[UNIX] Procps Buffer Overflow (pwdx)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/27/05

  • Next message: SecuriTeam: "[EXPL] MySQL MaxDB Webtool Buffer Overflow Exploit (%)" 
    To: list@securiteam.com
Date: 27 Apr 2005 17:51:03 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Procps Buffer Overflow (pwdx)
    ------------------------------------------------------------------------

    SUMMARY

    " <http://procps.sourceforge.net/> procps is a package that has a few
    small useful utilities that give information about processes using the
    /proc filesystem. The package includes the programs ps, top, vmstat, w,
    kill, free, slabtop, and skill."

    A buffer overflow vulnerability has been discovered in argument handling
    of pwdx utility supplied with Procps.

    DETAILS

    Vulnerable Systems:
     * pwdx included with Procps versions 3.2.5 and prior

    There seems there is no distribution which includes pwdx as setuid,
    however given its nature it may well be called by programs/scripts which
    are setuid or run by a privileged user. As such the vulnerability lays
    primarily in users assuming that this program is safe.

    Buffer Overflow Vulnerability:
    In pwdx.c:
    if (regexec(&re, argv[i], 0, NULL, 0) != 0)
    {
        printf(buf, "pwdx: invalid process id: %s\n", argv[i]); // FIXME
    (overflow)
        die(buf);
    }

    If it is unable to find a process id matching argv[1] it sprintf's it to a
    fixed length character array. Further more the function die(char*) has a
    format string vulnerability due to it being implemented in the following
    way:
    static void die(const char *msg)
    {
        fprintf(stderr, msg);
        exit(1);
    }

    Workaround:
    Do not setuid this program and if running the program as a privileged
    user ensure that any untrusted user is unable to control the arguments
    passed to pwdx.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:imranghory@gmail.com> Imran
    Ghory.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] MySQL MaxDB Webtool Buffer Overflow Exploit (%)"

    Relevant Pages

    • [NEWS] IBM DB2 Buffer Overflow Vulnerabilities (rec2xml, generate_distfile)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... procedure suffers from a stack based buffer overflow vulnerability. ...
      (Securiteam)
    • [NT] Trend Micro SSAPI Long Path Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Trend Micro SSAPI Long Path Buffer Overflow Vulnerability ... Remote exploitation of buffer overflow vulnerability in Trend Micro Inc.'s ...
      (Securiteam)
    • [NEWS] Oracle WebLogic Apache Connector
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache Connector is "module for the Apache httpd server. ... Corp.'s WebLogic Server Apache Connector could allow an attacker to ... A stack based buffer overflow vulnerability exists in the Apache Connector ...
      (Securiteam)
    • [NT] Adobe PageMaker Key Strings Stack Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Adobe PageMaker Key Strings Stack Buffer Overflow Vulnerability ... Exploitation of this vulnerability could allow an attacker to execute ... VENDOR RESPONSE ...
      (Securiteam)
    • [UNIX] Samba 3.x Under Default Kernel 2.6.x Allows Local Root Compromise
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Due to improper handling by Samba of setuid files (stored on a remote ... binary), and the client (the victim, which mounts the share and runs the ... The problem stems from the setuid root smbmnt. ...
      (Securiteam)