ISDN4Linux IPPPD Device String SysLog Format String Vulnerability

Bugtraq ID:	5437
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Aug 10 2002 12:00AM
Updated:	Aug 10 2002 12:00AM
Credit:	Vulnerability discovery credited to GOBBLES Security.
Vulnerable:	isdn4linux isdn4linux 3.1 pre1 + S.u.S.E. Firewall Adminhost VPN + S.u.S.E. Firewall Adminhost VPN + S.u.S.E. Linux Admin-CD for Firewall + S.u.S.E. Linux Admin-CD for Firewall + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Connectivity Server + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Database Server 0 + S.u.S.E. Linux Firewall on CD + S.u.S.E. Linux Live-CD for Firewall + S.u.S.E. Linux Live-CD for Firewall + S.u.S.E. SuSE eMail Server III + S.u.S.E. SuSE eMail Server III + SuSE Linux 8.0 i386 + SuSE Linux 8.0 i386 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 i386 + SuSE SUSE Linux Enterprise Server 7 + SuSE SUSE Linux Enterprise Server 7
Not Vulnerable:	isdn4linux isdn4linux 3.2 p1

ISDN4Linux IPPPD Device String SysLog Format String Vulnerability

isdn4linux is a freely available, open source package of isdn compatibility tools. It is available for Linux operating systems.

isdn4linux contains a format string vulnerability in the ipppd utility. In some installations, this utility is installed with setuid root privileges. Exploitation of this vulnerability could lead to a local attacker executing code with administrative privileges.

ISDN4Linux IPPPD Device String SysLog Format String Vulnerability

Exploit contributed by GOBBLES Security and stealth.

• /data/vulnerabilities/exploits/GOBBLES-own-ipppd.c
• /data/vulnerabilities/exploits/7350ippi

ISDN4Linux IPPPD Device String SysLog Format String Vulnerability

Solution:
Fixes available:


isdn4linux isdn4linux 3.1 pre1

• S.u.S.E. i4l-2002.7.23-0.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/i4l-2002.7.23-0.i386.rp m


• S.u.S.E. i4l-2002.7.23-0.ppc.rpm
  ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/i4l-2002.7.23-0.ppc.rpm


• S.u.S.E. i4l-2002.7.23-0.sparc.rpm
  ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/i4l-2002.7.23-0.sparc. rpm


• S.u.S.E. i4l-2002.7.31-0.i386.rpm
  ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/i4l-2002.7.31-0.i386.rp m

ISDN4Linux IPPPD Device String SysLog Format String Vulnerability

References:

• isdn4linux Homepage (isdn4linux)