Multiple Vendor Sun RPC xdr_array Buffer Overflow Vulnerability
BID:5356
Info
Multiple Vendor Sun RPC xdr_array Buffer Overflow Vulnerability
| Bugtraq ID: | 5356 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2002-0391 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 30 2002 12:00AM |
| Updated: | Nov 15 2007 12:37AM |
| Credit: | Discovered by ISS X-Force. |
| Vulnerable: |
Trustix Secure Linux 1.5 Trustix Secure Linux 1.2 Trustix Secure Linux 1.1 Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.8 Sun Solaris 2.7_sparc Sun Solaris 2.7 Sun Solaris 2.6_x86 Sun Solaris 2.6 SGI IRIX 6.5.17 m SGI IRIX 6.5.17 f SGI IRIX 6.5.16 m SGI IRIX 6.5.16 f SGI IRIX 6.5.15 m SGI IRIX 6.5.15 f SGI IRIX 6.5.14 m SGI IRIX 6.5.14 f SGI IRIX 6.5.13 m SGI IRIX 6.5.13 f SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 OpenBSD OpenBSD 2.9 OpenBSD OpenBSD 2.8 OpenBSD OpenBSD 2.7 OpenBSD OpenBSD 2.6 OpenBSD OpenBSD 2.5 OpenBSD OpenBSD 2.4 OpenBSD OpenBSD 2.3 OpenBSD OpenBSD 2.2 OpenBSD OpenBSD 2.1 OpenBSD OpenBSD 2.0 OpenBSD OpenBSD 3.1 OpenBSD OpenBSD 3.0 OpenAFS OpenAFS 1.3.2 OpenAFS OpenAFS 1.3.1 OpenAFS OpenAFS 1.3 OpenAFS OpenAFS 1.2.5 OpenAFS OpenAFS 1.2.4 OpenAFS OpenAFS 1.2.3 OpenAFS OpenAFS 1.2.2 b OpenAFS OpenAFS 1.2.2 a OpenAFS OpenAFS 1.2.2 OpenAFS OpenAFS 1.2.1 OpenAFS OpenAFS 1.2 OpenAFS OpenAFS 1.1.1 a OpenAFS OpenAFS 1.1.1 OpenAFS OpenAFS 1.1 OpenAFS OpenAFS 1.0.4 a OpenAFS OpenAFS 1.0.4 OpenAFS OpenAFS 1.0.3 OpenAFS OpenAFS 1.0.2 OpenAFS OpenAFS 1.0.1 OpenAFS OpenAFS 1.0 NetBSD NetBSD 1.6 beta NetBSD NetBSD 1.5.3 NetBSD NetBSD 1.5.2 NetBSD NetBSD 1.5.1 NetBSD NetBSD 1.5 NetBSD NetBSD 1.4.3 NetBSD NetBSD 1.4.2 NetBSD NetBSD 1.4.1 NetBSD NetBSD 1.4 MIT Kerberos 5 1.2.5 MIT Kerberos 5 1.2.4 MIT Kerberos 5 1.2.3 MIT Kerberos 5 1.2.2 MIT Kerberos 5 1.2.1 MIT Kerberos 5 1.2 MIT Kerberos 5 1.1.1 MIT Kerberos 5 1.1 MIT Kerberos 5 1.0.6 MIT Kerberos 5 1.0 Microsoft Services for Unix 3.0 KTH Kerberos 5 1.2.2 KTH Kerberos 5 1.2.1 KTH Kerberos 5 1.2 KTH Kerberos 5 1.1 IBM AIX 4.3.3 IBM AIX 5.1 HP Secure OS software for Linux 1.0 HP HP-UX 11.22 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.26 HP HP-UX 10.24 HP HP-UX 10.20 Series 800 HP HP-UX 10.20 Series 700 HP HP-UX 10.20 GNU glibc 2.2.5 GNU glibc 2.2.4 GNU glibc 2.2.3 GNU glibc 2.2.2 GNU glibc 2.2.1 GNU glibc 2.2 GNU glibc 2.1.3 FreeBSD FreeBSD 4.6 -STABLE FreeBSD FreeBSD 4.6 -RELEASE FreeBSD FreeBSD 4.6 FreeBSD FreeBSD 4.5 -STABLE FreeBSD FreeBSD 4.5 -RELEASE FreeBSD FreeBSD 4.5 FreeBSD FreeBSD 4.4 -STABLE FreeBSD FreeBSD 4.4 -RELENG FreeBSD FreeBSD 4.4 FreeBSD FreeBSD 4.3 -STABLE FreeBSD FreeBSD 4.3 -RELENG FreeBSD FreeBSD 4.3 -RELEASE FreeBSD FreeBSD 4.3 FreeBSD FreeBSD 4.2 -STABLE FreeBSD FreeBSD 4.2 -RELEASE FreeBSD FreeBSD 4.2 FreeBSD FreeBSD 4.1.1 -STABLE FreeBSD FreeBSD 4.1.1 -RELEASE FreeBSD FreeBSD 4.1.1 FreeBSD FreeBSD 4.1 FreeBSD FreeBSD 4.0 diet libc diet libc 0.18 diet libc diet libc 0.17 diet libc diet libc 0.16 diet libc diet libc 0.15 Caldera OpenLinux Workstation 3.1.1 Caldera OpenLinux Workstation 3.1 Caldera OpenLinux Server 3.1.1 Caldera OpenLinux Server 3.1 Apple Mac OS X 10.2 Apple Mac OS X 10.1.5 Apple Mac OS X 10.1.4 Apple Mac OS X 10.1.3 Apple Mac OS X 10.1.2 Apple Mac OS X 10.1.1 Apple Mac OS X 10.1 Apple Mac OS X 10.1 Apple Mac OS X 10.0.4 Apple Mac OS X 10.0.3 Apple Mac OS X 10.0.2 Apple Mac OS X 10.0.1 Apple Mac OS X 10.0 acm acm 5.0 |
| Not Vulnerable: |
SGI IRIX 6.5.18 OpenAFS OpenAFS 1.2.6 NetBSD NetBSD 1.6 diet libc diet libc 0.19 |
Exploit / POC
Multiple Vendor Sun RPC xdr_array Buffer Overflow Vulnerability
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
References
Multiple Vendor Sun RPC xdr_array Buffer Overflow Vulnerability
References:
References:
- 0.19 Changelog (diet libc)
- 46122 (Sun Microsystems)
- CERT Advisory CA-2002-25 Integer Overflow In XDR Library (CERT)
- Kerberos Homepage (MIT)
- Microsoft Security Bulletin MS02-057 (Microsoft)
- OpenBSD Homepage (OpenBSD)
- Remote Buffer Overflow Vulnerability in Sun RPC (Internet Security Systems)
- Security Update 2002-08-02 : Information and Download (Apple)
- ttdbserverd xdr_array() exploit (CORE Security)