Linux Man Page Source Buffer Overflow Vulnerability
BID:2872
Info
Linux Man Page Source Buffer Overflow Vulnerability
| Bugtraq ID: | 2872 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 12 2001 12:00AM |
| Updated: | Jun 12 2001 12:00AM |
| Credit: | Reported by zen-parse <[email protected]> on June 12, 2001. |
| Vulnerable: |
Redhat Linux 7.1 Redhat Linux 7.0 Redhat Linux 6.1 Redhat Linux 6.2 |
| Not Vulnerable: | |
Discussion
Linux Man Page Source Buffer Overflow Vulnerability
A buffer overflow vulnerability exists in the implementation of the 'man' system manual pager program commonly included with Linux distributions.
The vulnerability exists due to the way the program handles manual page files beginning with a '.so' statement. Under certain circumstances, the code responsible for processing this data may be allow the length of the filename from a '.so' statement to be expanded, eventually causing a boundary condition error.
As a result, it may be possible for local users to execute arbitrary code with group 'man' privileges.
A buffer overflow vulnerability exists in the implementation of the 'man' system manual pager program commonly included with Linux distributions.
The vulnerability exists due to the way the program handles manual page files beginning with a '.so' statement. Under certain circumstances, the code responsible for processing this data may be allow the length of the filename from a '.so' statement to be expanded, eventually causing a boundary condition error.
As a result, it may be possible for local users to execute arbitrary code with group 'man' privileges.
Exploit / POC
Linux Man Page Source Buffer Overflow Vulnerability
The following exploit was submitted by zen-parse <[email protected]>:
The following exploit was submitted by zen-parse <[email protected]>:
Solution / Fix
Linux Man Page Source Buffer Overflow Vulnerability
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.