Syslinux Boot Loader SetUID Installation Vulnerability

Bugtraq ID:	6876
Class:	Configuration Error
CVE:
Remote:	No
Local:	Yes
Published:	Feb 18 2003 12:00AM
Updated:	Feb 18 2003 12:00AM
Credit:	Announced in the Syslinux changelog.
Vulnerable:	Syslinux Syslinux 2.0 1 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1
Not Vulnerable:	Syslinux Syslinux 2.0 2

Syslinux Boot Loader SetUID Installation Vulnerability

Syslinux contains unspecified security vulnerabilities when running setuid root. Local users could potentially perform actions on the system that require privilege, potentially affecting local host security.

Exact details of this vulnerability are not currently known. This record will be updated when more details become available.

Syslinux Boot Loader SetUID Installation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Syslinux Boot Loader SetUID Installation Vulnerability

Solution:
It is recommended that all Gentoo Linux users who are running
sys-apps/syslinux upgrade to syslinux-2.02 as follows:

emerge sync
emerge -u syslinux
emerge clean

Upgrade to Syslinux 2.02:


Syslinux Syslinux 2.0 1

• Syslinux Syslinux 2.02
  http://www.kernel.org/pub/linux/utils/boot/syslinux/

Syslinux Boot Loader SetUID Installation Vulnerability

References:

• Home Page (Syslinux)