Solaris cachefsd Heap Overflow Vulnerability

Bugtraq ID:	4674
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	May 06 2002 12:00AM
Updated:	May 06 2002 12:00AM
Credit:	Discovered by Last Stage of Delirium.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6_sparc Sun Solaris 2.6 Cisco Voice Services Provisioning Tool + Sun Solaris 2.6 Cisco Virtual Switch Controller 3000 + Sun Solaris 2.6 Cisco Universal Gateway Manager Cisco Signaling Controller 2200 + Sun Solaris 2.5.1 + Sun Solaris 2.6 Cisco Secure ACS for Unix 2.3.6 .1 Cisco Secure ACS for Unix 2.3.5 .1 Cisco Secure ACS for Unix 2.3 Cisco Secure ACS for Unix 2.0 Cisco PGW2200 PSTN Gateway + Sun Solaris 2.6 Cisco MGC (Media Gateway Controller) Node Manager Cisco Media Gateway Manager Cisco IP Manager 2.0 Cisco IP Manager 1.0 Cisco EMS for the Cisco 7200/7400 Cisco EMS for the Catalyst 6500 / Cisco 7600 Cisco Element Management Framework Cisco DSL Manager Cisco Cable Manager Cisco Billing and Management Server + Sun Solaris 2.6 Cisco 12000 Manager
Not Vulnerable:	Cisco IDS-4230-xx Cisco IDS-4220-E Cisco IDS-4210 Cisco BTS 10200

Solaris cachefsd Heap Overflow Vulnerability

A remotely exploitable buffer overflow condition has been reported in cachefsd. The overflow occurs in the heap and is reportedly exploitable as valid malloc() chunk structures are overwritten. Successful attacks may result in remote attackers gaining root access on the affected system.

Solaris cachefsd Heap Overflow Vulnerability

Exploit code lsd_cachefsd.c has been provided by LAST STAGE OF DELIRIUM:

• /data/vulnerabilities/exploits/lsd_cachefsd.c

Solaris cachefsd Heap Overflow Vulnerability

Solution:
Cisco reports that users of MGC and related products who have applied the script from CSCO013.pkg are not vulnerable to this issue.

The following patches are available:


Sun Solaris 8_sparc

• Sun 110896-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=110896&rev=02

Sun Solaris 2.6_x86

• Sun 105694-13
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=105694&rev=13

Sun Solaris 7.0

• Sun 108800-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108800&rev=02

Sun Solaris 9

• Sun 114008-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=114008&rev=01

Sun Solaris 7.0_x86

• Sun 108801-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=108801&rev=02

Sun Solaris 9_x86

• Sun 114009-01
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=114009&rev=01

Sun Solaris 2.6

• Sun 105693-13
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=105693&rev=13

Sun Solaris 8_x86

• Sun 110897-02
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=110897&rev=02

Sun Solaris 2.5.1

• Sun 104849-09
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=104849&rev=09

Sun Solaris 2.5.1 _x86

• Sun 104848-09
  http://sunsolve.sun.com/pub-cgi/findPatch.pl?patchId=104848&rev=09

Solaris cachefsd Heap Overflow Vulnerability

References:

• 44309 (Sun Microsystems)