UML_Utilities UML_Net Slip Network Interface Denial Of Service Vulnerability

Bugtraq ID:	12016
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 15 2004 12:00AM
Updated:	Dec 15 2004 12:00AM
Credit:	Discovery of this issue is credited to Danny Lungstrom.
Vulnerable:	User-Mode Linux uml_utilities 20030903
Not Vulnerable:

UML_Utilities UML_Net Slip Network Interface Denial Of Service Vulnerability

The uml_utilites uml_net application may permit unprivileged malicious local users to shut down the slip network interface. This is due to the program being installed setuid root by default.

This vulnerability could be exploited to deny network services over slip on an affected computer.

UML_Utilities UML_Net Slip Network Interface Denial Of Service Vulnerability

The following command may be used to shut down the slip network interface:

uml_net 4 slip down eth0

UML_Utilities UML_Net Slip Network Interface Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

UML_Utilities UML_Net Slip Network Interface Denial Of Service Vulnerability

References:

• [local] [kill] uml-utilities 20030903 uml_net slip_down() fails to check permiss ("D. J. Bernstein" )
  
• User-Mode Linux Homepage (User-Mode Linux)