Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
BID:2550
Info
Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
| Bugtraq ID: | 2550 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-0249 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 09 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | This vulnerability was discovered by Anthony Osborne and John McDonald of NAI's COVERT labs and published on April 9, 2001. |
| Vulnerable: |
Sun Solaris 2.5.1 Sun Solaris 8_sparc Sun Solaris 7.0 Sun Solaris 2.6 Sun Solaris 2.5 Sun Solaris 2.4 Sun Solaris 2.3 |
| Not Vulnerable: | |
Discussion
Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
The Solaris ftp daemon contains a heap-based buffer overflow condition. The overflow occurs when the LIST command is issued with an argument that expands into an oversized string after being processed by glob().
This buffer overflow occurs in memory that is dynamically allocated. It may be possible for attackers to exploit this vulnerability and execute arbitrary code on the affected host.
To exploit this, the attacker must be able to create directories on the target host.
The Solaris ftp daemon contains a heap-based buffer overflow condition. The overflow occurs when the LIST command is issued with an argument that expands into an oversized string after being processed by glob().
This buffer overflow occurs in memory that is dynamically allocated. It may be possible for attackers to exploit this vulnerability and execute arbitrary code on the affected host.
To exploit this, the attacker must be able to create directories on the target host.
Exploit / POC
Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
Solution:
Fixes available:
Sun Solaris 2.6
Sun Solaris 7.0
Sun Solaris 8_sparc
Sun Solaris 2.5
Sun Solaris 2.5.1
Solution:
Fixes available:
Sun Solaris 2.6
-
Sun 106301-03
http://sunsolve.sun.com
Sun Solaris 7.0
-
Sun 110646-02
http://sunsolve.sun.com
Sun Solaris 8_sparc
-
Sun 111606-01
http://sunsolve.sun.com
Sun Solaris 2.5
-
Sun 103577-12
http://sunsolve.sun.com
Sun Solaris 2.5.1
-
Sun 103603-16
http://sunsolve.sun.com
References
Solaris ftpd glob() Expansion LIST Heap Overflow Vulnerability
References:
References:
- Sun-00205 (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)