Security bugs are reported here via bugzilla

[Hamish Greig <hgreig AT bigpond.net.au>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I tested this using the ls command suggested in the second link from Seth, 
jsut to mkae sure because the redhat version differs from ours.
The bug existed so I have now patched coreutils to fix this and retested it.
It is all fixed and pushed into stable 
Hamish
On Fri, 7 Nov 2003 16:06, Seth Alan Woolley wrote:
> There's a patch on the full-disclosure list.
>
> http://www.guninski.com/binls.html
>
> Best patch I've seen so far is this:
>
> http://mail.gnu.org/archive/html/bug-coreutils/2003-10/msg00076.html
>
> It's also fixed in CVS, supposedly -- looks like they won't be releasing
> a new version for it, so we may have to patch it.
>
> Seth
>
> On Wed, Nov 05, 2003 at 04:38:58PM +0000, Eric Sandall wrote:
> > Do we need to look up these patches for our systems?
> >
> > -sandalle
> >
> > ----- Forwarded message from Eric Sandall <ispsysop AT yahoo.com> -----
> >     Date: Wed, 5 Nov 2003 08:37:53 -0800 (PST)
> >     From: Eric Sandall <ispsysop AT yahoo.com>
> > Reply-To: Eric Sandall <ispsysop AT yahoo.com>
> >  Subject: Fwd: RHN Errata Alert: Updated fileutils/coreutils package fix
> > ls vulnerabilities
> >       To: eric AT sandall.us
> >
> > --- Red Hat Network Alert <dev-null AT rhn.redhat.com> wrote:
> > > Date: Tue, 4 Nov 2003 16:49:31 -0500
> > > Subject: RHN Errata Alert: Updated fileutils/coreutils package fix ls
> > > vulnerabilities
> > > From: Red Hat Network Alert <dev-null AT rhn.redhat.com>
> > > To: ispsysop <ispsysop AT yahoo.com>
> > >
> > > Red Hat Network has determined that the following advisory is
> > > applicable to
> > > one or more of the systems you have registered:
> > >
> > > Complete information about this errata can be found at the following
> > > location:
> > >
> > > https://rhn.redhat.com/network/errata/errata_details.pxt?eid=1865
> > >
> > > Security Advisory - RHSA-2003:309-08
> >
> > -------------------------------------------------------------------------
> >-----
> >
> > > Summary:
> > > Updated fileutils/coreutils package fix ls vulnerabilities
> > >
> > > Updated fileutils and coreutils packages that close a potential
> > > denial of
> > > service vulnerability are now available.
> > >
> > > Description:
> > > The fileutils package contains several basic system utilities. One of
> > > these utilities is the "ls" program, which is used to list
> > > information
> > > about files and directories. In Red Hat Linux 9, the ls program is
> > > part of
> > > the coreutils package.
> > >
> > > Georgi Guninski discovered a memory starvation denial of service
> > > vulnerability in the ls program.  It is possible to make ls allocate
> > > a
> > > huge amount of memory by specifying certain command line arguments.
> > > This
> > > vulnerability is remotely exploitable through services like wu-ftpd,
> > > which
> > > pass user arguments to ls.  The Common Vulnerabilities and Exposures
> > > project (cve.mitre.org) has assigned the name CAN-2003-0854 to this
> > > issue.
> > >
> > > A non-exploitable integer overflow in ls has also been discovered.
> > > It is
> > > possible to make ls crash by specifying certain command line
> > > arguments.
> > > This vulnerability is remotely exploitable through services like
> > > wu-ftpd,
> > > which pass user arguments to ls.  The Common Vulnerabilities and
> > > Exposures
> > > project (cve.mitre.org) has assigned the name CAN-2003-0853 to this
> > > issue.
> > >
> > > This erratum contains new fileutils packages for Red Hat Linux
> > > versions
> > > 7.1, 7.2, 7.3, and 8.0.  It also contains new coreutils packages for
> > > Red
> > > Hat Linux 9.  These packages contain backported patches correcting
> > > these
> > > vulnerabilities.
> > >
> > > The Red Hat Linux 7.2 and 7.3 packages also add support for the
> > > O_DIRECT flag, which controls the use of synchronous I/O on file
> > > systems
> > > such as OCFS.
