Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
BID:101
Info
Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
| Bugtraq ID: | 101 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Unknown |
| Local: | Unknown |
| Published: | Apr 21 1998 12:00AM |
| Updated: | Apr 21 1998 12:00AM |
| Credit: | This vulnerability was found by Matt Conover <[email protected]> and reported in the RSI.0002.05-18-98.BNU.UUCPD security advisory. |
| Vulnerable: |
Sun SunOS 4.1.4 Sun SunOS 4.1.3 c Sun SunOS 4.1.3 _U1 Sun SunOS 4.1.3 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 Sun Solaris 2.2 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.2 NetBSD NetBSD 1.3.1 NetBSD NetBSD 1.3 Digital OSF/1 2.1 B Digital OSF/1 2.1 Digital OSF/1 2.0 B Digital OSF/1 2.0 Digital OSF/1 1.3 A Digital OSF/1 1.3 Digital OSF/1 1.2 |
| Not Vulnerable: |
Slackware Linux 3.4 Slackware Linux 3.3 Slackware Linux 3.2 Slackware Linux 3.1 Redhat Linux 5.0 Redhat Linux 4.2 Redhat Linux 4.1 Redhat Linux 4.0 FreeBSD FreeBSD 2.2.8 FreeBSD FreeBSD 2.2.2 FreeBSD FreeBSD 2.1.7 .1 FreeBSD FreeBSD 2.1.6 FreeBSD FreeBSD 2.1.5 FreeBSD FreeBSD 2.1 FreeBSD FreeBSD 2.0.5 FreeBSD FreeBSD 2.0 BSDI BSD/OS 4.0 BSDI BSD/OS 3.0 BSDI BSD/OS 2.1 BSDI BSD/OS 2.0.1 BSDI BSD/OS 2.0 |
Discussion
Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
Upon successfully logging into a system with uucpd,
the daemon will attempt to record wtmp information.
However, due to insufficient bounds checking, a buffer
overflow can result when uucpd attempts to copy the
connecting hostname into a buffer with a predefined size.
While overwriting the buffer, the attacker can manipulate
the stack and execute their own commands, possibly gaining
root access into the system.
The attacker must have an account on the system, which
will allow this to be exploited.
This problem is present in BNU uucpd. This is not
installed by default on every operating system.
This also may not always run as root.
Upon successfully logging into a system with uucpd,
the daemon will attempt to record wtmp information.
However, due to insufficient bounds checking, a buffer
overflow can result when uucpd attempts to copy the
connecting hostname into a buffer with a predefined size.
While overwriting the buffer, the attacker can manipulate
the stack and execute their own commands, possibly gaining
root access into the system.
The attacker must have an account on the system, which
will allow this to be exploited.
This problem is present in BNU uucpd. This is not
installed by default on every operating system.
This also may not always run as root.
Exploit / POC
Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
Solution:
--- uucpd.old.c Thu Feb 6 06:34:45 1997
+++ uucpd.c Tue Apr 7 16:37:46 1998
@@ -300,7 +300,8 @@
time(&ll.ll_time);
lseek(f, pw->pw_uid * sizeof(struct lastlog), 0);
- strcpy(line, remotehost);
+ strncpy(line, remotehost, sizeof(line)-1);
SCPYN(ll.ll_line, line);
SCPYN(ll.ll_host, remotehost);
(void) write(f, (char *) &ll, sizeof ll);
For NetBSD's patch please refer to: http://www.repsec.com/advisory/0002.patch.html
Solution:
--- uucpd.old.c Thu Feb 6 06:34:45 1997
+++ uucpd.c Tue Apr 7 16:37:46 1998
@@ -300,7 +300,8 @@
time(&ll.ll_time);
lseek(f, pw->pw_uid * sizeof(struct lastlog), 0);
- strcpy(line, remotehost);
+ strncpy(line, remotehost, sizeof(line)-1);
SCPYN(ll.ll_line, line);
SCPYN(ll.ll_host, remotehost);
(void) write(f, (char *) &ll, sizeof ll);
For NetBSD's patch please refer to: http://www.repsec.com/advisory/0002.patch.html
References
Multiple Vendor BNU uucpd Buffer Overflow Vulnerability
References:
References: