COMMAND
aaabase
SYSTEMS AFFECTED
aaabase < 2000.1.3 on SuSE Linux
PROBLEM
Following is based on SuSE Security Announcement. A security hole
was discovered in the package mentioned above. Please update as
soon as possible or disable the service if you are using this
software on your SuSE Linux installation(s). Other Linux
distributions or operating systems might be affected as well,
please contact your vendor for information about this issue.
aaa_base is the basic package which comes with any SuSE Linux
installation. Two vulnerabilities have been found:
1) The cron job /etc/cron.daily/aaa_base does a daily checking of
files in /tmp and /var/tmp, where old files will be deleted if
configured to do so. Please note this this feature is NOT
activated by default.
2) Some system accounts have their homedirectories set to /tmp by
default. These are the users games, firewall, wwwrun and
nobody on a SuSE 6.4.
What about impact?
1) If the /tmp cleanup is activated, any file or directory can be
deleted by any local user
2) If an attacker creates dot files in /tmp (e.g. bash profiles),
these might be executed if someone uses e.g. "su - nobody" to
switch to the nobody user. This can lead to a compromise of
that userid. This vulnerability is present in several other
unix systems as well - please check all!
SOLUTION
Update the package from FTP server. You can find updates on our
ftp-Server:
ftp://ftp.suse.com/pub/suse/i386/update for Intel processors
ftp://ftp.suse.com/pub/suse/axp/update for Alpha processors
or try the following web pages for a list of mirrors:
http://www.suse.de/ftp.html
http://www.suse.com/ftp_new.html
Directly that would be:
ftp://ftp.suse.com/pub/suse/axp/update/6.1/a1/aaa_base-2000.5.2-0.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/6.3/a1/aaa_base-2000.5.2-0.alpha.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.1/a1/aaa_base-2000.5.2-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.2/a1/aaa_base-2000.5.2-0.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.4/a1/aaa_base-2000.5.2-0.i386.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/6.3/a1/aaa_base-2000.5.2-0.ppc.rpm
The root user will receive a email with the accounts listed which
have a homedirectory in /tmp. You have to fix this by hand,
because some installations might break if they rely on information
saved in the (unsafe) /tmp homedirectory. The email will give
more information what to do.