CDE DTPrintInfo Help Volume Search Buffer Overflow Vulnerability

Bugtraq ID:	4630
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 29 2002 12:00AM
Updated:	Apr 29 2002 12:00AM
Credit:	Vulnerability discovery credited to Kevin Kotas.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4 IBM AIX 4.3.3 IBM AIX 4.3.2 IBM AIX 4.3.1 IBM AIX 4.3 IBM AIX 5.1 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.24 HP HP-UX 10.20 HP HP-UX 10.10 Compaq Tru64 5.1 a Compaq Tru64 5.1 Compaq Tru64 5.0 a Compaq Tru64 4.0 g Compaq Tru64 4.0 f Caldera UnixWare 7.1.1 Caldera OpenUnix 8.0
Not Vulnerable:

CDE DTPrintInfo Help Volume Search Buffer Overflow Vulnerability

CDE is the Common Desktop Environment. It is distributed with several versions of the UNIX Operating System, and maintained by various vendors.

It is possible to execute arbitrary code through the dtprintinfo program. When the dtprintinfo program is executed, a help menu is supplied via the desktop. By using this help menu, and performing a volume search with a string of arbitrary length, it is possible to cause a buffer overflow that could be used to overwrite stack variables, including the return address.

CDE DTPrintInfo Help Volume Search Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

CDE DTPrintInfo Help Volume Search Buffer Overflow Vulnerability

Solution:
Vendor fixes available:


IBM AIX 5.1

• IBM IY20917
  

Sun Solaris 7.0

• Sun 107178-02
  http://sunsolve.sun.com

Sun Solaris 7.0_x86

• Sun 107179-02
  http://sunsolve.sun.com

Sun Solaris 2.4

• Sun 105076-04
  http://sunsolve.sun.com

Sun Solaris 2.5_x86

• Sun 105354-04
  http://sunsolve.sun.com

Sun Solaris 8_x86

• Sun 108950-04
  http://sunsolve.sun.com

Sun Solaris 2.6

• Sun 106242-03
  http://sunsolve.sun.com

Sun Solaris 2.4_x86

• Sun 105354-04
  http://sunsolve.sun.com

Sun Solaris 8_sparc

• Sun 108949-04
  http://sunsolve.sun.com

Sun Solaris 2.6_x86

• Sun 106243-03
  http://sunsolve.sun.com

Sun Solaris 2.5

• Sun 105076-04
  http://sunsolve.sun.com

HP HP-UX 10.10

• HP PHSS_23355
  http://itrc.hp.com

HP HP-UX 10.20

• HP PHSS_23796
  http://itrc.hp.com

HP HP-UX 10.24

• HP PHSS_24097
  http://itrc.hp.com

HP HP-UX 11.0

• HP PHSS_27869
  http://itrc.hp.com

HP HP-UX 11.0 4

• HP PHSS_24098
  http://itrc.hp.com

HP HP-UX 11.11

• HP PHSS_24087
  http://itrc.hp.com


• HP PHSS_24091
  http://itrc.hp.com

Sun Solaris 2.5.1

• Sun 105076-04
  http://sunsolve.sun.com

Sun Solaris 2.5.1 _x86

• Sun 105354-04
  http://sunsolve.sun.com

Compaq Tru64 4.0 f

• Compaq DUV40FB18-C0067301-13427-ES-20020228.tar
  Prerequisite: 4.0F with Patch Kit 7 (BL18) installed
  http://ftp1.support.compaq.com/public/unix/v4.0f/

IBM AIX 4.3

• IBM IY21539
  

IBM AIX 4.3.1

• IBM IY21539
  

IBM AIX 4.3.2

• IBM IY21539
  

IBM AIX 4.3.3

• IBM IY21539
  

Compaq Tru64 5.1 a

• Compaq T64V51AB1-C0011201-13438-ES-20020228.tar
  Prerequisite: 5.1A with Patch Kit 1 (BL1) installed
  http://ftp1.support.compaq.com/public/unix/v5.1a/

Caldera UnixWare 7.1.1

• Caldera erg712032.pkg.Z
  ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.30/erg712032. pkg.Z

Caldera OpenUnix 8.0

• Caldera erg712032.pkg.Z
  ftp://ftp.caldera.com/pub/updates/OpenUNIX/CSSA-2002-SCO.30/erg712032. pkg.Z

CDE DTPrintInfo Help Volume Search Buffer Overflow Vulnerability

References: