ncpfs Access Control Bug Lets Local Users Access Files and Buffer Overflow May Let Local Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013019
|
|
SecurityTracker URL: http://securitytracker.com/id?1013019
|
|
CVE Reference: CAN-2005-0013
, CAN-2005-0014
(Links to External Site)
|
Date: Jan 28 2005
|
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.2.6
|
Description: Two vulnerabilities were reported in ncpfs. A local user can access arbitrary files with elevated privileges. A local user may also be able to execute arbitrary code with elevated privileges.
The ncp_fopen_nwc() function in 'ncpfs-2.2.0.18/lib/ncplib.c' does not properly control access to files. The function does not check
to make sure that the file ownership matches the uid of the calling user. As a result, a local user can invoke ncpmount to cause
ncpfs to access a file that the user would otherwise not be permitted to access [CVE: CAN-2005-0013].
The opt_set_volume_after_parsing_all_options()
function in 'ncpfs-2.2.5/sutil/ncplogin.c' does not properly validate the length of user-supplied command line parameters. A local
user can supply a specially crafted path value to trigger a buffer overflow, potentially allowing the local user to execute arbitrary
code with elevated privileges [CVE: CAN-2005-0014].
Erik Sjolund is credited with discovering these flaws.
|
Impact: A local user can access arbitrary files with elevated privileges.
A local user may also be able to execute arbitrary code with elevated privileges.
|
Solution: The vendor has released a fixed version (2.2.6), available at:
ftp://platan.vc.cvut.cz/pub/linux/ncpfs/
|
Cause: Access control error, Boundary error
|
Underlying OS: Linux (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 27 Jan 2005 15:37:19 -0500
Subject: [none]
|
ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6
> ChangeSet@1.306, 2005-01-27 18:25:25+01:00
> Fix CAN-2005-0013 and CAN-2005-0014.
>
> Fix CAN-2005-0013: Run with euid == uid for most of time, and switch
> to euid == 0 only when really needed.
>
> And although previous change decreases impact of CAN-2005-0014, let's
> fix random small static character arrays too.
|
|
