Ifenslave Argument Local Buffer Overflow Vulnerability
BID:7682
Info
Ifenslave Argument Local Buffer Overflow Vulnerability
| Bugtraq ID: | 7682 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | May 26 2003 12:00AM |
| Updated: | May 26 2003 12:00AM |
| Credit: | Discovery of this vulnerability has been credited to Julien L. <[email protected]>. |
| Vulnerable: |
ifenslave ifenslave 0.0.7 |
| Not Vulnerable: | |
Discussion
Ifenslave Argument Local Buffer Overflow Vulnerability
ifenslave for Linux has been reported prone to a buffer overflow vulnerability.
The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.
It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of ifenslave. ifenslave is not installed setUID or setGID by default.
It should be noted that although this vulnerability has been reported to affect ifenslave version 0.07 previous versions might also be affected.
ifenslave for Linux has been reported prone to a buffer overflow vulnerability.
The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.
It is possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of ifenslave. ifenslave is not installed setUID or setGID by default.
It should be noted that although this vulnerability has been reported to affect ifenslave version 0.07 previous versions might also be affected.
Exploit / POC
Ifenslave Argument Local Buffer Overflow Vulnerability
The following proof of concept exploit code has been supplied by jlanthea <[email protected]> and jsk.
Another proof of concept exploit was provided by [email protected].
The following proof of concept exploit code has been supplied by jlanthea <[email protected]> and jsk.
Another proof of concept exploit was provided by [email protected].
Solution / Fix
Ifenslave Argument Local Buffer Overflow Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Ifenslave Argument Local Buffer Overflow Vulnerability
References:
References:
- ifenslave v0.07 local buffer overflow (Julien L.