Multiple Vendor mailx Vulnerability
BID:393
Info
Multiple Vendor mailx Vulnerability
| Bugtraq ID: | 393 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jun 25 1998 12:00AM |
| Updated: | Jun 25 1998 12:00AM |
| Credit: | This vulnerability was reported to the Bugtraq mailing list by Alvaro Martinez Echevarria <[email protected]> on June 25, 1998. |
| Vulnerable: |
Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 2.6_x86 Sun Solaris 2.6 HW3/98 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 SGI IRIX 6.3 SGI IRIX 5.3 SGI IRIX 5.2 Redhat Linux 4.2 |
| Not Vulnerable: |
Sun Solaris 7.0_x86 Sun Solaris 7.0 |
Discussion
Multiple Vendor mailx Vulnerability
A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail.
A buffer overrun exists in the /bin/mailx program. This program was originally developed as part of BSD, and is available on many Unix systems. By supplying a long, well crafted buffer as the username argument, an attacker can use it to execuate arbitrary code. On some systems, this will result in the ability to execute code as group mail.
Exploit / POC
Multiple Vendor mailx Vulnerability
x
x
Solution / Fix
Multiple Vendor mailx Vulnerability
Solution:
Patches should be applied. A suitable short term solution is to remove the setgid or setuid bit, if present.
Redhat:
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/i386/mailx-8.1.1-3.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/alpha/mailx-8.1.1-3.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/sparc/mailx-8.1.1-3.sparc.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.0/i386/mailx-8.1.1-3.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.0/alpha/mailx-8.1.1-3.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/i386/mailx-8.1.1-0.2.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/alpha/mailx-8.1.1-0.2.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/sparc/mailx-8.1.1-0.2.sparc.rpm
Slackware:
ftp://ftp.cdrom.com/pub/linux/slackware/slakware/n3/mailx.tgz
ftp://ftp.cdrom.com/pub/linux/slackware/source/n/mailx/mailx-overflow.diff.gz
SGI
OS Version Vulnerable? Patch # Other Actions
IRIX 3.x yes not avail Note 1, 2 & 3
IRIX 4.x yes not avail Note 1, 2 & 3
IRIX 5.0.x yes not avail Note 1, 2 & 3
IRIX 5.1.x yes not avail Note 1, 2 & 3
IRIX 5.2 yes not avail Note 1, 2 & 3
IRIX 5.3 yes 3347
IRIX 6.0.x yes not avail Note 1, 2 & 3
IRIX 6.1 yes not avail Note 1, 2 & 3
IRIX 6.2 yes 3348
IRIX 6.3 yes 3394
IRIX 6.4 yes 3394
IRIX 6.5 yes not avail Note 4
IRIX 6.5.1m yes 3393 Note 5
NOTES:
1) Upgrade to currently supported IRIX operating system.
2) Chage permissions.
3) Unsupported by SGI, "freeware" sendmail distributions can be
found at http://www.sendmail.org/
4) For IRIX 6.5, you must first install IRIX 6.5.1 Maintenance
Release and then install patch 3393. If you have not
received an IRIX 6.5.1m CD for IRIX 6.5, contact your SGI
Support Provider or download the Maintenance Release from
http://support.sgi.com/
5) Patchsets have been replaced with quarterly Maintenance
Releases Streams starting with IRIX 6.5. Information about
Maintenance Release Streams can be found in the IRIX 6.5
Technical Brief at: http://www.sgi.com/software/irix6.5/
Sun patches are available at Sunsolve Online, http://sunsolve.sun.com
Solution:
Patches should be applied. A suitable short term solution is to remove the setgid or setuid bit, if present.
Redhat:
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/i386/mailx-8.1.1-3.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/alpha/mailx-8.1.1-3.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.1/sparc/mailx-8.1.1-3.sparc.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.0/i386/mailx-8.1.1-3.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/5.0/alpha/mailx-8.1.1-3.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/i386/mailx-8.1.1-0.2.i386.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/alpha/mailx-8.1.1-0.2.alpha.rpm
rpm -Uvh ftp://ftp.redhat.com/updates/4.2/sparc/mailx-8.1.1-0.2.sparc.rpm
Slackware:
ftp://ftp.cdrom.com/pub/linux/slackware/slakware/n3/mailx.tgz
ftp://ftp.cdrom.com/pub/linux/slackware/source/n/mailx/mailx-overflow.diff.gz
SGI
OS Version Vulnerable? Patch # Other Actions
IRIX 3.x yes not avail Note 1, 2 & 3
IRIX 4.x yes not avail Note 1, 2 & 3
IRIX 5.0.x yes not avail Note 1, 2 & 3
IRIX 5.1.x yes not avail Note 1, 2 & 3
IRIX 5.2 yes not avail Note 1, 2 & 3
IRIX 5.3 yes 3347
IRIX 6.0.x yes not avail Note 1, 2 & 3
IRIX 6.1 yes not avail Note 1, 2 & 3
IRIX 6.2 yes 3348
IRIX 6.3 yes 3394
IRIX 6.4 yes 3394
IRIX 6.5 yes not avail Note 4
IRIX 6.5.1m yes 3393 Note 5
NOTES:
1) Upgrade to currently supported IRIX operating system.
2) Chage permissions.
3) Unsupported by SGI, "freeware" sendmail distributions can be
found at http://www.sendmail.org/
4) For IRIX 6.5, you must first install IRIX 6.5.1 Maintenance
Release and then install patch 3393. If you have not
received an IRIX 6.5.1m CD for IRIX 6.5, contact your SGI
Support Provider or download the Maintenance Release from
http://support.sgi.com/
5) Patchsets have been replaced with quarterly Maintenance
Releases Streams starting with IRIX 6.5. Information about
Maintenance Release Streams can be found in the IRIX 6.5
Technical Brief at: http://www.sgi.com/software/irix6.5/
Sun patches are available at Sunsolve Online, http://sunsolve.sun.com
References
Multiple Vendor mailx Vulnerability
References:
References:
- AIX Fix Distribution Service (IBM)
- IBM Support Databases (IBM)
- SGI Support (Silicon Graphics Inc.)
- Sun Patch Access Page (Sun Microsystems)
- Sun Patches List (Sun Microsystems)
- Sunsolve Online(tm) (Sun Microsystems)
- Updates, Fixes, and Errata Page (RedHat)