Solaris snoop (GETQUOTA) Buffer Overflow Vulnerability

Bugtraq ID:	864
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	Yes
Published:	Dec 09 1999 12:00AM
Updated:	Dec 09 1999 12:00AM
Credit:	This vulnerability was discovered by the ISS X-Force and posted to the Bugtraq mailing list on December 9, 1999.
Vulnerable:	Sun Solaris 2.5.1 _x86 Sun Solaris 2.5.1 _ppc Sun Solaris 2.5.1 Sun Solaris 7.0_x86 Sun Solaris 7.0 Sun Solaris 2.6_x86 Sun Solaris 2.6 Sun Solaris 2.5_x86 Sun Solaris 2.5 Sun Solaris 2.4_x86 Sun Solaris 2.4
Not Vulnerable:

Solaris snoop (GETQUOTA) Buffer Overflow Vulnerability

Certain versions of Solaris (2.X) ship with a program designed to monitor network traffic accessible from on a hosts ethernet segment. This program, /usr/sbin/snoop is under certain versions of Solaris vulnerable to a remotely exploitable buffer overflow attack. The problem lies in where snoop attempts to decode GETQUOTA requests to the rquotad RPC daemon. Rquotad is an rpc(4) server which returns quotas for a user of a local file system which is mounted by a remote machine over the NFS. The results are used by quota(1M) to display user quotas for remote file systems.

An overly long GETQUOTA request will result in a buffer overflow which can be used to execute arbitrary code as root (the privilege which snoop runs at).

Solaris snoop (GETQUOTA) Buffer Overflow Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Solaris snoop (GETQUOTA) Buffer Overflow Vulnerability

Solution:
Patches are available to all Sun customers at http://sunsolve.sun.com


Sun Solaris 2.6

• Sun 108492-01
  sparc
  

Sun Solaris 7.0

• Sun 108482-01
  sparc
  

Sun Solaris 2.4_x86

• Sun 108491-01
  x86
  

Sun Solaris 2.6_x86

• Sun 108493-01
  x86
  

Sun Solaris 2.5

• Sun 108501-01
  sparc
  

Sun Solaris 7.0_x86

• Sun 108483-01
  x86
  

Sun Solaris 2.4

• Sun 108490-01
  sparc
  

Sun Solaris 2.5_x86

• Sun 108502-01
  x86
  

Solaris snoop (GETQUOTA) Buffer Overflow Vulnerability

References:

• Sun Patch Access Page (Sun Microsystems)
  
• Sun Patches List (Sun Microsystems)
  
• Sunsolve Online(tm) (Sun Microsystems)
  
• X-Force Web Page (Internet Security Systems)