Solaris Xsun HOME Buffer Overflow Vulnerability

Bugtraq ID:	2561
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 10 2001 12:00AM
Updated:	Apr 10 2001 12:00AM
Credit:	Discovered by Riley Hassell <[email protected]> and published on April 10, 2001.
Vulnerable:	Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6 Sun Solaris 2.5 Sun Solaris 2.4 Sun Solaris 2.3 Avaya CMS Server 9.0
Not Vulnerable:

Solaris Xsun HOME Buffer Overflow Vulnerability

The X11 server that ships with Sun Microsystems' Solaris, Xsun, contains a locally exploitable buffer overflow vulnerability.

The condition is present when the value of the HOME environment variable is of excessive length (more than 1050 bytes long).

An attacker may exploit this vulnerability to execute arbitrary code with effective group 'root' privileges.

Solaris Xsun HOME Buffer Overflow Vulnerability

Riley Hassell <[email protected]> has supplied an exploit.

• /data/vulnerabilities/exploits/xsunexp.c

Solaris Xsun HOME Buffer Overflow Vulnerability

Solution:
Sun has released Sun Alert ID 26359 to address this issue. Please see the referenced alert for further information.

Fixes for Avaya Call Management System (CMS) version 9.0 can be obtained from the vendor. Please contact the vendor and reference QPPCN 1325BS5 to obtain the fixes. An Avaya advisory containing more information is available at the following location:

http://support.avaya.com/japple/css/japple?temp.groupID=128450&temp.selectedFamily=128451&temp.selectedProduct=154235&temp.selectedBucket=126655&temp.feedbackState=askForFeedback&temp.documentID=203074&PAGE=avaya.css.CSSLvl1Detail&executeTransaction=avaya.css.UsageUpdate()


Sun Solaris 2.6

• Sun 105633-55
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=105633

Sun Solaris 7.0

• Sun 108376-25
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=108376

Sun Solaris 8_x86

• Sun 109401-07
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=109401

Sun Solaris 8_sparc

• Sun 108652-30
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=108652

Sun Solaris 2.5

• Sun 103210-31
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=103210

Sun Solaris 7.0_x86

• Sun 108088-06
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=108088

Sun Solaris 2.5.1

• Sun 103566-56
  http://sunsolve.sun.com/search/advsearch.do?collection=PATCH&type=coll ections&max=50&language=en&toDocument=yes&queryKey5=103566

Solaris Xsun HOME Buffer Overflow Vulnerability

References:

• Sun Alert ID: 26359 (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)