AIX SIGIO and SIGURG Signals Vulnerability
BID:402
Info
AIX SIGIO and SIGURG Signals Vulnerability
| Bugtraq ID: | 402 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 11 1997 12:00AM |
| Updated: | Nov 11 1997 12:00AM |
| Credit: | This problem was published in the IBM APAR Database on November 11, 1997. Part of the Discussion section of this advisory was taken from the OpenBSD advisory "Vulnerability in I/O Signal Handling" released September 15, 1997. |
| Vulnerable: |
IBM AIX 4.3 IBM AIX 4.2.1 IBM AIX 4.2 IBM AIX 4.1.5 IBM AIX 4.1.4 IBM AIX 4.1.3 IBM AIX 4.1.2 IBM AIX 4.1.1 IBM AIX 4.1 |
| Not Vulnerable: |
IBM AIX 4.3.2 |
Discussion
AIX SIGIO and SIGURG Signals Vulnerability
Under certain versions of AIX processes may receive SIGIO or SIGURG signals from other unrelated processes. The processes receiving the signals may exit unexpectedly. This could allow malicious users to kill processes which were not their own. This is a problem many OS's have been found to suffer from. In addition to being an extremely potent denial of service attack, surgical application of this vulnerability can be used to compromise the system - for example, a process holding a bound address (NFS port 2049, for instance) can be killed off and it's port stolen; this can be used to steal NFS file handles.
This problem was fixed by adding code to sockets subsystem to only allow SIGIO and SIGURG signals to processes with the same UID as the process that called the SIOCSPGRP ioctl.
Under certain versions of AIX processes may receive SIGIO or SIGURG signals from other unrelated processes. The processes receiving the signals may exit unexpectedly. This could allow malicious users to kill processes which were not their own. This is a problem many OS's have been found to suffer from. In addition to being an extremely potent denial of service attack, surgical application of this vulnerability can be used to compromise the system - for example, a process holding a bound address (NFS port 2049, for instance) can be killed off and it's port stolen; this can be used to steal NFS file handles.
This problem was fixed by adding code to sockets subsystem to only allow SIGIO and SIGURG signals to processes with the same UID as the process that called the SIOCSPGRP ioctl.
Exploit / POC
AIX SIGIO and SIGURG Signals Vulnerability
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution / Fix
AIX SIGIO and SIGURG Signals Vulnerability
Solution:
IBM has issued the following APAR's to address this problem:
AIX 4.3
---------
APAR # IX72553
AIX 4.2
---------
APAR # IX71795
AIX 4.1
---------
APAR # IX71832
Solution:
IBM has issued the following APAR's to address this problem:
AIX 4.3
---------
APAR # IX72553
AIX 4.2
---------
APAR # IX71795
AIX 4.1
---------
APAR # IX71832
References
AIX SIGIO and SIGURG Signals Vulnerability
References:
References:
- AIX Fix Distribution Service (IBM)
- IBM Support Databases (IBM)