BID:2605

Solaris kcms_configure KCMS_PROFILES Buffer Overflow Vulnerability

Info

Solaris kcms_configure KCMS_PROFILES Buffer Overflow Vulnerability

Bugtraq ID:	2605
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 11 2001 12:00AM
Updated:	Apr 11 2001 12:00AM
Credit:	This vulnerability was revealed in an advisory posted to BugTraq by LSD <[email protected]> on 11 April 2001.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5

Not Vulnerable:

Discussion

Solaris kcms_configure KCMS_PROFILES Buffer Overflow Vulnerability

The Kodak Color Management System configuration tool 'kcms_configure' is vulnerable to a buffer overflow that could yield root privileges to an attacker.

The bug exists in the KCMS_PROFILES environment variable parser in a shared library 'kcsSUNWIOsolf.so' used by kcms_configure. If an overly long KCMS_PROFILES variable is set and kcms_configure is subsequently run, kcms_configure will overflow. Because the kcms_configure binary is setuid root, the overflow allows an attacker to execute arbitrary code as root.

Exploits are available against Solaris x86 and Solaris Sparc.