-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ Caldera International, Inc. Security Advisory Subject: Volution 1.0 security update Advisory number: CSSA-2001-021.0 Issue date: 2001 June, 08 Cross reference: ______________________________________________________________________________ 1. Problem Description The Volution client and server components have been enhanced from the currently shipping (English and International) components to provide a higher level of security. If you are using the Volution client that comes with OpenLinux 3.1, you do not need to apply the client RPM listed here. However, you will need to apply the server RPM. Volution Client One of the security enhancements made affects the way the Volution client interacts with the Volution Computer Creation Daemon. The new Volution client by default, WILL NOT use the Computer Creation Daemon. To use the Computer Creation Daemon, edit the /etc/opt/csm/csm.conf file and add a entry. Here is an example where the entry has been added: INSERT_YOUR_URL_HERE INSERT_YOUR_OBJECT_NAME_HERE INSERT_PASSWORD_HERE INSERT_YOUR_OBJECT_NAME_HERE INSERT_SWR_LOCATION_HERE A Volution client with this csm.conf file change contacts the Volution Computer Creation daemon and a new csm.conf file with the proper authname, password, etc., is created. The risk of having a entry in the csm.conf file is that the machine could be vulnerable to control by a rogue Volution server. If a Volution client has in the csm.conf file and it is unable to authenticate to the LDAP directory server, it will attempt to contact a Computer Creation Daemon which it finds using SLP. If a rogue Volution system has been brought up inside your network, the Volution client could communicate with the rogue Volution system. If this happens, the rogue Volution system now has control of the client. Volution Server Security enhancements have also been made to the Volution server. We recommend that you upgrade the Volution server components to csm-server-1.0.8-47. The file /etc/opt/csm/csmccd.conf on the Volution server is used as a template for new client csm.conf files that are created as a result from a Volution client / Volution Computer Creation Daemon communication. If you want Volution clients to continue to use the Computer Creation Daemon, a entry must be placed in the csmccd.conf file. Here is an example where the entry has been added to the csmccd.conf file: LDAP://ldap.calderalabs.com:389 INSERT_YOUR_OBJECT_NAME_HERE INSERT_YOUR_PASSWORD_HERE INSERT_YOUR_OBJECT_NAME_HERE ou=rpms,o=caldera LOCATION_WORKSTATIONS_WILL_BE_CREATED SEARCH_FOR_WORKSTATIONS_HERE_ON_UPDATES AND_ALSO_SEARCH_HERE AND_HERE (You can have as many as you need) 2. Vulnerable Versions System Package ----------------------------------------------------------- Volution 1.0 All packages previous to csm-1.0.8-47 csm-server-1.0.8.47 3. Solution Workaround none The proper solution is to upgrade to the latest packages. 4. Volution 1.0 4.1 Location of Fixed Packages The upgrade packages can be found on Caldera's FTP site at: ftp://ftp.caldera.com/pub/updates/Volution/1.0/current/RPMS/ 4.2 Verification eb708eb65a667a7108726a1fecc0b56f RPMS/csm-1.0.8-47.i386.rpm c0cbc125afd8aae3ecec143432359750 RPMS/csm-server-1.0.8-47.i386.rpm 4.3 Installing Fixed Packages Upgrade the affected packages with the following commands: rpm -Fhv csm*.i386.rpm 5. References This and other Caldera security resources are located at: http://www.caldera.com/support/security/index.html This security fix addresses Caldera's internal Problem Report 9547. 6. Disclaimer Caldera International, Inc. is not responsible for the misuse of any of the information we provide on this web site and /or through our security advisories. Our advisories are a service to our customers intended to promote secure intallation and use of Caldera Volution. 7. Licence Agreement Downloading this software upgrade does not grant you a license for the software. If you have and existing license for the software, this upgrade is bound by the terms of the software license agreement included with the original software. ______________________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.5 (GNU/Linux) Comment: For info see http://www.gnupg.org iD8DBQE7IJZc18sy83A/qfwRAvTDAJ4iOz5pO/b4kMSjgxlLlsQO3o1dtQCbBcdk GjgmKRlr7rar5bVu93J3IJg= =yZ1W -----END PGP SIGNATURE-----