-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

______________________________________________________________________________
		   Caldera Systems, Inc.  Security Advisory

Subject:		security problems in webmin
Advisory number: 	CSSA-2001-004.0
Issue date: 		2001 January, 17
Cross reference:
______________________________________________________________________________


1. Problem Description

   On several occasions, webmin creates temporary files insecurely.
   This can be exploited by a local attacker to overwrite or
   create arbitrary files and possibly gain root privilege.
 
   There are no known exploits for this problem.

2. Vulnerable Versions

   System                       Package
   -----------------------------------------------------------
   OpenLinux Desktop 2.3        not shipping with webmin

   OpenLinux eServer 2.3.1      All packages previous to
   and OpenLinux eBuilder       webmin-0.749-5

   OpenLinux eDesktop 2.4	All packages previous to
                                wemin-0.78-8

3. Solution

   Workaround:

     none

   The proper solution is to upgrade to the fixed packages.

4. OpenLinux eServer 2.3.1 and OpenLinux eBuilder for ECential 3.0

   4.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eServer/2.3/current/SRPMS

   4.2 Verification
       
       9cf4e2041e6c6122f402199d09fcbffc  RPMS/webmin-0.749-5.i386.rpm
       4a1eaff7a80609ec19198aa815081f4b  SRPMS/webmin-0.749-5.src.rpm 
       
   4.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  rpm -Fhv webmin-0.749-5.i386.rpm

5. OpenLinux eDesktop 2.4

   5.1 Location of Fixed Packages

       The upgrade packages can be found on Caldera's FTP site at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/RPMS/

       The corresponding source code package can be found at:

       ftp://ftp.calderasystems.com/pub/updates/eDesktop/2.4/current/SRPMS

   5.2 Verification

       b6c8209aac511616367e8a6278e49c6d  RPMS/webmin-0.78-8.i386.rpm
       fb9ddf3279b007fa99f49e7aaf486f5b  SRPMS/webmin-0.78-8.src.rpm 

   5.3 Installing Fixed Packages

       Upgrade the affected packages with the following commands:

	  rpm -Fhv webmin-0.78-8.i386.rpm

6. References

   This and other Caldera security resources are located at:

   http://www.calderasystems.com/support/security/index.html

   This security fix closes Caldera's internal Problem Report 8732.

7. Disclaimer

   Caldera Systems, Inc. is not responsible for the misuse of any of the
   information we provide on this website and/or through our security
   advisories. Our advisories are a service to our customers intended to
   promote secure installation and use of Caldera OpenLinux.

______________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.1 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE6ZarL18sy83A/qfwRApCGAJ9v/FkWzGVtASyI5Ldopk7ZCau4twCeLOxS
eUIie7kKyFMgJqLROaJflWE=
=rAVp
-----END PGP SIGNATURE-----