-----BEGIN PGP SIGNED MESSAGE-----

Subject: Caldera Security Advisory SA-1997.06: Vulnerability in elm package

Caldera Security Advisory SA-1997.06
Original issue date:    6-July-1997
Last revised:           6-July-1997

Topic: Vulnerability in elm

I. Problem Description

	A vulnerability exists within the elm mail reader that will allow
	allow un-privileged users on systems to read, delete, and modify other
	users' email.

	This is also known as the "termname-overflow" bug.

II. Impact

	On systems such as Caldera OpenLinux 1.0 and 1.1, an unprivileged
	user can modify other's email.

III. Solution

	Obtain the new elm-2.4.25-5.i386.rpm, and elm-doc-2.4.25-5.i386.rpm
	files and install according to the instructions found in the README
	file which is one directory up from the actual rpm files.

	These packages are located on Caldera's FTP server (ftp.caldera.com):

	/pub/openlinux/updates/1.0/current/RPMS
	/pub/openlinux/updates/1.1/current/RPMS (Both are the same)

	The MD5 checksum (from the "md5sum" command) for these packages are:
	44f6f7aa0426e205447c860b4fa0ff46  elm-2.4.25-5.i386.rpm
	f35d83b4340faccdcee47da751417e86  elm-doc-2.4.25-5.i386.rpm
        
	Please follow the instructions from the README file precisely to
	update any older version of elm that may be on your system:


IV. References / Credits

	This and other Caldera security resources are located at:

		http://www.caldera.com/tech-ref/security/

	This advisory is based on a message to linux-security:
Subject: [linux-security] Security hole in Elm...
Message-ID: <Pine.LNX.3.95L01at.970514162056.12656A-100000@venus.wis.pk.edu.pl>

	Credits to:
		Marcin Bohosiewicz <marcus@venus.wis.pk.edu.pl>
		ftp://venus.wis.pk.edu.pl/pub/RPMS/elm-2.4.25-8.i386.rpm
		ftp://venus.wis.pk.edu.pl/pub/SRPMS/elm-2.4.25-8.src.rpm
		LST / Raymund Will <ray@lst.de>

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBM8A1DOn+9R4958LpAQEUrgP/cinP6XjKlCnajAEs/D60GUpwV+0ZMbut
SluunhivDw4v7ir3mXlgaHwxYY3avs4bcAvjWscZGk/1/TcN99xdeIOfOnxNvdqf
nmPCv+RE5Q02Fiy4HTTv/AM39iGL/p3OcGwd92YD9RsaWYGH+cb5USBRaR/rLVnF
J7eb4UnccJ0=
=SbiR
-----END PGP SIGNATURE-----