TITLE:
SUSE update for permissions

SECUNIA ADVISORY ID:
SA17290

VERIFY ADVISORY:
http://secunia.com/advisories/17290/

CRITICAL:
Less critical

IMPACT:
Security Bypass

WHERE:
Local system

OPERATING SYSTEM:
UnitedLinux 1.0
http://secunia.com/product/2003/
SUSE Linux Enterprise Server 9
http://secunia.com/product/4118/
SuSE Linux Enterprise Server 8
http://secunia.com/product/1171/
SuSE Linux Desktop 1.x
http://secunia.com/product/2002/
SUSE Linux 9.3
http://secunia.com/product/4933/
SUSE Linux 9.2
http://secunia.com/product/4258/
SuSE Linux 9.1
http://secunia.com/product/3473/
SuSE Linux 9.0
http://secunia.com/product/2467/

DESCRIPTION:
SUSE has issued an update for permissions. This fixes a
vulnerability, which can be exploited by malicious, local users to
bypass certain security restrictions.

The vulnerability is caused due to the way "chkstat" tries to prevent
symlink attacks by not changing the permissions of files that has a
hardlink count of more than one. This can be bypassed by creating a
hardlink to the targeted file. When the file has been deleted and
replaced by a new one by its owner, the hardlink count of the file
created by the malicious user will decrease to one, thus allowing the
permissions of the targeted file to be changed.

SOLUTION:
Apply updated packages.

-- x86 Platform --

SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/permissions-2005.10.20-0.1.i586.rpm
216afa8469276198015e5fff177580d2

SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/i586/permissions-2005.10.20-0.1.i586.rpm
3d61d27c7bf81889a321972ac12dcaab

SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/i586/permissions-2005.10.20-0.2.i586.rpm
72d9a0b5b0b750fb656aa54eb7c6ebdd

SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/permissions-2005.10.20-3.i586.rpm
cf8c022048e93fc6d159913ad7824e6a
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/i586/xmcd-3.0.2-552.i586.rpm
f3e82cf342c45ab46fca16c98587b22d

-- x86-64 Platform --

SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/permissions-2005.10.20-0.1.x86_64.rpm
0d11d64965eee2cefeb56edfe258fee4

SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/x86_64/permissions-2005.10.20-0.1.x86_64.rpm
4f2373ed4a93e3974b919e595a9490b7

SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/x86_64/permissions-2005.10.20-0.2.x86_64.rpm
3ca12f4aae9b7a1b484e6a0e4f8f658d

SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/permissions-2005.10.20-3.x86_64.rpm
853503b8868c1d2a34d05aaf6824cf83
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/x86_64/xmcd-3.0.2-552.x86_64.rpm
fd95ac5dd3980af5308abe7062849149

-- Sources --

SUSE LINUX 9.3:
ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/src/permissions-2005.10.20-0.1.src.rpm
0a856cadf3b65db9434f20203413aba3

SUSE LINUX 9.2:
ftp://ftp.suse.com/pub/suse/i386/update/9.2/rpm/src/permissions-2005.10.20-0.1.src.rpm
57c3240513c9861634e79547df4f8cf0

SUSE LINUX 9.1:
ftp://ftp.suse.com/pub/suse/i386/update/9.1/rpm/src/permissions-2005.10.20-0.2.src.rpm
b47b5e76f759227d325a33dbbcb5ae96
ftp://ftp.suse.com/pub/suse/x86_64/update/9.1/rpm/src/permissions-2005.10.20-0.2.src.rpm
f98fa35639b7d118e6aed1ecb99c4cbb

SuSE Linux 9.0:
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/permissions-2005.10.20-3.src.rpm
8fa2759f6d2012aee4571e5830ea26eb
ftp://ftp.suse.com/pub/suse/i386/update/9.0/rpm/src/xmcd-3.0.2-552.src.rpm
44f64e89f871fd07bd6291d88277b327
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/permissions-2005.10.20-3.src.rpm
48857a183ff120bc39ebb280eaca8764
ftp://ftp.suse.com/pub/suse/x86_64/update/9.0/rpm/src/xmcd-3.0.2-552.src.rpm
9e961bdfaf2c935857eb86bd64b74c83

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Stefan Nordhausen.

ORIGINAL ADVISORY:
http://lists.suse.com/archive/suse-security-announce/2005-Oct/0008.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------