UML_NET Integer Mismanagement Code Execution Vulnerability

Bugtraq ID:	7676
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 24 2003 12:00AM
Updated:	May 24 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to both [email protected] (jonny robertson) and Ktha <[email protected]>.
Vulnerable:	User-Mode Linux uml_utilities Redhat kernel-utils-2.4-8.13.i386.rpm + Redhat Linux 8.0
Not Vulnerable:

UML_NET Integer Mismanagement Code Execution Vulnerability

A vulnerability has been discovered in uml_net. Due to integer mismanagement while handling version information, it may be possible for an attacker to execute arbitrary code. Specifically, by supplying a negative value within the version information it is possible to bypass various calculations and cause an invalid indexing into an array of functions. As a result, it is possible for an attacker to execute a function in an attacker-controlled location of memory.

Successful exploitation of this vulnerability would allow an attacker to execute arbitrary commands with the privileges of uml_net, possibly root.

UML_NET Integer Mismanagement Code Execution Vulnerability

The following proof of concept was provided:

• /data/vulnerabilities/exploits/sm00ny-uml_net.c

UML_NET Integer Mismanagement Code Execution Vulnerability

Solution:
It has been determined that the uml_net application is incorrectly installed as suid root on the Red Hat 8.0 Linux distribution. As a result, Red Hat has released an updated kernel-utils package to address this issue. Users are advised to upgrade as soon as possible.


Redhat kernel-utils-2.4-8.13.i386.rpm

• Red Hat kernel-utils-2.4-8.28.i386.rpm
  ftp://updates.redhat.com/8.0/en/os/i386/kernel-utils-2.4-8.28.i386.rpm

UML_NET Integer Mismanagement Code Execution Vulnerability

References:

• RHSA-2003-056 (Red Hat)
  
• User-Mode Linux Homepage (User-Mode Linux)
  
• uml_net bug (Ktha )