_____________________________________________________________________________

      SCO Security Advisory

Subject:    Linux: uudecode performs inadequate checks on user-specified output files
Advisory number:   CSSA-2002-040.0
Issue date:     2002 October 28
Cross reference:
______________________________________________________________________________


1. Problem Description

  The uudecode utility would create an output file without checking
  to see if it was about to write to a symlink or a pipe. If a
  user uses uudecode to extract data into open shared directories,
  such as /tmp, this vulnerability could be used by a local attacker
  to overwrite files or lead to privilege escalation.


2. Vulnerable Supported Versions

  System        Package
  ----------------------------------------------------------------------

  OpenLinux 3.1.1 Server    prior to sharutils-4.2.1-7MR.1.i386.rpm

  OpenLinux 3.1.1 Workstation  prior to sharutils-4.2.1-7MR.1.i386.rpm

  OpenLinux 3.1 Server    prior to sharutils-4.2.1-7MR.1.i386.rpm

  OpenLinux 3.1 Workstation  prior to sharutils-4.2.1-7MR.1.i386.rpm


3. Solution

  The proper solution is to install the latest packages. Many
  customers find it easier to use the Caldera System Updater, called
  cupdate (or kcupdate under the KDE environment), to update these
  packages rather than downloading and installing them by hand.


4. OpenLinux 3.1.1 Server

  4.1 Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/RPMS

  4.2 Packages

  98a9348513f981d0c919de67c7a3fd44  sharutils-4.2.1-7MR.1.i386.rpm

  4.3 Installation

  rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

  4.4 Source Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2002-040.0/SRPMS

  4.5 Source Packages

  9c89a0b5d4527def4cb2764bcd87f972  sharutils-4.2.1-7MR.1.src.rpm


5. OpenLinux 3.1.1 Workstation

  5.1 Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/RPMS

  5.2 Packages

  d790a48715269c624d347556e4e84253  sharutils-4.2.1-7MR.1.i386.rpm

  5.3 Installation

  rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

  5.4 Source Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2002-040.0/SRPMS

  5.5 Source Packages

  521eb3dbd3aabb1e76a5db895f46e0bf  sharutils-4.2.1-7MR.1.src.rpm


6. OpenLinux 3.1 Server

  6.1 Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/RPMS

  6.2 Packages

  87cd6250715583afa9905785853e546b  sharutils-4.2.1-7MR.1.i386.rpm

  6.3 Installation

  rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

  6.4 Source Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2002-040.0/SRPMS

  6.5 Source Packages

  ce9daba62eb424024a37b1d0288384db  sharutils-4.2.1-7MR.1.src.rpm


7. OpenLinux 3.1 Workstation

  7.1 Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/RPMS

  7.2 Packages

  03b5f44ec89f04f36500e9ce909459ad  sharutils-4.2.1-7MR.1.i386.rpm

  7.3 Installation

  rpm -Fvh sharutils-4.2.1-7MR.1.i386.rpm

  7.4 Source Package Location

   ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2002-040.0/SRPMS

  7.5 Source Packages

  cc2636f8152aced9d77fa310c65f0b8c  sharutils-4.2.1-7MR.1.src.rpm


8. References

  Specific references for this advisory:
     http://www.aerasec.de/security/index.html?id=ae-200204-033?=en
     http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0178
     http://www.kb.cert.org/vuls/id/336083

  SCO security resources:
     http://www.sco.com/support/security/index.html

  This security fix closes SCO incidents sr864863, fz521051,
  erg712053.


9. Disclaimer

  SCO is not responsible for the misuse of any of the information
  we provide on this website and/or through our security
  advisories. Our advisories are a service to our customers intended
  to promote secure installation and use of SCO products.


10. Acknowledgements

  AERAsec discovered and researched this vulnerability.