Elm Local TERM Environment Variable Buffer Overrun Vulnerability

Bugtraq ID:	8030
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	May 13 1997 12:00AM
Updated:	May 13 1997 12:00AM
Credit:	The discovery of this vulnerability has been credited to Wojciech Swieboda <[email protected]>.
Vulnerable:	Elm Development Group ELM 2.4 - Redhat Linux 5.2 sparc - Redhat Linux 5.2 i386 - Redhat Linux 5.2 alpha - Redhat Linux 5.2 + Slackware Linux 4.0 + Slackware Linux 3.6 Elm Development Group ELM 2.3
Not Vulnerable:

Elm Local TERM Environment Variable Buffer Overrun Vulnerability

A buffer overrun has been discovered in Elm. The problem occurs due to insufficient bounds checking performed before copying user-supplied data into an internal memory buffer. Specifically, a TERM environment variable containing excessive data would cause a buffer within Elm to be overrun.

As Elm is installed setgid on some systems, the exploitation of this vulnerability could potentially allow for the elevation of local privileges.

Elm Local TERM Environment Variable Buffer Overrun Vulnerability

An exploit for this issue has been made available by [email protected]:

• /data/vulnerabilities/exploits/DSR-korean-elm.pl

Elm Local TERM Environment Variable Buffer Overrun Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Elm Local TERM Environment Variable Buffer Overrun Vulnerability

References:

• Elm 2.3 and 2.4 curses overflow (insecure.org)
  
• gid bin from /usr/ports/korean/elm (FreeBSD) ()