IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
BID:7672
Info
IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
| Bugtraq ID: | 7672 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 23 2003 12:00AM |
| Updated: | May 23 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to "[email protected]" <[email protected]>. |
| Vulnerable: |
SGI IRIX 6.5.19 SGI IRIX 6.5.18 SGI IRIX 6.5.17 SGI IRIX 6.5.16 SGI IRIX 6.5.15 SGI IRIX 6.5.14 SGI IRIX 6.5.13 SGI IRIX 6.5.12 SGI IRIX 6.5.11 SGI IRIX 6.5.10 SGI IRIX 6.5.9 SGI IRIX 6.5.8 SGI IRIX 6.5.7 SGI IRIX 6.5.6 SGI IRIX 6.5.5 SGI IRIX 6.5.4 SGI IRIX 6.5.3 SGI IRIX 6.5.2 SGI IRIX 6.5.1 SGI IRIX 6.5 SGI IRIX 6.4 SGI IRIX 6.3 SGI IRIX 6.2 SGI IRIX 6.1 SGI IRIX 6.0.1 SGI IRIX 6.0 SGI IRIX 5.3 SGI IRIX 5.2 SGI IRIX 5.1.1 SGI IRIX 5.1 SGI IRIX 5.0.1 SGI IRIX 5.0 |
| Not Vulnerable: | |
Discussion
IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
A buffer overflow vulnerability has been reported for the MediaMail binary that may result in a user obtaining elevated privileges.
Although unconfirmed, an attacker, using a custom crafted string, could overwrite stack memory, including the return address of a function, and potentially execute arbitrary code with group 'mail' privileges.
This vulnerability may be related to the issue described in BID 4959.
A buffer overflow vulnerability has been reported for the MediaMail binary that may result in a user obtaining elevated privileges.
Although unconfirmed, an attacker, using a custom crafted string, could overwrite stack memory, including the return address of a function, and potentially execute arbitrary code with group 'mail' privileges.
This vulnerability may be related to the issue described in BID 4959.
Exploit / POC
IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
The following proof of concept was provided:
sh$ export $HOME=`perl -e 'print "A"x12096'
sh$ /usr/bin/X11/MediaMail
The following proof of concept was provided:
sh$ export $HOME=`perl -e 'print "A"x12096'
sh$ /usr/bin/X11/MediaMail
Solution / Fix
IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
Solution:
SGI has stated in a previous MediaMail advisory, possibly related to this issue, that MediaMail is an expired product, and patches will not be issued. Additionally, SGI has stated that affected users should uninstall the program, and use an alternative mail client.
-------------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
SGI has stated in a previous MediaMail advisory, possibly related to this issue, that MediaMail is an expired product, and patches will not be issued. Additionally, SGI has stated that affected users should uninstall the program, and use an alternative mail client.
-------------
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IRIX MediaMail HOME Environment Variable Buffer Overflow Vulnerability
References:
References:
- bazarr CALL POLICE ("[email protected]"
- Re: bazarr CALL POLICE (Michael Nelson