Solaris kcms Buffer Overflow Vulnerability

Bugtraq ID:	452
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Dec 24 1998 12:00AM
Updated:	Dec 24 1998 12:00AM
Credit:	First posted to Bugtraq on December 24, 1998 by Cheez Whiz <[email protected]> . Additional information posted by Casper Dik <[email protected]>, Dima Volodin <[email protected]>, and Mark K. Pettit <[email protected]>.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5
Not Vulnerable:

Solaris kcms Buffer Overflow Vulnerability

There is an unchecked sprintf() call in the versions of /usr/openwin/bin/kcms_configure shipped with solaris 2.5, 2.5.1 and 2.6. Unfortunately, kcms_configure is installed setuid root, making it possible for an attacker to overflow the buffer and have arbitrary code executed with superuser privileges. The consequence of this vulnerability being exploited is a local root compromise.

Solaris kcms Buffer Overflow Vulnerability

For Solaris x86 and SPARC.

• /data/vulnerabilities/exploits/kcmsex.c
• /data/vulnerabilities/exploits/ex_kcms_configuresp.c

Solaris kcms Buffer Overflow Vulnerability

Solution:
Solaris has released patches addressing this issue for all affected platforms. Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 7.0_x86

• Sun 107339-01
  x86
  

Sun Solaris 2.6

• Sun 107336-01
  sparc
  

Sun Solaris 7.0

• Sun 107337-01
  sparc
  

Sun Solaris 2.6_x86

• Sun 107338-01
  x86
  

Sun Solaris 2.5

• Sun 103878-05
  sparc
  


• Sun 103880-05
  x86
  

Sun Solaris 2.5.1 _x86

• Sun 103881-05
  x86
  

Sun Solaris 2.5.1

• Sun 103879-05
  sparc
  

Solaris kcms Buffer Overflow Vulnerability

References: