Note: This is an archival copy of Security Sun Alert 200261 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000205.1.
Date of Resolved Release
FTP daemon of Heimdal is vulnerable to multiple signal handler race conditions ...
The FTP daemon of Heimdal is vulnerable to multiple signal handler race conditions that may allow an unprivileged remote or local user to execute aribitrary code with the privileges (typically root) of the FTP server process .
Note: Heimdal (heimdal.info) is a free implementation of Kerberos 5.
This issue is described in the following documents:
2. Contributing Factors
This issue can occur in the following releases:
Note: JDS for Solaris is not impacted by this issue.
This issue only occurs with Heimdal FTP versions heimdal-0.4e-396 or earlier.
To determine the release of JDS for Linux installed on a system, the following command can be run:
% cat /etc/sun-release Sun Java Desktop System, Release 2 -build 10b (GA) Assembled 30 March 2004
To determine the version of Heimdal, the following command can be run:
% rpm -qf /usr/lib/heimdal/sbin/ftpd heimdal-0.4e-396
There are no predictable symptoms that would indicate the described issue has been exploited.
There is no workaround. Please see the "Resolution" section below.
This issue is addressed in the following releases:
To download and install the updated RPMs from the update servers select the following from the launch bar:
Launch >> Applications >> System Tools >> Online Update
For more information on obtaining updates see:
Copyright 2000-2010 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
Sun Java Desktop System Release 2
This solution has no attachment