aaabase < 2000.1.3 on SuSE Linux


    Following is based on SuSE Security Announcement.  A security hole
    was discovered in the package  mentioned above.  Please update  as
    soon as  possible or  disable the  service if  you are  using this
    software  on  your  SuSE   Linux  installation(s).   Other   Linux
    distributions  or  operating  systems  might  be affected as well,
    please contact your vendor for information about this issue.

    aaa_base is  the basic  package which  comes with  any SuSE  Linux
    installation.  Two vulnerabilities have been found:

    1) The cron job /etc/cron.daily/aaa_base does a daily checking  of
       files in /tmp and /var/tmp, where old files will be deleted  if
       configured to  do so.   Please note  this this  feature is  NOT
       activated by default.
    2) Some system accounts have their homedirectories set to /tmp  by
       default.   These  are  the  users  games,  firewall, wwwrun and
       nobody on a SuSE 6.4.

    What about impact?

    1) If the /tmp cleanup is activated, any file or directory can  be
       deleted by any local user
    2) If an attacker creates dot files in /tmp (e.g. bash  profiles),
       these might be executed if  someone uses e.g. "su -  nobody" to
       switch to the nobody  user.  This can  lead to a compromise  of
       that userid.   This vulnerability is  present in several  other
       unix systems as well - please check all!


    Update the package from FTP server.   You can find updates on  our
    ftp-Server: for Intel processors  for Alpha processors

    or try the following web pages for a list of mirrors:

    Directly that would be:

    The root user will receive a email with the accounts listed  which
    have a  homedirectory in  /tmp.   You have  to fix  this by  hand,
    because some installations might break if they rely on information
    saved in  the (unsafe)  /tmp homedirectory.   The email  will give
    more information what to do.