HP/UX 'ipcs' Buffer Overflow May Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1006392 |
|
SecurityTracker URL: http://securitytracker.com/id/1006392
|
|
CVE Reference:
GENERIC-MAP-NOMATCH
(Links to External Site)
|
Date: Mar 27 2003
|
Impact:
Execution of arbitrary code via local system, User access via local system
|
|
|
Description:
A vulnerability was reported in the ipcs interprocess communication status utility on the HP/UX operating system. A local user may be able to gain elevated privileges.
It is reported that a local user can trigger a buffer overflow in /usr/bin/ipcs. It may be possible to exploit the overflow to execute arbitrary code on the system with 'sys' group privileges, but that was not confirmed in the report.
A demonstration exploit is provided:
/usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
|
Impact:
A local user may be able to obtain elevated ('sys' group) privileges on the system.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.hp.com/ (Links to External Site)
|
Cause:
Boundary error
|
Underlying OS:
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 27 Mar 2003 20:55:29 GMT
Subject: [Full-Disclosure] ipcs on HP-UX 11.0
|
Hi!
There is a buffer overflow in /usr/bin/ipcs on HP-UX 11.0 (other versions might be
vulnerable too).
$ ls -al /usr/bin/ipcs
-r-xr-sr-x 1 bin sys 28672 Apr 23 1999 /usr/bin/ipcs
$ /usr/bin/ipcs -C `perl -e 'print "A" x 2232'`
Segmentation fault
All ipcs vulnerabilities I know about are on HP Tru64.
This system was patched with PHCO_18374 - the lastest patch for ipcs.
I just wondering if it was known before, and if it was - maybe someone has a working proof
of concept on this.
bt@delfi.lt
--------------------------------------------------------------------
This message was sent using DELFI MailMan - http://mailman.delfi.lt/
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
