HP/UX 'ipcs' Buffer Overflow May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1006392
|
|
CVE Reference: GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 27 2003
|
Impact: Execution of arbitrary code via local system, User access via local system
|
Description: A vulnerability was reported in the ipcs interprocess communication status utility on the HP/UX operating system. A local user may be able to gain elevated privileges.
It is reported that a local user can trigger a buffer overflow in /usr/bin/ipcs. It may be possible to exploit the overflow to execute
arbitrary code on the system with 'sys' group privileges, but that was not confirmed in the report.
A demonstration exploit is
provided:
/usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
|
Impact: A local user may be able to obtain elevated ('sys' group) privileges on the system.
|
Solution: No solution was available at the time of this entry.
|
Vendor URL: www.hp.com/ (Links to External Site)
|
Cause: Boundary error
|
Underlying OS: UNIX (HP/UX)
|
Reported By: bt@delfi.lt
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 27 Mar 2003 20:55:29 GMT
From: bt@delfi.lt
Subject: [Full-Disclosure] ipcs on HP-UX 11.0
|
Hi!
There is a buffer overflow in /usr/bin/ipcs on HP-UX 11.0 (other versions might be
vulnerable too).
$ ls -al /usr/bin/ipcs
-r-xr-sr-x 1 bin sys 28672 Apr 23 1999 /usr/bin/ipcs
$ /usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
Segmentation fault
All ipcs vulnerabilities I know about are on HP Tru64.
This system was patched with PHCO_18374 - the lastest patch for ipcs.
I just wondering if it was known before, and if it was - maybe someone has a working proof
of concept on this.
bt@delfi.lt
--------------------------------------------------------------------
This message was sent using DELFI MailMan - http://mailman.delfi.lt/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
