+@ 
> o?
> K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+) R+(++)
> tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
> ------END GEEK CODE BLOCK------
> 
> Eric Sandall                     |  Source Mage GNU/Linux Developer
> eric AT sandall.us                  |  http://www.sourcemage.org/
> http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
> http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
> 
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
> _______________________________________________
> SM-Security mailing list
> SM-Security AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/sm-security

-- 
Seth Alan Woolley <seth at positivism.org>, SPAM/UCE is unauthorized
Key id EF10E21A = 36AD 8A92 8499 8439 E6A8  3724 D437 AF5D EF10 E21A
http://smgl.positivism.org:11371/pks/lookup?op=get&search=0xEF10E21A

Attachment: pgppHp4cMKz15.pgp
Description: PGP signature