HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
BID:7132
Info
HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
| Bugtraq ID: | 7132 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Mar 18 2003 12:00AM |
| Updated: | Mar 18 2003 12:00AM |
| Credit: | This vulnerability was disclosed by the vendor. |
| Vulnerable: |
HP HP-UX 11.22 HP HP-UX 11.20 HP HP-UX 11.11 HP HP-UX 11.0 4 HP HP-UX 11.0 HP HP-UX 10.34 HP HP-UX 10.30 HP HP-UX 10.26 HP HP-UX 10.24 HP HP-UX 10.20 SIS HP HP-UX 10.20 Series 800 HP HP-UX 10.20 Series 700 HP HP-UX 10.20 HP HP-UX 10.16 HP HP-UX 10.10 HP HP-UX 10.9 HP HP-UX 10.8 HP HP-UX 10.1 0 HP HP-UX 10.0 1 HP HP-UX 10.0 HP HP-UX 9.10 HP HP-UX 9.9 HP HP-UX 9.8 HP HP-UX 9.7 HP HP-UX 9.6 HP HP-UX 9.5 HP HP-UX 9.4 HP HP-UX 9.3 HP HP-UX 9.1 HP HP-UX 9.0 HP HP-UX 8.9 HP HP-UX 8.8 HP HP-UX 8.7 HP HP-UX 8.6 HP HP-UX 8.5 HP HP-UX 8.4 HP HP-UX 8.2 HP HP-UX 8.1 HP HP-UX 8.0 HP HP-UX 11i v1 Compaq Tru64 5.1 a PK3 (BL3) Compaq Tru64 5.1 a PK2 (BL2) Compaq Tru64 5.1 a PK1 (BL1) Compaq Tru64 5.1 a Compaq Tru64 5.1 PK6 (BL20) Compaq Tru64 5.1 PK5 (BL19) Compaq Tru64 5.1 PK4 (BL18) Compaq Tru64 5.1 PK3 (BL17) Compaq Tru64 5.1 Compaq Tru64 5.0 a PK3 (BL17) Compaq Tru64 5.0 a Compaq Tru64 4.0 g PK3 (BL17) Compaq Tru64 4.0 g Compaq Tru64 4.0 f PK7 (BL18) Compaq Tru64 4.0 f PK6 (BL17) Compaq Tru64 4.0 f |
| Not Vulnerable: |
HP MPE/iX 7.0 HP MPE/iX 6.5 HP MPE/iX 6.0 HP MPE/iX 5.5 HP MPE/iX 5.0 HP MPE/iX 4.5 HP MPE/iX 4.0 Compaq OpenVMS 7.3 VAX Compaq OpenVMS 7.3 Alpha Compaq OpenVMS 7.2.1 Alpha Compaq OpenVMS 7.2 -2 Alpha Compaq OpenVMS 7.2 -1H2 Alpha Compaq OpenVMS 7.2 -1H1 Alpha Compaq OpenVMS 7.2 VAX Compaq OpenVMS 7.2 Alpha Compaq OpenVMS 7.1 -2 Alpha Compaq OpenVMS 7.1 VAX Compaq OpenVMS 7.1 Alpha Compaq OpenVMS 6.2 VAX Compaq OpenVMS 6.2 Alpha Compaq OpenVMS 6.2 Compaq OpenVMS 5.3 Compaq Nonstop Kernel S-Series 3.0 |
Discussion
HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
It has been reported that HP Tru64 and HP-UX based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. Consequently, I/O that are opened by a setuid process may be assigned file descriptors equivelent to those used by the C library as 'standard input','standard output', and 'standard error'.
This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
It has been reported that HP Tru64 and HP-UX based kernels do not check to ensure that the C library standard I/O file descriptors 0-2 are valid open files before exec()ing setuid images. Consequently, I/O that are opened by a setuid process may be assigned file descriptors equivelent to those used by the C library as 'standard input','standard output', and 'standard error'.
This may result in untrusted, attacker supplied data being written to sensitive I/O channels. Local root compromise has been confirmed as a possible consequence.
Exploit / POC
HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution / Fix
HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
Solution:
Fixes are available:
Compaq Tru64 4.0 g PK3 (BL17)
Compaq Tru64 4.0 f PK7 (BL18)
Compaq Tru64 5.0 a PK3 (BL17)
Compaq Tru64 5.1 PK5 (BL19)
Compaq Tru64 5.1 PK6 (BL20)
Compaq Tru64 5.1 a PK3 (BL3)
Solution:
Fixes are available:
Compaq Tru64 4.0 g PK3 (BL17)
-
HP t64v40gb17-c0028500-17206-es-20030305.tar
ftp://ftp1.support.compaq.com/public/unix/v4.0g/t64v40gb17-c0028500-17 206-es-20030305.tar
Compaq Tru64 4.0 f PK7 (BL18)
-
HP t64v50ab17-c0031400-17220-es-20030305.tar
ftp://ftp1.support.compaq.com/public/unix/v5.0a/t64v50ab17-c0031400-17 220-es-20030305.tar
Compaq Tru64 5.0 a PK3 (BL17)
-
HP t64v50ab17-c0031400-17220-es-20030305.tar
ftp://ftp1.support.compaq.com/public/unix/v5.0a/t64v50ab17-c0031400-17 220-es-20030305.tar
Compaq Tru64 5.1 PK5 (BL19)
-
HP t64v51b19-c0143704-17254-es-20030306.tar
ftp://ftp1.support.compaq.com/public/unix/v5.1/t64v51b19-c0143704-1725 4-es-20030306.tar
Compaq Tru64 5.1 PK6 (BL20)
-
HP t64v51b20-c0172301-17255-es-20030306.tar
ftp://ftp1.support.compaq.com/public/unix/v5.1/t64v51b20-c0172301-1725 5-es-20030306.tar
Compaq Tru64 5.1 a PK3 (BL3)
-
HP t64v51ab3-c0106401-17256-es-20030306.tar
ftp://ftp1.support.compaq.com/public/unix/v5.1a/t64v51ab3-c0106401-172 56-es-20030306.tar
References
HP Tru64/HP-UX C Library Standard I/O File Descriptor Vulnerability
References:
References: