BID:7991

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Info

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Bugtraq ID:	7991
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Jun 19 2003 12:00AM
Updated:	Jun 19 2003 12:00AM
Credit:	The vendor has announced this vulnerability.
Vulnerable:	Sun SunOS 5.9 _x86 Sun SunOS 5.9 Sun Solaris 9_x86 Sun Solaris 9 Sun Solaris 8_x86 Sun Solaris 8_sparc Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6

Not Vulnerable:

Discussion

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Sun dbm_open(), ndbm(), dbm() and dbminit() library functions have been reported prone to buffer overflow vulnerabilities. Each of these issues likely present themselves due to a lack of sufficient bounds checking performed when copying externally supplied data into an internal memory buffer. Excessive data supplied to one of the functions will overrun the boundary of the assigned buffer and corrupt adjacent memory.

It should be noted that the vendor has discussed that the Solaris Xsun application is linked to the vulnerable library and runs as a privileged application. Therefore it may be possible for a local or remote attacker to exploit this condition to obtain root privileges.

Exploit / POC

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Multiple Sun Database Functions Buffer Overflow Vulnerabilities

Solution:
This vendor has reported that this issue is addressed in the following releases; links to the patches can be obtained in the referenced advisory:

SPARC Platform

Solaris 2.6 with patches 105210-47, 105377-06 and 105401-43 or later for each listed patch
Solaris 7 with patches 106541-22, 106942-26 and 106949-03 or later for each listed patch
Solaris 8 with patches 108827-24, 108993-16 and 109152-02 or later for each listed patch
Solaris 9 with patches 112874-01, 112922-02, 113319-10, 114569-02 and 114571-01 or later for each listed patch

x86 Platform

Solaris 2.6 with patches 105211-49 and 105402-43 or later for each listed patch
Solaris 7 with patches 106542-22 and 106943-26 or later for each listed patch
Solaris 8 with patches 108828-25, 108994-16 and 114617-01 or later for each listed patch
Solaris 9 with patches 113719-03, 114570-01 and 114715-01 or later for each listed patch

Fixes:

Sun Solaris 2.6