| NSFOCUS Security Advisory(SA2003-07)
Topic: HP-UX Software Distributor Buffer Overflow Vulnerability
Release Date: 2003-11-13
CVE CAN ID : CAN-2003-0089
Affected system:
==============
- HP-UX B.11.00
- HP-UX B.11.11
Impact:
======
NSFOCUS Security Team has found a buffer overflow in Software Distributor utilities for HP-UX. By exploiting the vulnerability local attackers could gain root privilege.
Description:
==========
The Software Distributor(SD) utilities for HP-UX contain a number of programs such as swinstall. These programs are used to create, install, distribute and manage software products. A buffer overflow exists in the programs with suid root bit (such as swinstalll/swmodify etc) and allows local attackers to run arbitrary code with root privilege.
If the environment variable LANG is set as a over large string, programs such as swinstall will copy it into a fixed-size buffer without any bound check, which causes a stack overflow. By overwriting the returned address and other data in the stack, local attackers could gain root privilege.
Workaround:
===========
NSFOCUS suggests to temporarily remove the suid root bit for all the programs in SD utilities :
# chmod a-s /usr/sbin/sw*
Vendor Status:
============
2002.11.19 Informed the vendor
2002.12.05 Vendor confirmed the vulnerability
2003.11.05 Vendor released a security bulletin (HPSBUX0311-293) and relative patches for the vulnerability.
Detailed information for the HP security bulletin is available at:
http://www1.itrc.hp.com/service/cki/docDisplay.do?docId=HPSBUX0311-293
Note: Valid ITRC account is required for the link above.
Patch ID:
HP-UX B.11.00 PHCO_28847
HP-UX B.11.11 PHCO_28848
Additional Information:
==================
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2003-0089 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems. Candidates may change significantly before they become official CVE entries.
Credit:
=====
Yang Jilong of NSFOCUS Security Team found the vulnerability. |
