SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Lpsystem Vendors:   Caldera/SCO
Caldera Open Unix (SCO) lpsystem Utility May Let Local Users Gain Elevated Privileges
SecurityTracker Alert ID:  1002300
SecurityTracker URL:  http://securitytracker.com/id/1002300
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Aug 29 2001
Impact:   Execution of arbitrary code via local system, User access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): Open Unix 8.0.0
Description:   A vulnerability was reported in Caldera's lpsystem printer registration utility for Open Unix. A local user may be able to gain elevated privileges.

A local user can provide a long argument to /usr/sbin/lpsystem to trigger a buffer overflow and cause a segmentation fault or possibly cause arbitrary code to be executed.

For example, the following command will reportedly cause a core dump:

/usr/sbin/lpsystem `perl -e 'print "A" x 7000'`

This vulnerability was originally noted by KF (dotslash @ snosoft.com).

Impact:   A local user may be able to obtain elevated privileges.
Solution:   The vendor has released fix binaries, available at:

ftp://ftp.sco.com/pub/security/openunix/sr847408/

md5 checksums:

f2048bf92f7a55e13d2c3fb1ae8670d4 erg711789a.Z

Vendor URL:  www.calderasystems.com/support/security/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Open UNIX-SCO)

Message History:   None.


 Source Message Contents

Subject:  Security Update: [CSSA-2001-SCO.15] Open Unix: lpsystem buffer overflow


--J/dobhs11T7y2rNN
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: 8bit            

To: bugtraq@securityfocus.com security-announce@lists.securityportal.com announce@lists.caldera.com 

___________________________________________________________________________

	    Caldera International, Inc. Security Advisory

Subject:		Open Unix: lpsystem buffer overflow
Advisory number: 	CSSA-2001-SCO.15
Issue date: 		2001 August 28
Cross reference:
___________________________________________________________________________



1. Problem Description
	
	A long argument to /usr/sbin/lpsystem can cause lpsystem to
	have a segmentation violation. This might be used by an
	unauthorized user to gain privilege.


2. Vulnerable Versions

	Operating System	Version		Affected Files
	------------------------------------------------------------------
	Open Unix		8.0.0		/usr/sbin/lpsystem


3. Workaround

	None.


4. Open Unix

  4.1 Location of Fixed Binaries

	ftp://ftp.sco.com/pub/security/openunix/sr847408/


  4.2 Verification

	md5 checksums:

	f2048bf92f7a55e13d2c3fb1ae8670d4	erg711789a.Z


	md5 is available for download from

		ftp://ftp.sco.com/pub/security/tools/


  4.3 Installing Fixed Binaries

	Upgrade the affected binaries with the following commands:

	# uncompress /tmp/erg711789a.Z
	# pkgadd -d /tmp/erg711789a


5. References

	http://www.calderasystems.com/support/security/


6. Disclaimer

	Caldera International, Inc. is not responsible for the misuse
	of any of the information we provide on our website and/or
	through our security advisories. Our advisories are a service
	to our customers intended to promote secure installation and
	use of Caldera International products.


7.Acknowledgements

	Caldera International wishes to thank KF <dotslash@snosoft.com>
	for discovering and reporting this problem.
	 
___________________________________________________________________________

--J/dobhs11T7y2rNN
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAjuL0W8ACgkQaqoBO7ipriFANgCfRiT8g+hsU4X7Xzb4CTInPsPg
/SgAnj5MqzU3C2SxzykMzia9v2RAv3+6
=yjHZ
-----END PGP SIGNATURE-----

--J/dobhs11T7y2rNN--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC