Arkiea Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow Vulnerability

Bugtraq ID:	661
Class:	Boundary Condition Error
CVE:	CVE-1999-1534
Remote:	No
Local:	Yes
Published:	Sep 26 1999 12:00AM
Updated:	Jul 11 2009 12:56AM
Credit:	This vulnerability was found by Brock Tellier <[email protected]>.
Vulnerable:	Knox Software Arkeia 4.0 + SuSE Linux 6.2
Not Vulnerable:

Arkiea Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow Vulnerability

A local buffer overflow in the handling of the HOME environment variable by the rlserver and rnavc binaries that are part of the Knox Software Arkiea backup application allow local users to obtain root access.

Arkiea Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow Vulnerability

An exploit has been made available.

• /data/vulnerabilities/exploits/knox.c

Arkiea Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow Vulnerability

Solution:
Currently the SecurityFocus staff are not aware of any vendor supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

In the mean time turn off the setuid bits from the rnavc and nlservd executables.

Arkiea Backup rnavc & nlserverd HOME Environment Variable Buffer Overflow Vulnerability

References:

• Knox Software Home Page (Knox Software)
  
• S.u.S.E. Homepage (S.u.S.E.)