Multiple Linux Vendor man Buffer Overrun Vulnerability
BID:1011
Info
Multiple Linux Vendor man Buffer Overrun Vulnerability
| Bugtraq ID: | 1011 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 26 2000 12:00AM |
| Updated: | Feb 26 2000 12:00AM |
| Credit: | This vulnerability was posted to the Bugtraq mailing list by Michal Zalewski <[email protected]> on February 26, 2000. |
| Vulnerable: |
Turbolinux Turbolinux 4.4 Turbolinux Turbolinux 4.2 Turbolinux Turbolinux 3.5 b2 Turbolinux man 1.5 g-5 Redhat man 1.5 g-6.sparc Redhat man 1.5 g-6.i386 Redhat man 1.5 g-6.alpha Redhat Linux 6.2 i386 Redhat Linux 6.0 Redhat Linux 5.2 i386 Redhat Linux 5.1 Redhat Linux 5.0 Redhat Linux 4.2 Redhat Linux 4.1 Redhat Linux 4.0 |
| Not Vulnerable: |
Turbolinux man 1.5 h1-1 |
Discussion
Multiple Linux Vendor man Buffer Overrun Vulnerability
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
A buffer overflow exists in the implementation of the 'man' program shipped with RedHat Linux, and other LInux vendors. By carefully crafting a long buffer of machine executable code, and placing it in the MANPAGER environmental variable, it becomes possible for a would be attacker to gain egid man.
Using attacks previously outlined by Pawel Wilk, and available in the reference portion of the credit section, it is possible for an attacker to alter manpages such that code will be executed. Upon looking up an altered manpage, code will be executed with the privileges of the person running man. If this person is the root user, root privileges can be obtained.
Solution / Fix
Multiple Linux Vendor man Buffer Overrun Vulnerability
Solution:
Removal of the setgid bit from this application will eliminate the problem. Preformatted man pages will no longer be created, however.
Turbolinux man 1.5 g-5
Solution:
Removal of the setgid bit from this application will eliminate the problem. Preformatted man pages will no longer be created, however.
Turbolinux man 1.5 g-5
-
TurboLinux man-1.5h1-1.i386.rpm
ftp://ftp.turbolinux.com/pub/updates/6.0/security/man-1.5h1-1.i386.rpm