TUCoPS :: Linux :: Red Hat/Fedora :: m-057.txt

Red Hat at Vulnerability (CIAC M-057)


                       The U.S. Department of Energy
                     Computer Incident Advisory Center
                           ___  __ __    _     ___
                          /       |     /_\   /
                          \___  __|__  /   \  \___

                             INFORMATION BULLETIN

                           Red Hat "at" Vulnerability
                           [Red Hat RHSA-2002:015-17]

March 18, 2002 22:00 GMT                                          Number M-057
PROBLEM:       A heap corruption vulnerability exists in the "at" program that
               allows local users to execute arbitrary code. 
PLATFORM:      Red Hat Linux 6.2 - alpha, i386, sparc 
               Red Hat Linux 7.0 - alpha, i386 
               Red Hat Linux 7.1 - alpha, i386, ia64 
               Red Hat Linux 7.2 - i386, ia64, s390 
DAMAGE:        A malicious local user could execute arbitrary code. The "at" 
               command is installed as setuid root, therefore arbitrary code 
               would be run with root privileges. 
SOLUTION:      Apply the appropriate RPMs. 
VULNERABILITY  The risk is LOW. A local user account is necessary to exploit 
ASSESSMENT:    this vulnerability. 
 CIAC BULLETIN:      http://www.ciac.org/ciac/bulletins/m-057.shtml 
 ORIGINAL BULLETIN:  https://www.redhat.com/support/errata/RHSA-2002-015.html 

[***** Start Red Hat RHSA-2002:015-17 *****]

Synopsis: Updated at package available  

Advisory ID: RHSA-2002:015-17  

Issue Date: 2002-01-15  

Updated On: 2002-03-13  

Product: Red Hat Linux  

Keywords: at security heap corruption environment  

Cross References:  


1. Topic:

This updated at package fixes two minor problems and one major
problem where the environment can get wiped out prior to the 
execution of a scheduled command.

For versions of Red Hat Linux prior to 7.2, this package also 
fixes a potential security vulnerability which can result in 
heap corruption (Red Hat Linux 7.2 is not vulnerable to this 
security exploit).

Update 2002-02-01: The package for Red Hat Linux 6.2 tried to 
source a file in /etc/init.d, which doesn't exist on a standard 

2. Problem description:

A server running the latest version of at could have commands 
that depend on the current environment (for example, the PATH) 
which would then fail or run incorrectly because the environment 
would not be accessible when the command was executed at a later 

Additionally, in versions of Red Hat Linux prior to 7.2 a malicious 
local user could specify an execution time is in a carefully 
drafted format causing a heap corruption bug. Since the at command 
is installed as setuid root this bug can be exploited.

The Common Vulnerabilities and Exposures project (cve.mitre.org) 
has assigned the name CAN-2002-0004 to this issue. Thanks to 
zen-parse for reporting this vulnerability.

In addition to the fixed heap corruption, file handling security 
on all versions of at has been improved by adding the O_EXCL 
(exclusive) option to an open system call. 

3. Bug IDs fixed: (see bugzilla for more information)

49491 - all environment is wiped out prior to executing user command
51253 - Wrong pointer to time syntax in man page
52626 - "at" RPM says that /var/spool/at/.SEQ should be executable

4. Relevant releases/architectures:

Red Hat Linux 6.2 - alpha, i386, sparc 
Red Hat Linux 7.0 - alpha, i386 
Red Hat Linux 7.1 - alpha, i386, ia64 
Red Hat Linux 7.2 - i386, ia64, s390

5. RPMs required:

Red Hat Linux 6.2:





Red Hat Linux 7.0:




Red Hat Linux 7.1:





Red Hat Linux 7.2:





6. Solution:

Before applying this update, make sure all previously released 
errata relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only 
those RPMs which are currently installed will be updated. Those 
RPMs which are not installed but included in the list will not be 
updated. Note that you can also use wildcards (*.rpm) if your 
current directory *only* contains the desired RPMs.

Please note that this update is also available via Red Hat Network. 
Many people find this an easier way to apply updates. To use Red 
Hat Network, launch the Red Hat Update Agent with the following 


This will start an interactive process that will result in the 
appropriate RPMs being upgraded on your system. 

