Corel® Linux® Community
About Corel Products Corel® LINUX® OS - Buy or Download Now!
Corel® WordPerfect® 8 for Linux®
Linux
Designer
Office Community
Corel.com
CorelCity.com™
About Linux®
Starters

Articles

Advanced

Resources

Interact

About Corel

Technical Support

Corel & Linux

Linux Products

Linux Careers @ Corel

Corel®
WordPerfect® 8 for Linux®


Free Download

What’s Inside the Box

Highlights & Features

System Requirements

Pricing & Purchasing

Support

Register Now

In the Press

Open Source Development

Contact Us

Corel® WordPerfect® 8 for Linux® Support Issue

Corel Corporation has been made aware of a minor security issue that, if left unmodified, could permit unwarranted access to files on the computers of users of its Corel® WordPerfect® 8 for Linux ® software.

This issue, while minor, can be used to exploit a system in certain circumstances. The matter does not affect any users of Corel WordPerfect 8 for Linux installed on non-networked or standalone computers.

A small change in the installation process by network administrators will nullify the unwarranted access issue, and that change is documented below.

A fix can be enacted by users who have already installed Corel WordPerfect 8 for Linux , but Corel recommends for optimal protection that those in a networked environment delete the application and reinstall the software using the method described below.

Corel has not been made aware of incidents where the security issue has resulted in any unauthorized access of files at this time.

This issue only affects users of the no-charge download of Corel WordPerfect 8 for Linux, purchasers of the standalone shrinkwrap version of Corel WordPerfect 8 for Linux and the server edition of Corel WordPerfect 8 for Linux/UNIX®.

This is not an issue affecting users of Corel WordPerfect 8 for Linux on any other platforms except Linux and UNIX.

Corel is working on a permanent solution to this problem. However in the interim, the following work-around has been devised:

DO NOT INSTALL Corel WordPerfect 8 for Linux as “root”.

Explanation of the problem:

When Corel WordPerfect 8 for Linux loads, it creates a directory called /tmp/wpc-<hostname> (where <hostname> is the host name of your computer) that has the UMASK 777.

Some necessary temporary files are stored in this folder, all containing the UMASK 666. When Corel WordPerfect 8 for Linux loads, it checks to see that these files exist, and if so, it will overwrite them.

However, Corel WordPerfect 8 for Linux doesn’t check to see if these files have been replaced with sym-links of the same name. If this has been done (perhaps to compromise system security), Corel WordPerfect 8 for Linux will follow those sym-links and, if it has the rights to do so (which it will if you install the application as “root”), it will overwrite the file pointed to by the sym-link. This problem could be used to exploit a system.

Procedure to eliminate the problem:

If you have not installed Corel WordPerfect 8 for Linux yet, simply follow the instructions under “Installation Procedures”.

If you have already installed Corel WordPerfect 8 for Linux, we strongly recommend that you delete that installation and re-install the application. To delete a current installation of Corel WordPerfect 8 for Linux, execute the following instructions:

rm -r <path to Corel WordPerfect 8 for Linux Installation> (answer yes to the prompts)
rm -rf ~/.wprc
rm /etc/magic

Installation procedures:

If you already have another user account set up on your system, then simply log in under that user account, and run the installation program as you normally would.

NOTE: On most systems, you can only mount the CD-ROM drive as root, so you should do this before you log in as a non-root user.

If you do not have a “non-root” user account set up on your system, the following will set that up (for RedHat Linux only):

  1. Login as root

  2. Type: adduser <username>
       where <username> can be any name you wish, but should be something short and easy to remember

  3. Next type: passwd <username>
       where <username> is the same as what you chose for the previous step

  4. You will be prompted for a password for that user, and then asked to confirm that password

  5. If all went well, you will receive a message similar to the following:
       "passwd: all authentication tokens updated successfully"

To enact a fix to Corel WordPerfect 8 for Linux without re-installing the software (this should only be attempted by advanced Linux users). Corel recommends deleting the software and reinstalling using the previous method.

This procedure will change the installation of Corel WordPerfect 8 for Linux so that it can't be used to exploit the host system. This procedure must be executed as root, and is recommended for advanced users only.

Command list:

cd <path to Corel WordPerfect 8 for Linux Installation>/..
chown <non-root user>:<non-root user> <install directory name> -R
chown <non-root user>:<non-root user> /etc/magic
rm -rf /tmp/wpc*

EXAMPLE:

cd /usr/local/wp8/..
chown johnd:johnd wp8 -R
chown johnd:johnd /etc/magic
rm -rf /tmp/wpc*



Copyright © 1999 – 2000 Corel Corporation. All rights reserved.
Terms of Use/Legal Disclaimer
Year 2000 Information
Last modified on: 3/09/00
Send e-mail to Webmaster
Send this page to a friend

Graphics by Corel