> >
> > -------------------------------------------------------------------------
> >-----
> >
> > > -------------
> > > Taking Action
> > > -------------
> > > You may address the issues outlined in this advisory in two ways:
> > >
> > >      - select your server name by clicking on its name from the list
> > >        available at the following location, and then schedule an
> > >        errata update for it:
> > >            https://rhn.redhat.com/network/systemlist/system_list.pxt
> > >
> > >      - run the Update Agent on each affected server.
> > >
> > >
> > > ---------------------------------
> > > Changing Notification Preferences
> > > ---------------------------------
> > > To enable/disable your Errata Alert preferences globally please log
> > > in to RHN
> > > and navigate from "Your RHN" / "Your Account" to the "Preferences"
> > > tab.
> > >
> > >         URL: https://rhn.redhat.com/network/my_account/my_prefs.pxt
> > >
> > > You can also enable/disable notification on a per system basis by
> > > selecting an
> > > individual system from the "Systems List". From the individual system
> > > view
> > > click the "Details" tab.
> > >
> > >
> > > ----------------
> > > Affected Systems
> > > ----------------
> > > According to our records, this errata may apply to one or more of the
> > >
> > > systems that you've profiled with Red Hat Network.  To see precisely
> > > which
> > > systems are affected, please go to:
> > >
> > > https://rhn.redhat.com/network/errata/systems_affected.pxt?eid=1865
> > >
> > >
> > >
> > > The Red Hat Network Team
> > >
> > > This message is being sent by Red Hat Network Alert to:
> > >     RHN user login:        ispsysop
> > >     Email address on file: <ispsysop AT yahoo.com>
> > >
> > > If you lost your RHN password, you can use the information above to
> > > retrieve it by email from the following address:
> > >     https://rhn.redhat.com/forgot_password.pxt
> > >
> > > To cancel these notices, go to:
> > >     https://rhn.redhat.com/oo.pxt?uid=1027788&oid=1588450
> >
> > =====
> > Eric Sandall                  * Computer Systems Administrator        
> > Institute for Shock Physics   * Department of Physics                 
> > Washington State University   * P.O. Box 642816
> > Pullman, WA 99164-2816        * phone: (509) 335-5931
> > e-mail: ispsysop AT yahoo.com
> > "Adventure. Excitement. A sysop craves not these things." -Anonymous
> >
> > "MS Windows is for those who want to use computers for work, Linux is for
> > those who want to work on their computers" -Eric S.
> >
> > __________________________________
> > Do you Yahoo!?
> > Protect your identity with Yahoo! Mail AddressGuard
> > http://antispam.yahoo.com/whatsnewfree
> >
> > ----- End forwarded message -----
> >
> >
> > --
> > PGP Key Fingerprint:  FCFF 26A1 BE21 08F4 BB91  FAED 1D7B 7D74 A8EF DD61
> > http://search.keyserver.net:11371/pks/lookup?op=get&search=0xA8EFDD61
> >
> > -----BEGIN GEEK CODE BLOCK-----
> > Version: 3.12
> > GCS/E/IT$ d-- s++:+>: a-- C++(+++) BL++++VIS>$ P+(++) L+++ E-(---) W++
> > N+@ o? K? w++++>-- O M-@ V-- PS+(+++) PE(-) Y++(+) PGP++(+) t+() 5++ X(+)
> > R+(++) tv(--)b++(+++) DI+@ D++(+++) G>+++ e>+++ h---(++) r++ y+
> > ------END GEEK CODE BLOCK------
> >
> > Eric Sandall                     |  Source Mage GNU/Linux Developer
> > eric AT sandall.us                  |  http://www.sourcemage.org/
> > http://eric.sandall.us/          |  SysAdmin @ Inst. Shock Physics @ WSU
> > http://counter.li.org/  #196285  |  http://www.shock.wsu.edu/
> >
> > ----------------------------------------------------------------
> > This message was sent using IMP, the Internet Messaging Program.
> > 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/q52I8fSufZR6424RAusDAJ9vl5RiEtcnMAjUpGPUIFqECRJpvgCeLdIa
ACM3S8/a0lt7vZCH5UJrixw=
=Caxm
-----END PGP SIGNATURE-----