SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   BIND Vendors:   Caldera/SCO
(Caldera Issues DNS Resolver Fix for UnixWare) Libc Buffer Overflow in gethostnamadr() and getnetnamadr() Functions May Let Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1005133
SecurityTracker URL:  http://securitytracker.com/id/1005133
CVE Reference:   CVE-2002-0651   (Links to External Site)
Date:  Aug 24 2002
Impact:   Execution of arbitrary code via network, Root access via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   A buffer overflow vulnerability was reported in 'libc'. A remote user with control over a DNS server could cause arbitrary code to be executed on the system when the system resolves an address.

Pine Internet released a security advisory for 'libc' warning of a buffer overflow in the resolver code of libc.

A remote user with control over a DNS server can send a specially crafted reply to the target host when the target host makes a certain DNS query.

The flaw appears to reside in the gethostnamadr() and getnetnamadr() functions.

Impact:   A remote user could cause arbitrary code to be run on the system in certain situations. The privileges that the code would run with depend on the privileges of the calling routine that uses the affected libc components.
Solution:   The vendor has released a fix for UnixWare 7.1.1:

Location of Fixed Binaries

ftp://ftp.caldera.com/pub/updates/UnixWare/CSSA-2002-SCO.37

Verification

MD5 (erg501624.pkg.Z) = cb425affbc7740e3338dfd55409ba0f0

Installing Fixed Binaries

Upgrade the affected binaries with the following commands:

Download erg501624.pkg.Z to the /var/spool/pkg directory

# uncompress /var/spool/pkg/erg501624.pkg.Z
# pkgadd -d /var/spool/pkg/erg501624.pkg

Vendor URL:  www.caldera.com/support/security/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  UNIX (Open UNIX-SCO)
Underlying OS Comments:  UnixWare 7.1.1

Message History:   This archive entry is a follow-up to the message listed below.
Jun 26 2002 Libc Buffer Overflow in gethostnamadr() and getnetnamadr() Functions May Let Remote Users Execute Arbitrary Code



 Source Message Contents

Subject:  Security Update: [CSSA-2002-SCO.37] UnixWare 7.1.1 : buffer overflow in DNS resolver


--V0207lvV8h4k8FAm
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

To: bugtraq@securityfocus.com announce@lists.caldera.com scoannmod@xenitec.on.ca full-disclosure@lists.netsys.com

______________________________________________________________________________

		Caldera International, Inc.  Security Advisory

Subject:		UnixWare 7.1.1 : buffer overflow in DNS resolver
Advisory number: 	CSSA-2002-SCO.37
Issue date: 		2002 August 23
Cross reference:
______________________________________________________________________________


1. Problem Description

	From CERT CA-2002-19: A buffer overflow vulnerability exists
	in multiple implementations of DNS resolver libraries.
	Operating systems and applications that utilize vulnerable
	DNS resolver libraries may be affected. A remote attacker
	who is able to send malicious DNS responses could potentially
	exploit this vulnerability to execute arbitrary code or
	cause a denial of service on a vulnerable system.


2. Vulnerable Supported Versions

	System				Binaries
	----------------------------------------------------------------------
	UnixWare 7.1.1			/usr/lib/nslookup.help
					/usr/sbin/addr
					/usr/sbin/dig
					/usr/sbin/dnskeygen
					/usr/sbin/dnsquery
					/usr/sbin/host
					/usr/sbin/in.named
					/usr/sbin/irpd
					/usr/sbin/mkservdb
					/usr/sbin/named-bootconf
					/usr/sbin/named-xfer
					/usr/sbin/ndc
					/usr/sbin/nslookup
					/usr/sbin/nsupdate


3. Solution

	The proper solution is to install the latest packages.


4. UnixWare 7.1.1

	4.1 Location of Fixed Binaries

	ftp://ftp.caldera.com/pub/updates/UnixWare/CSSA-2002-SCO.37


	4.2 Verification

	MD5 (erg501624.pkg.Z) = cb425affbc7740e3338dfd55409ba0f0

	md5 is available for download from
		ftp://ftp.caldera.com/pub/security/tools


	4.3 Installing Fixed Binaries

		Upgrade the affected binaries with the following commands:

	Download erg501624.pkg.Z to the /var/spool/pkg directory

	# uncompress /var/spool/pkg/erg501624.pkg.Z
	# pkgadd -d /var/spool/pkg/erg501624.pkg


5. References

	Specific references for this advisory:
		http://www.isc.org/products/BIND/bind-security.html
		http://www.pine.nl/advisories/pine-cert-20020601.asc
		http://www.kb.cert.org/vuls/id/803539
		http://www.cert.org/advisories/CA-2002-19.html
		http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0651

	Caldera security resources:
		http://www.caldera.com/support/security/index.html

	This security fix closes Caldera incidents sr866551, fz521493,
	erg501624.


6. Disclaimer

	Caldera International, Inc. is not responsible for the
	misuse of any of the information we provide on this website
	and/or through our security advisories. Our advisories are
	a service to our customers intended to promote secure
	installation and use of Caldera products.


7. Acknowledgements

	Caldera thanks Joost Pol of PINE-CERT and the FreeBSD Project
	for their analysis of these vulnerabilities.

______________________________________________________________________________

--V0207lvV8h4k8FAm
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (SCO_SV)
Comment: For info see http://www.gnupg.org

iEYEARECAAYFAj1mxygACgkQaqoBO7ipriGigQCfUuwKubxLWNsBGlbLHt4OB9Y0
Df8AnjpwDiT0+iHUf9p8eUrp8ZxPFKH4
=fyGl
-----END PGP SIGNATURE-----

--V0207lvV8h4k8FAm--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC