[UNIX] HP-UX Software Distributor Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 11/16/03

  • Next message: SecuriTeam: "[EXPL] ListBox and ComboBox Control Buffer Overflow (Exploit)" 
    To: list@securiteam.com
Date: 16 Nov 2003 18:19:54 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      HP-UX Software Distributor Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    NSFOCUS Security Team has found a buffer overflow in Software Distributor
    utilities for HP-UX. By exploiting the vulnerability local attackers could
    gain root privilege.

    DETAILS

    Vulnerable systems:
     * HP-UX B.11.00
     * HP-UX B.11.11

    The Software Distributor(SD) utilities for HP-UX contain a number of
    programs such as swinstall. These programs are used to create, install,
    distribute and manage software products. A buffer overflow exists in the
    programs that are suid root bit (such as swinstall, swmodify, etc), this
    allows local attackers to run arbitrary code with root privileges.

    If the environment variable LANG is set as an over large string, programs
    such as swinstall will copy it into a fixed-size buffer without any bounds
    checking, which causes a stack overflow. By overwriting the returned
    address and other data in the stack, local attackers can gain root
    privileges.

    Workaround:
    NSFOCUS suggests temporarily removing the suid root bit for all the
    programs in SD utilities: # chmod a-s /usr/sbin/sw*.

    Vendor Status:
    2002.11.19 Informed the vendor
    2002.12.05 Vendor confirmed the vulnerability
    2003.11.05 Vendor released a security bulletin (HPSBUX0311-293) and
    relative patches for the vulnerability.

    Detailed information for the HP security bulletin is available at:
    <http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0311-293>
    http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0311-293

    Note: Valid ITRC account is required for the link above.

    Patch ID:
    HP-UX B.11.00 PHCO_28847
    HP-UX B.11.11 PHCO_28848

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:security@nsfocus.com>
    NSFOCUS Security Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] ListBox and ComboBox Control Buffer Overflow (Exploit)"

    Relevant Pages