Multiple Vendor ps(1) Buffer Overflow Vulnerability

Bugtraq ID:	220
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 28 1997 12:00AM
Updated:	Apr 28 1997 12:00AM
Credit:	This bug was originally posted to the Bugtraq mailing list by Joe Zbiciak <[email protected]> on Mon, 28 Apr 1997.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5
Not Vulnerable:	Sun Solaris 2.6_x86 Sun Solaris 2.6 SGI IRIX 6.5.18 SGI IRIX 6.5.17 SGI IRIX 6.5.16 SGI IRIX 6.5.15 SGI IRIX 6.5.14 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 FreeBSD FreeBSD 3.3

Multiple Vendor ps(1) Buffer Overflow Vulnerability

The ps command prints information about active processes on a system. Due to insufficient bounds checking on arguments supplied to ps, it is possible to overwrite the internal data space of the ps program. As ps is setuid root, this vulnerability may be exploited by users on a system to gain root access.

Multiple Vendor ps(1) Buffer Overflow Vulnerability

The following exploit was provided:

• /data/vulnerabilities/exploits/solps.sh

Multiple Vendor ps(1) Buffer Overflow Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com

SGI customers are advised to upgrade to IRIX version 6.5.5 or later:


Sun Solaris 2.4_x86

• Sun 102278-03
  x86
  


• Sun 102712-02
  sparc
  

Sun Solaris 2.5

• Sun 105052-01
  sparc
  

Sun Solaris 2.3

• Sun 101545-03
  sparc
  


• Sun 101736-04
  sparc
  

Sun Solaris 2.5_x86

• Sun 105053-01
  sparc
  

Sun Solaris 2.4

• Sun 102277-03
  sparc
  


• Sun 102711-02
  sparc
  

Sun Solaris 2.5.1 _x86

• Sun 105051-01
  x86
  http://sunsolve.sun.com/search/document.do?assetkey=1-21-105051-01-1

Sun Solaris 2.5.1

• Sun 105050-01
  sparc
  

Multiple Vendor ps(1) Buffer Overflow Vulnerability

References:

• Australian CERT (AUSCERT)
  
• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)