[UNIX] Sun Microsystems Solaris ld.so Directory Traversal Vulnerability



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Sun Microsystems Solaris ld.so Directory Traversal Vulnerability
------------------------------------------------------------------------


SUMMARY

Solaris is a UNIX operating system developed by Sun Microsystems. Local
exploitation of a directory traversal vulnerability in ld.so could
potentially allow a non root user to execute arbitrary code as root.

DETAILS

Vulnerable Systems:
* Solaris 10 for both x86 and SPARC

ld.so uses the environmental variables LANG, LC_ALL, and LC_MESSAGES to
determine what locale is currently set. When ld.so encounters an error,
such as when a non root user specifies an unsafe library in the LD_PRELOAD
environmental variable, it uses one of the above variables to open up a
message file that contains error strings. It will make a call like this to
open the file:

open("/usr/lib/locale/$LANG/LC_MESSAGES/SUNW_OST_SGS.mo",..)

$LANG is a user controlled environmental variable that is not sanitized.
This message file is meant to contain format strings used to build error
messages, and should therefore only be writable by root. By setting LANG
to a value such as "../../../../../home/user" an attacker can control the
the location of this message file, and pass arbitrary format strings to a
printf() like function in ld.so.

Analysis:
Successful local exploitation allows attackers to execute arbitrary code
as root on the affected host.

ld.so does not use the C library printf() function; it has it's own
minimal implementation. This implementation does not provide the %n format
specifier. Therefore an attacker is limited to leaking information through
such specifiers as %x. However, while researching this vulnerability it
was found that the formatting function itself also contains a buffer
overflow vulnerability that can be triggered with a user controlled format
string. This vulnerability is discussed in a separate iDefense advisory.
By combining these two vulnerabilities it is possible that an attacker
could execute arbitrary code as root.

Vendor Response:
Sun Microsystems has addressed this problem with new patches. More
information can be found in Sun Alert #102724. This alert can be found
at: <http://sunsolve.sun.com/search/document.do?assetkey=1-26-102724-1>
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102724-1

Disclosure Timeline:
10/24/2006 - Initial vendor notification
10/27/2006 - Initial vendor response
12/12/2006 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by
<mailto:idlabs-advisories@xxxxxxxxxxxx> iDefense Labs Security Advisories.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=449



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)
  • [UNIX] Sun Microsystems Solaris srsexec Format String Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris srsexec Format String Vulnerability ... all of the client machines being monitored and is set-uid root by default. ... attackers to execute arbitrary code with root privileges. ...
    (Securiteam)
  • [UNIX] SCO Multiple Local Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
    (Securiteam)
  • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
    (Securiteam)
  • [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have been recently discovered in Tikiwiki, ... Remote exploitation of an input validation vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on the vulnerable ...
    (Securiteam)