UNIX — THE HEADLINES

 2002/1/18 

Exploit circulating for CDE hole in Solaris

 2001/12/21 

Buffer overflow in System V derived login

 2001/11/22 

Remote logic flaw in HP-UX line printer daemon

 2001/11/15 

CDE flaw could allow malicious hacking

 2001/11/06 

Multiple vulnerabilities in lpd

UNIX — THE LINKS

• IFStatus promiscuous mode detector for Solaris
• Monitor Syscalls on FreeBSD
• ComClear — Clear Your Netscape Browser History Information
• Reviewing your X Window security

  Disclaimer: These hyper-links can be placed by visitors of this site. The link, the description and the content of the linked pages do not fall under the responsibility of the SYS-2064 editors and do not represent their opinion. The editors may modify or delete any entries.

UNIX — THE NEWS

2002/1/18

20:29 +0100

Exploit circulating for CDE hole in Solaris

[Unix] CERT/CC say in their advisory CA-2002-01 that hackers are actively exploiting a known vulnerability in Sun Microsystems Inc.'s Solaris version of the Unix operating system, urging administrators to check if their system is vulnerable. CERT says that it had received "credible reports" of an exploit for Solaris systems. An exploit is a software tool that can be used to break into computer systems and that is often used by hackers, explains InfoWorld.

The exploit takes advantage of a buffer overflow vulnerability that was first discovered in March 1999. The flaw in a library function used by the CDE (Common Desktop Environment) could allow an attacker to take full control over the system, CERT said. CDE is a graphical user interface that is typically installed by default on Unix systems.

CDE is "a fairly widespread product on Unix platforms" and is included in products from Sun Microsystems Inc., IBM Corp., Hewlett-Packard Co. and Compaq Computer Corp., according to Art Manion, an Internet security analyst with the CERT.

The CDE Subprocess Control Service (dtspcd) is a network daemon that accepts requests from remote clients to execute commands and launch programs remotely. The service does not perform adequate input validation, as a result of which a malicious client could manipulate data sent and cause a buffer overflow, according to CERT. // c.f. SecuritySpace :: [dre].

Comments (0)

2001/12/21

15:45 +0100

Buffer overflow in System V derived login

[Unix] Several applications use login for authentication to the system. CERT Advisory CA-2001-34 reports, that a remotely exploitable buffer overflow exists in login derived from System V. Attackers can exploit this vulnerability to gain root access to the server. Affected systems are: —IBM AIX versions 4.3 and 5.1, —Hewlett-Packard's HP-UX, —SCO OpenServer 5.0.6 and earlier, —SGI IRIX 3.x, —Sun Solaris 8 and earlier

Several implementations of login that are derived from System V allow a user to specify arguments such as environment variables to the process. An array of buffers is used to store these arguments. A flaw exists in the checking of the number of arguments accepted. This flaw permits the array of buffers to be overflowed.

On most systems, login is not suid; therefore, it runs as the user who called it. If, however, login is called by an application that runs with greater privileges than those of the user, such as telnetd or rlogind, then the user can exploit this vulnerability to gain the privileges of that program. In the case of telnetd or rlogind, root access is gained.

Since in.telnetd and in.rlogind are available over the network, a remote attacker without any previous access to the system could use this vulnerability to gain root access to the system.

If a program that invokes login is suid (or sgid) User_A, then this can be exploited to gain the privileges of User_A. An exploit exists and may be circulating.

Users/admins of affected systems should see their vendors for a patch. // c.f. CERT/CC :: [dre].

Comments (0)

2001/11/22

10:57 +0100

Remote logic flaw in HP-UX line printer daemon

[Unix] Internet Security Systems (ISS) X-Force has discovered a vulnerability in the HP-UX line printer daemon (rlpdaemon). This vulnerability may allow a remote or local attacker to execute arbitrary code with superuser privilege. Meanwhile, Hewlett-Packard Company Security Bulletin #0176 and CERT/CC Advisory CA-2001-32 were released in this matter.

The line printer daemon allows printer sharing over a network of Unix computers. HP-UX is shipped with a line printer daemon adapted from BSD Unix. The HP line printer daemon is similar to "in.lpd" in other Unix variants. Affected are the lpds of OS versions HP-UX 10.01, 10.10, 10.20, 11.00 and 11.11.

The rlpdaemon daemon is enabled by default and executed with superuser privilege. This vulnerability can be successfully exploited with no local account or specific knowledge of the target system’s configuration.

ISS X-Force recommends that all system administrators who have not implemented network printing should immediately disable rlpdaemon and any other unused services. // c.f. VulnWatch, CERT/CC :: [dre].

Comments (0)

2001/11/15

09:04 +0100

CDE flaw could allow malicious hacking

[Unix] A vulnerability in a component of a graphical user interface that ships with several commercial Unix systems could let a malicious attacker take administrative control of an affected host system, ComputerWorld summarises advisory CA-2001-31 from the CERT/CC at Carnegie Mellon University in Pittsburgh.

The vulnerability exists in a function used by the Common Desktop Environment (CDE) Subprocess Control Service, which is responsible for accepting requests from clients to execute commands and open applications remotely. Because of an error in the way requests from remote clients are validated, crackers could manipulate data and cause a buffer overflow.

The CDE is an integrated graphical user interface that runs on Unix and Linux systems. The affected software includes several versions of Hewlett-Packard Co.'s HP-UX, IBM's AIX, Sun Microsystems Inc.'s Solaris and Compaq Computer Corp.'s Tru64 Unix.

Patches that address the problem are available from some of the vendors, while a few others have acknowledged the problem and are investigating, according to the CERT advisory.

Until patches are available, one way for users to mitigate their exposure is to limit or block access to the Subprocess Control Service from untrusted networks, CERT advised. // c.f. SecuritySpace :: [dre].

Comments (0)

2001/11/06

14:15 +0100

Multiple vulnerabilities in lpd

[Unix] CERT Advisory CA-2001-30 warns of multiple vulnerabilities in several implementations of the line printer daemon (lpd). The line printer daemon enables various clients to share printers over a network. Review your configuration to be sure you have applied all relevant patches. We also encourage you to restrict access to the lpd service to only authorized users.

Most of these vulnerabilities are buffer overflows allowing a remote intruder to gain root access to the lpd server. For the latest and most detailed information about the known vulnerabilities, please see the CERT Vulnerability Notes Database.

The following table represents the status of each vendor with regard to each vulnerability. Please be aware that vendors produce multiple products; if they are listed in this table, not all products may be affected. If a vendor is not listed in the table below, then their status should be considered unknown.

+ = Affected
- = Not Affected
  = Unknown
   
VU# ->  274043 388183 722143 466239 39001  30308  966075
Apple      -                                         -
BSDI       +                                          
Caldera    -      -      -      -      -      -      -
Cray              -      -      -      -             -
Debian                                 +      +       
Engarde    -      -      -      -      -      -      -
FreeBSD    +      -      -      -      -      -      -
Fujitsu    -      -      -      -      -      -      -
HP                                                   +
IBM        -      +      +      +      -      +      -
Mandrake                               +              
NetBSD     +                                          
OpenBSD    +                                          
Red Hat                                +      +       
SCO        +                                          
SGI        +                                          
SuSE       +                                          
Sun        -      -      -      -      +      -      -

If you cannot disable the service, you can limit your exposure to these vulnerabilities by using a router or firewall to restrict access to port 515/TCP (printer). Note that this does not protect you against attackers from within your network. // c.f. SecuriTeam :: [dre].

Comments (0)