Solaris sdtcm_convert Vulnerability

Bugtraq ID:	166
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Unknown
Published:	Oct 23 1998 12:00AM
Updated:	Oct 23 1998 12:00AM
Credit:	This messages was posted to Bugtraq by Joel Eriksson ([email protected]) Fri, 23 Oct 1998 19:16:26 +0200.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4
Not Vulnerable:

Solaris sdtcm_convert Vulnerability

Sdtcm_convert is a setuid-root data conversion utility which converts OpenWindows version 3 calendar data files to version 4 and vice versa. A buffer overflow condition has been found in sdtcm_convert which may be exploited to obtain root access.

This is Sun Bug# 4184188.

Solaris sdtcm_convert Vulnerability

CORE has developed a working commercial exploit for their IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following exploit example was provided:
cd /tmp
cp /usr/dt/bin/sdtcm_convert test
truss -o blaha ./test -d /tmp `perl -e 'print "A"x10265'`
tail -5 blaha

• /data/vulnerabilities/exploits/ex_sdtcm_convert.c

Solaris sdtcm_convert Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.6

• Sun 105566-06
  sparc
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-105566-06-1

Sun Solaris 7.0

• Sun 107022-01
  sparc
  

Sun Solaris 2.6_x86

• Sun 105567-07
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-105567-07-1

Sun Solaris 2.5

• Sun 103671-06
  sparc
  

Sun Solaris 7.0_x86

• Sun 107023-01
  x86
  

Sun Solaris 2.5_x86

• Sun 103718-06
  x86
  

Sun Solaris 2.5.1 _x86

• Sun 103717-06
  x86
  

Sun Solaris 2.5.1

• Sun 103670-06
  sparc
  

Solaris sdtcm_convert Vulnerability

References:

• sdtcm_convert exploit (CORE Security)