HPUX PCLToTIFF Command Line Argument Local Buffer Overflow Vulnerability

Bugtraq ID:	7853
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 09 2003 12:00AM
Updated:	Jun 09 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to LSD Research Group.
Vulnerable:	HP HP-UX 10.26 HP HP-UX 10.20 HP HP-UX 10.10 HP HP-UX 10.0 1
Not Vulnerable:

HPUX PCLToTIFF Command Line Argument Local Buffer Overflow Vulnerability

HP-UX pcltotiff has been reported prone to a buffer overflow vulnerability.

The issue is reportedly due to a lack of sufficient bounds checking performed on user-supplied data before it is copied into an internal memory space.

It may be possible for a local attacker to seize control of the vulnerable application and have malicious arbitrary code executed in the context of pcltotiff.

HPUX PCLToTIFF Command Line Argument Local Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

HPUX PCLToTIFF Command Line Argument Local Buffer Overflow Vulnerability

Solution:
The vendor has recommended that users, to address this issue, remove set group id permissions from pcltotiff and allow read access to /usr/lib/X11/fonts/ifo.st/typefaces/ by executing the following commands as the root user:

/sbin/chmod 555 /opt/sharedprint/bin/pcltotiff
/sbin/chmod o+r /usr/lib/X11/fonts/ifo.st/typefaces/

HPUX PCLToTIFF Command Line Argument Local Buffer Overflow Vulnerability

References:

• pcltotiff bufferoverflow (Last Stage of Delirium)
  
• [LSD] HP-UX security vulnerabilities (Last Stage of Delirium )
  
• HP-UX pcltotiff ([email protected])