SUS Format String Vulnerability
BID:11176
Info
SUS Format String Vulnerability
| Bugtraq ID: | 11176 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 14 2004 12:00AM |
| Updated: | Sep 14 2004 12:00AM |
| Credit: | Leon Juranic <[email protected]> is credited for the discovery of this vulnerability. |
| Vulnerable: |
Peter D. Gray SUS 2.0.1 Peter D. Gray SUS 2.0 |
| Not Vulnerable: |
Peter D. Gray SUS 2.0.6 |
Discussion
SUS Format String Vulnerability
It is reported that SUS contains a format string vulnerability in its logging function. This issue is due to a failure of the applications to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.
Due to improper message sanitization, any format string specifiers are interpreted literally by the syslog() function, giving the attacker control over process memory.
Due to the nature of the SUS package, an attacker with local interactive access could exploit this vulnerability to gain superuser privileges.
SUS versions prior to 2.0.6 are reported vulnerable.
It is reported that SUS contains a format string vulnerability in its logging function. This issue is due to a failure of the applications to properly sanitize user-supplied input before using it as the format specifier in a formatted printing function.
Due to improper message sanitization, any format string specifiers are interpreted literally by the syslog() function, giving the attacker control over process memory.
Due to the nature of the SUS package, an attacker with local interactive access could exploit this vulnerability to gain superuser privileges.
SUS versions prior to 2.0.6 are reported vulnerable.
Exploit / POC
SUS Format String Vulnerability
A proof of concept example exploit has been described at:
http://security.lss.hr/PoC/index.php?p=adv&ID=LSS-2004-09-01.html
A proof of concept example exploit has been described at:
http://security.lss.hr/PoC/index.php?p=adv&ID=LSS-2004-09-01.html
Solution / Fix
SUS Format String Vulnerability
Solution:
The vendor has released version 2.0.6 to address this issue.
Gentoo has released an advisory (GLSA 200409-17) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their systems:
emerge sync
emerge -pv ">=app-admin/sus-2.0.2-r1"
emerge ">=app-admin/sus-2.0.2-r1"
Peter D. Gray SUS 2.0
Peter D. Gray SUS 2.0.1
Solution:
The vendor has released version 2.0.6 to address this issue.
Gentoo has released an advisory (GLSA 200409-17) to address this issue. Please see the referenced advisory for more information. Gentoo users may carry out the following commands to update their systems:
emerge sync
emerge -pv ">=app-admin/sus-2.0.2-r1"
emerge ">=app-admin/sus-2.0.2-r1"
Peter D. Gray SUS 2.0
-
Peter D. Gray sus-2.0.6.tar.Z
http://pdg.uow.edu.au/sus/sus-2.0.6.tar.Z
Peter D. Gray SUS 2.0.1
-
Peter D. Gray sus-2.0.6.tar.Z
http://pdg.uow.edu.au/sus/sus-2.0.6.tar.Z
References
SUS Format String Vulnerability
References:
References:
- SUS Changelog (Peter D. Gray)
- SUS Home Page (Peter D. Gray)
- SUS 2.0.2 local root vulnerability (LSS Security