RedHat 5.1 dumpreg Vulnerability
BID:372
Info
RedHat 5.1 dumpreg Vulnerability
| Bugtraq ID: | 372 |
| Class: | Design Error |
| CVE: |
CVE-1999-1406 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 29 1998 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | This bug was posted to the Bugtraq mailing list on July 29, 1998 by Zachary Amsden<[email protected]>. The Discussion and Exploit sections of this vulnerability were almost wholly based on those posts. |
| Vulnerable: |
Redhat Linux 5.1 |
| Not Vulnerable: |
Redhat Linux 5.2 i386 |
Discussion
RedHat 5.1 dumpreg Vulnerability
The dumpreg utility included with redhat 5.1 can cause kernel crashes. The reasons is that it opens /dev/mem with O_RDWR access and blindly prints its output to fd 1. This can be trivially exploited with a simple program and run by any local user to corrupt kernel memory. Results may vary, but a crash is pretty much inevitable given enough time. A quick fix would be to remove setuid privs from the dumpreg program, as this is not needed for normal use.
The dumpreg utility included with redhat 5.1 can cause kernel crashes. The reasons is that it opens /dev/mem with O_RDWR access and blindly prints its output to fd 1. This can be trivially exploited with a simple program and run by any local user to corrupt kernel memory. Results may vary, but a crash is pretty much inevitable given enough time. A quick fix would be to remove setuid privs from the dumpreg program, as this is not needed for normal use.
Exploit / POC
RedHat 5.1 dumpreg Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
RedHat 5.1 dumpreg Vulnerability
Solution:
Remove the setuid bit from the dumpreg program and upgrade to a newer version of RedHat Linux 5.0.
Solution:
Remove the setuid bit from the dumpreg program and upgrade to a newer version of RedHat Linux 5.0.
References
RedHat 5.1 dumpreg Vulnerability
References:
References: