SunOS arp(8c) Memory Dump Vulnerability
BID:291
Info
SunOS arp(8c) Memory Dump Vulnerability
| Bugtraq ID: | 291 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 01 1994 12:00AM |
| Updated: | Feb 01 1994 12:00AM |
| Credit: | It is unkown to the SecurityFocus staff when this bug was made public or by whom. This entry was summarized from the Security Bugware web page maintained by Hrvoje Crvelin <[email protected]>. |
| Vulnerable: |
Sun SunOS 4.1.4 Sun SunOS 4.1.3 c Sun SunOS 4.1.3 _U1 Sun SunOS 4.1.3 Sun SunOS 4.1.2 Sun SunOS 4.1.1 Sun SunOS 4.1 PSR_A Sun SunOS 4.1 Sun SunOS 4.0.3 c Sun SunOS 4.0.3 Sun SunOS 4.0.2 Sun SunOS 4.0.1 Sun SunOS 4.0 |
| Not Vulnerable: | |
Discussion
SunOS arp(8c) Memory Dump Vulnerability
The version of arp(8c) which shipped with versions of SunOs 4.1.X could be used to dump system memory by using the -f flag. This flag causes the file filename to be read and multiple entries to be set in the ARP tables. However, in this instance because of poor permission sets on /dev/kmem a user can specify the file to be read as /dev/kmem and therefore gain a dump of currently paged system memory. This could lead to a root compromise.
The version of arp(8c) which shipped with versions of SunOs 4.1.X could be used to dump system memory by using the -f flag. This flag causes the file filename to be read and multiple entries to be set in the ARP tables. However, in this instance because of poor permission sets on /dev/kmem a user can specify the file to be read as /dev/kmem and therefore gain a dump of currently paged system memory. This could lead to a root compromise.
Exploit / POC
SunOS arp(8c) Memory Dump Vulnerability
$ arp -f /dev/kmem | strings > mem
$ arp -f /dev/kmem | strings > mem
Solution / Fix
SunOS arp(8c) Memory Dump Vulnerability
Solution:
Turn execute permision for 'others' off on /dev/kmem.
Solution:
Turn execute permision for 'others' off on /dev/kmem.