BID:3681

Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

Info

Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

Bugtraq ID:	3681
Class:	Boundary Condition Error
CVE:	CVE-2001-0797
Remote:	Yes
Local:	No
Published:	Dec 12 2001 12:00AM
Updated:	Nov 15 2007 12:39AM
Credit:	Discovered by Mark Dowd of ISS X-Force.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 Sun Solaris 2.3 Sun Solaris 2.2 Sun Solaris 2.1 Sun Solaris 2.0 SGI IRIX 3.3.3 SGI IRIX 3.3.2 SGI IRIX 3.3.1 SGI IRIX 3.3 SGI IRIX 3.2 SCO Open Server 5.0.6 a SCO Open Server 5.0.6 SCO Open Server 5.0.5 SCO Open Server 5.0.4 SCO Open Server 5.0.3 SCO Open Server 5.0.2 SCO Open Server 5.0.1 SCO Open Server 5.0 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 IBM AIX 5.1 HP HP-UX (VVOS) 11.0.4 HP HP-UX (VVOS) 10.24 HP HP-UX 11.11 HP HP-UX 11.0 HP HP-UX 10.20 HP HP-UX 10.10 HP HP-UX 10.0 1 HP HP-UX 10.0 Cisco Voice Services Provisioning Tool + Sun Solaris 2.6 Cisco Signaling Controller 2200 + Sun Solaris 2.5.1 + Sun Solaris 2.6 Cisco Secure IDS Network Sensor 3.0 (2)S6 Cisco Secure IDS Network Sensor 3.0 Cisco PGW2200 PSTN Gateway + Sun Solaris 2.6 Cisco Billing and Management Server + Sun Solaris 2.6

Not Vulnerable:	Cisco Secure IDS Network Sensor 3.0 (5)

Discussion

Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

The 'login' program is used in UNIX systems to authenticate users with a username and password. The utility is typically invoked at the console, by 'telnetd', 'rlogind', and if configured to do so, SSH.

Versions of 'login' descended from System V UNIX contain a buffer overflow when handling environment variables. Several operating systems such as Solaris/SunOS, HP-UX, AIX, IRIX, and Unixware contain vulnerable versions of 'login'.

Unauthenticated clients can exploit this issue to execute arbitrary code as root. On systems where 'login' is installed setuid root, local attackers can elevate privileges.

Exploit / POC

Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.

A publicly available exploit has been written for Solaris i386 systems. An unpublished exploit for Solaris/SPARC systems is in circulation in the underground.

This issue is also exploitable by setting the TTYPROMPT environment variable to contain six bytes of data and then passing a string containing 65 " c" character combinations, followed by a newline, to a telnet service accessing the vulnerable login.

A newer exploit has been made available.

/data/vulnerabilities/exploits/smash_bin_login.c
/data/vulnerabilities/exploits/login.pl
/data/vulnerabilities/exploits/raptor_rlogin.c

Solution / Fix

Multiple Vendor System V Derived 'login' Buffer Overflow Vulnerability

Solution:
According to CERT, HP's response is that the telnet daemon shipped with HP-UX contains the buffer overflow but is not exploitable. Despite this, administrators are urged to take appropriate steps (see above) to be careful.

Cisco Billing and Management Server