lv Configuration File Privilege Escalation Vulnerability

Bugtraq ID:	7613
Class:	Design Error
CVE:	CVE-2003-0188
Remote:	No
Local:	Yes
Published:	May 16 2003 12:00AM
Updated:	Jul 11 2009 10:06PM
Credit:	Discovery is credited to Leonard Stiles.
Vulnerable:	Redhat lv-4.49.4-9.i386.rpm + Redhat Linux 9.0 i386 Redhat lv-4.49.4-7.i386.rpm + Redhat Linux 8.0 Redhat lv-4.49.4-3.i386.rpm + Redhat Linux 7.3 + Redhat Linux 7.2 Redhat lv-4.49.4-1.i386.rpm + Redhat Linux 7.1 lv lv 4.49.4 + Debian Linux 3.0 sparc + Debian Linux 3.0 s/390 + Debian Linux 3.0 ppc + Debian Linux 3.0 mipsel + Debian Linux 3.0 mips + Debian Linux 3.0 m68k + Debian Linux 3.0 ia-64 + Debian Linux 3.0 ia-32 + Debian Linux 3.0 hppa + Debian Linux 3.0 arm + Debian Linux 3.0 alpha + Debian Linux 3.0 + Terra Soft Solutions Yellow Dog Linux 3.0 lv lv 4.49.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k + Debian Linux 2.2 lv lv 4.49.2 lv lv 4.49.1
Not Vulnerable:	lv lv 4.49.5

lv Configuration File Privilege Escalation Vulnerability

There is no exploit code required.

lv Configuration File Privilege Escalation Vulnerability

Solution:
Debian has released fixed packages for this issue. Download links can be found in the attached advisory (DSA 304-1).

The vendor has fixed this issue in lv 4.49.5. Users are advised to upgrade.


Redhat lv-4.49.4-9.i386.rpm

• Red Hat lv-4.49.4-9.9.1.i386.rpm
  ftp://updates.redhat.com/9/en/os/i386/lv-4.49.4-9.9.1.i386.rpm

Redhat lv-4.49.4-1.i386.rpm

• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm

Redhat lv-4.49.4-3.i386.rpm

• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm


• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm

Redhat lv-4.49.4-7.i386.rpm

• Red Hat lv-4.49.4-7.80.1.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/lv-4.49.4-7.80.1.i386.rpm

lv lv 4.49.1

• lv lv 4.49.5
  http://www.ff.iij4u.or.jp/~nrt/freeware/lv4495.tar.gz

lv lv 4.49.2

• lv lv 4.49.5
  http://www.ff.iij4u.or.jp/~nrt/freeware/lv4495.tar.gz

lv lv 4.49.3

• Debian lv_4.49.3-4potato2_alpha.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_a lpha.deb


• Debian lv_4.49.3-4potato2_arm.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_a rm.deb


• Debian lv_4.49.3-4potato2_i386.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_i 386.deb


• Debian lv_4.49.3-4potato2_m68k.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_m 68k.deb


• Debian lv_4.49.3-4potato2_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_p owerpc.deb


• Debian lv_4.49.3-4potato2_sparc.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.3-4potato2_s parc.deb


• lv lv 4.49.5
  http://www.ff.iij4u.or.jp/~nrt/freeware/lv4495.tar.gz

lv lv 4.49.4

• Debian lv_4.49.4-7woody2_alpha.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_al pha.deb


• Debian lv_4.49.4-7woody2_arm.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_ar m.deb


• Debian lv_4.49.4-7woody2_hppa.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_hp pa.deb


• Debian lv_4.49.4-7woody2_i386.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_i3 86.deb


• Debian lv_4.49.4-7woody2_ia64.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_ia 64.deb


• Debian lv_4.49.4-7woody2_m68k.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_m6 8k.deb


• Debian lv_4.49.4-7woody2_mips.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_mi ps.deb


• Debian lv_4.49.4-7woody2_mipsel.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_mi psel.deb


• Debian lv_4.49.4-7woody2_powerpc.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_po werpc.deb


• Debian lv_4.49.4-7woody2_s390.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_s3 90.deb


• Debian lv_4.49.4-7woody2_sparc.deb
  http://security.debian.org/pool/updates/main/l/lv/lv_4.49.4-7woody2_sp arc.deb


• lv lv 4.49.5
  http://www.ff.iij4u.or.jp/~nrt/freeware/lv4495.tar.gz


• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.1/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm


• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.2/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm


• Red Hat lv-4.49.4-3.7x.1.i386.rpm
  ftp://updates.redhat.com/7.3/en/os/i386/lv-4.49.4-3.7x.1.i386.rpm


• Red Hat lv-4.49.4-7.80.1.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/lv-4.49.4-7.80.1.i386.rpm


• Red Hat lv-4.49.4-9.9.1.i386.rpm
  ftp://updates.redhat.com/9/en/os/i386/lv-4.49.4-9.9.1.i386.rpm


• Terra Soft Solutions lv-4.49.4-9.9.1.ppc.rpm
  ftp://ftp.yellowdoglinux.com/pub/yellowdog/updates/yellowdog-3.0/ppc/l v-4.49.4-9.9.1.ppc.rpm