Solaris IPCS Timezone Buffer Overflow Vulnerability
BID:2581
Info
Solaris IPCS Timezone Buffer Overflow Vulnerability
| Bugtraq ID: | 2581 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-0423 |
| Remote: | No |
| Local: | Yes |
| Published: | Apr 12 2001 12:00AM |
| Updated: | Jul 11 2009 06:06AM |
| Credit: | This vulnerability was discovered by Riley Hassell <[email protected]>, and announced to Bugtraq in an Eeye Security Advisory on April 12, 2001. |
| Vulnerable: |
Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 |
| Not Vulnerable: | |
Discussion
Solaris IPCS Timezone Buffer Overflow Vulnerability
Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.
A problem in the handling of environment variables by the SGID sys program ipcs could lead to local users gaining elevated privileges. Improper bounds checking of the buffer holding the TIMEZONE environment variable by the program could lead to a buffer overflow, and the overwriting of stack variables including the return address.
Therefore, it is possible for a local user to execute arbitrary code with the EUID of sys, and potentially gain further elevated privileges.
Solaris is the variant of the UNIX Operating System distributed by Sun Microsystems. Solaris is designed as a scalable operating system for the Intel x86 and Sun Sparc platforms, and operates on machines varying from desktop to enterprise server.
A problem in the handling of environment variables by the SGID sys program ipcs could lead to local users gaining elevated privileges. Improper bounds checking of the buffer holding the TIMEZONE environment variable by the program could lead to a buffer overflow, and the overwriting of stack variables including the return address.
Therefore, it is possible for a local user to execute arbitrary code with the EUID of sys, and potentially gain further elevated privileges.
Exploit / POC
Solaris IPCS Timezone Buffer Overflow Vulnerability
Solaris 7 Sparc:
$ TZ=`perl -e 'print "A"x1107'`
$ /usr/bin/ipcs
Solaris 8 Sparc:
$ TZ=`perl -e 'print "A"x1199'`
$ /usr/bin/ipcs
Solaris x86:
$ TZ=`perl -e 'print "A"x1035'`
$ /usr/bin/i86/ipcs
Solaris 7 Sparc:
$ TZ=`perl -e 'print "A"x1107'`
$ /usr/bin/ipcs
Solaris 8 Sparc:
$ TZ=`perl -e 'print "A"x1199'`
$ /usr/bin/ipcs
Solaris x86:
$ TZ=`perl -e 'print "A"x1035'`
$ /usr/bin/i86/ipcs
Solution / Fix
Solaris IPCS Timezone Buffer Overflow Vulnerability
Solution:
Sun has released patches to address this issue.
Sun Solaris 7.0_x86
Sun Solaris 7.0
Sun Solaris 8_x86
Sun Solaris 8_sparc
Solution:
Sun has released patches to address this issue.
Sun Solaris 7.0_x86
Sun Solaris 7.0
Sun Solaris 8_x86
Sun Solaris 8_sparc
References
Solaris IPCS Timezone Buffer Overflow Vulnerability
References:
References: