SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Mailtool Vendors:   Sun
Sun Solaris Mailtool Allows Local Users to Execute Arbitrary Commands on the Host with the Mail Group Privileges
SecurityTracker Alert ID:  1001625
SecurityTracker URL:  http://securitytracker.com/id/1001625
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Updated:  May 30 2001
Original Entry Date:  May 28 2001
Impact:   Execution of arbitrary code via local system
Exploit Included:  Yes  
Version(s): Solaris 8 x86, Solaris 8 sparc, [possibly others]; 2.6 is reported vulnerable by another user
Description:   A vulnerability has been reported in the Solaris mailtool e-mail utility that allows local users to execute arbitrary commands with the "mail" group id privileges.

A buffer overflow reportedly exists in the OPENWINHOME environment variable. By supplying a long environment buffer containing machine executable code, a local user can execute arbitrary command(s). Because the mailtool utility is installed with set group id "mail" privileges by default in Solaris, the arbitrary commands will be executed with "mail" group privileges.

This vulnerability has reportedbly been assigned Sun Bug ID: 4458476

Impact:   A local user can execute arbitrary commands on the server with "mail" group privileges.
Solution:   No solution was available at the time of this entry. The advisory reports that users can clear the sgid bit off the /usr/openwin/bin/mailtool program as a workaround.
Vendor URL:  www.sun.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Solaris - SunOS)

Message History:   None.


 Source Message Contents

Subject:  [synnergy] - Solaris mailtool(1) buffer overflow vulnerability


Vulnerability in Solaris mailtool(1)

Date Published: May 29, 2001

Advisory ID: N/A

Bugtraq ID: N/A

Sun Bug ID: 4458476

CVE CAN: Non currently assigned.

Title: Solaris mailtool(1) Buffer Overflow Vulnerability

Class: Boundary Error Condition

Remotely Exploitable: No

Locally Exploitable: Yes

Vulnerable Packages/Systems:

Solaris 8       x86
Solaris 8       sparc
[possibly others]

Discovery: dethy@synnergy.net

Synopsis:

The mailtool program is installed setgid mail by default in Solaris,
a buffer overrun exists in the OPENWINHOME environment variable. By
specifying a long environment buffer containing machine executable code,
it is possible to execute arbitrary command(s) as gid mail.

Analysis:

The vulnerability in mailtool incorrectly handles data from the
OPENWINHOME environment variable, if this variable exceeds a predefined
length a stack overflow can occur.


 bash-2.03# export OPENWINHOME=`perl -e 'print "A"x1010'`
 bash-2.03# mailtool
 Segmentation Fault

 `truss` output:
    Incurred fault #6, FLTBOUNDS  %pc = 0xDF8BD448
    siginfo: SIGSEGV SEGV_MAPERR addr=0x4141414D
    Received signal #11, SIGSEGV [default]
    siginfo: SIGSEGV SEGV_MAPERR addr=0x4141414D
    *** process killed ***


Quick Fix:

Clear the sgid bit off the /usr/openwin/bin/mailtool program.
chmod -s `which mailtool`

Solution/Vendor:

Sun Microsystems was notified on May 14, 2001 and verified the
vulnerability. Patches/fixes are shortly to be released.

Related Links:

This vulnerability is unrelated to the Solaris 7/8 ximp40 shared library
overflow discovered earlier in the year:
http://www.securityfocus.com/archive/1/159586

Credits :

Vulnerability discovered by dethy (dethy@synnergy.net)

Synnergy Networks http://www.synnergy.net


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC