 | ||||||
| << Previous | INDEX | Search | src | Set bookmark | Go to bookmark | Next >> |
| ||||||
| |||||||||||||||||||||
Date: Tue, 27 Mar 2001 13:33:08 +0100 From: "Secure Network Operations , Inc." <recon@SNOSOFT.COM> To: BUGTRAQ@SECURITYFOCUS.COM Subject: SCO 5.0.6 issues (lpadmin) =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Strategic Reconnisiance Team Security Advisory(SRT2001-07) Topic: SCO 5.0.6 issues (lpadmin) Vendor: SCO Release Date: 03/27/01 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D .: Description SCO OpenServer 5.0.6 ships with suid bin=20 /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin. lpadmin has poor handling of command line arguments resulting in a buffer=20 overflow. lpadmin will core dump if fed more than 6476 chars. .: Impact /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin `perl -e 'print "A" x 7000'` Memory fault - core dumped This problem makes it possible to overwrite memory space of the running=20 process, and potentially execute code with the inherited privileges of bin. .: Workaround .: Systems Affected SCO OpenServer 5.0.6 upgrade from 5.0.x and 5.0.6 fresh install. chmod -s /opt/K/SCO/Unix/5.0.6Ga/usr/lib/lpadmin .: Proof of Concept To be released at a later time. .: Vendor Status Vendor was notified on 03/22/01. Vendor lab tests confirmed the issue. Patch status is unknown. .: Credit Kevin Finisterre dotslash@snosoft.com, krfinisterre@checkfree.com =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D =A9Copyright 2001 Secure Network Operations , Inc. All Rights Reserved. Strategic Reconnisiance Team | recon@snosoft.com http://recon.snosoft.com | http://www.snosoft.com ----------------------------------------------------------------------
| |||||||||||||||||||||
|
|
|