7. Verification:

MD5 sum                           Package Name
beab8c80838d3920d758a2e8e5b5e3b2 6.2/en/os/SRPMS/at-3.1.8-22.2.src.rpm
31a1aac9c620778fe24a5d9c73b468c6 6.2/en/os/alpha/at-3.1.8-22.2.alpha.rpm
a5ea88124398a0b937dd93e93d62c3bd 6.2/en/os/i386/at-3.1.8-22.2.i386.rpm
3ee8b5c53f23d0eae9bd78c69621ff78 6.2/en/os/sparc/at-3.1.8-22.2.sparc.rpm
b1f62f4b41e12a54a1f73d639363a638 7.0/en/os/SRPMS/at-3.1.8-23.src.rpm
97e27a1d2dc0f08d8f118209a891689a 7.0/en/os/alpha/at-3.1.8-23.alpha.rpm
ea793fd803f10c8fa66abb8191fefb9b 7.0/en/os/i386/at-3.1.8-23.i386.rpm
b1f62f4b41e12a54a1f73d639363a638 7.1/en/os/SRPMS/at-3.1.8-23.src.rpm
97e27a1d2dc0f08d8f118209a891689a 7.1/en/os/alpha/at-3.1.8-23.alpha.rpm
ea793fd803f10c8fa66abb8191fefb9b 7.1/en/os/i386/at-3.1.8-23.i386.rpm
8fed88d53824e98f509289c42ea01237 7.1/en/os/ia64/at-3.1.8-23.ia64.rpm
b1f62f4b41e12a54a1f73d639363a638 7.2/en/os/SRPMS/at-3.1.8-23.src.rpm
ea793fd803f10c8fa66abb8191fefb9b 7.2/en/os/i386/at-3.1.8-23.i386.rpm
8fed88d53824e98f509289c42ea01237 7.2/en/os/ia64/at-3.1.8-23.ia64.rpm
b392c294aab8dfa5ec86255d7582fa04 7.2/en/os/s390/at-3.1.8-23.s390.rpm

These packages are GPG signed by Red Hat, Inc. for security. Our key 
is available at: http://www.redhat.com/about/contact.html
You can verify each package with the following command: 
rpm --checksig filename

If you only wish to verify that each package has not been corrupted 
or tampered with, examine only the md5sum with the following command: 
rpm --checksig --nogpg filename

Note that you need RPM >= 3.0 to check GnuPG keys. 

8. References:


[***** End Red Hat RHSA-2002:015-17 *****]


CIAC wishes to acknowledge the contributions of Red Hat, Inc. for the 
information contained in this bulletin.

CIAC, the Computer Incident Advisory Center, is the computer
security incident response team for the U.S. Department of Energy
(DOE) and the emergency backup response team for the National
Institutes of Health (NIH). CIAC is located at the Lawrence Livermore
National Laboratory in Livermore, California. CIAC is also a founding
member of FIRST, the Forum of Incident Response and Security Teams, a
global organization established to foster cooperation and coordination
among computer security teams worldwide.

CIAC services are available to DOE, DOE contractors, and the NIH. CIAC
can be contacted at:
    Voice:    +1 925-422-8193 (7x24)
    FAX:      +1 925-423-8002
    STU-III:  +1 925-423-2604
    E-mail:   ciac@ciac.org

Previous CIAC notices, anti-virus software, and other information are
available from the CIAC Computer Security Archive.

   World Wide Web:      http://www.ciac.org/
   Anonymous FTP:       ftp.ciac.org

PLEASE NOTE: Many users outside of the DOE, ESnet, and NIH computing
communities receive CIAC bulletins.  If you are not part of these
communities, please contact your agency's response team to report
incidents. Your agency's team will coordinate with CIAC. The Forum of
Incident Response and Security Teams (FIRST) is a world-wide
organization. A list of FIRST member organizations and their
constituencies can be obtained via WWW at http://www.first.org/.

This document was prepared as an account of work sponsored by an
agency of the United States Government. Neither the United States
Government nor the University of California nor any of their
employees, makes any warranty, express or implied, or assumes any
legal liability or responsibility for the accuracy, completeness, or
usefulness of any information, apparatus, product, or process
disclosed, or represents that its use would not infringe privately
owned rights. Reference herein to any specific commercial products,
process, or service by trade name, trademark, manufacturer, or
otherwise, does not necessarily constitute or imply its endorsement,
recommendation or favoring by the United States Government or the
University of California. The views and opinions of authors expressed
herein do not necessarily state or reflect those of the United States
Government or the University of California, and shall not be used for
advertising or product endorsement purposes.

LAST 10 CIAC BULLETINS ISSUED (Previous bulletins available from CIAC)

M-047: Oracle PL/SQL EXTPROC Database Vulnerability
M-048: Oracle 9iAS Default Configuration Vulnerability
M-049: Multiple PHP Vulnerabilities
M-050: Data Leak with Cisco Express Forwarding
M-051: Microsoft XMLHTTP Control Vulnerability
M-052: Microsoft Java Applet Can Redirect Browser Traffic
M-053: mod_ssl and Apache_SSL Modules Contain a Buffer Overflow
M-054: OpenSSH Contains Remote Exploitable Vulnerability
M-055: Microsoft Unchecked Buffer in Windows Shell
M-056: Red Hat "uuxqt" Vulnerability

TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2024 AOH