[NEWS] IBM Tivoli Firewall Security Toolbox (TFST) Remote Buffer Overflow Vulnerability

From: support@securiteam.com
Date: 03/23/03

  • Next message: support@securiteam.com: "[UNIX] Multiple vulnerabilities in Ximian's Evolution Mail User Agent" 
    From: support@securiteam.com
To: list@securiteam.com
Date: 23 Mar 2003 17:50:42 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    In the US?

    Contact Beyond Security at our new California office
    housewarming rates on automated network vulnerability
    scanning. We also welcome ISPs and other resellers!

    Please contact us at: 323-882-8286 or ussales@beyondsecurity.com
    - - - - - - - - -

      IBM Tivoli Firewall Security Toolbox (TFST) Remote Buffer Overflow
    Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    The Tivoli Firewall Toolbox is an optional component of the Tivoli
    management environment and provides the underlying communication for the
    framework-based applications within a firewall environment.

    A vulnerability was discovered in the Tivoli relay daemon, which is part
    of this communication layer.

    DETAILS

    Vulnerable systems:
     * Tivoli Firewall Toolbox version 1.2

    Impact:
    The vulnerability may allow a Tivoli endpoint to execute arbitrary code on
    an affected system.

    Technical description:
    The TFST relay daemon, which listens on a TCP network socket, performs no
    bounds checking while storing data from Tivoli nodes into a memory buffer.
    Due to this, it is possible for Tivoli nodes to cause a buffer overflow in
    the relay daemon.

    The buffer overflow can be used to overwrite critical program control data
    on the stack and may therefore be used to inject malicious code in the
    relay daemon process. This code can then be executed with the privileges
    of this process.

    On UNIX platforms, abuse of this vulnerability can initially allow remote
    attackers to penetrate affected systems with user 'nobody' privileges. Due
    to insecure permissions on the relay.sh script, which is executed at boot
    time, it is possible to elevate the user 'nobody' privileges to those of
    the 'root' user on these systems.

    It should be noted that the relay daemon, under normal circumstances, is
    configured to only accept connections from trusted Tivoli nodes.

    Solution:
    Affected Tivoli customers should upgrade to the IBM Tivoli Firewall
    Toolbox version 1.3, which can be found at:
     
    <http://www-3.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html> http://www-3.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html
    (Entitled Customers only)

     <ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_1.3>
    ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_1.3
    (anonymous access)

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:niels.heinen@ubizen.com>
    Niels Heinen.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: support@securiteam.com: "[UNIX] Multiple vulnerabilities in Ximian's Evolution Mail User Agent"