ncpfs Access Control Bug Lets Local Users Access Files and Buffer Overflow May Let Local Users Execute Arbitrary Code
|
|
SecurityTracker Alert ID: 1013019 |
|
SecurityTracker URL: http://securitytracker.com/id/1013019
|
|
CVE Reference:
CAN-2005-0013, CAN-2005-0014
(Links to External Site)
|
Date: Jan 28 2005
|
Impact:
Disclosure of system information, Disclosure of user information, Execution of arbitrary code via local system, Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.2.6
|
Description:
Two vulnerabilities were reported in ncpfs. A local user can access arbitrary files with elevated privileges. A local user may also be able to execute arbitrary code with elevated privileges.
The ncp_fopen_nwc() function in 'ncpfs-2.2.0.18/lib/ncplib.c' does not properly control access to files. The function does not check to make sure that the file ownership matches the uid of the calling user. As a result, a local user can invoke ncpmount to cause ncpfs to access a file that the user would otherwise not be permitted to access [CVE: CAN-2005-0013].
The opt_set_volume_after_parsing_all_options() function in 'ncpfs-2.2.5/sutil/ncplogin.c' does not properly validate the length of user-supplied command line parameters. A local user can supply a specially crafted path value to trigger a buffer overflow, potentially allowing the local user to execute arbitrary code with elevated privileges [CVE: CAN-2005-0014].
Erik Sjolund is credited with discovering these flaws.
|
Impact:
A local user can access arbitrary files with elevated privileges.
A local user may also be able to execute arbitrary code with elevated privileges.
|
Solution:
The vendor has released a fixed version (2.2.6), available at:
ftp://platan.vc.cvut.cz/pub/linux/ncpfs/
|
Cause:
Access control error, Boundary error
|
Underlying OS:
Linux (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Thu, 27 Jan 2005 15:37:19 -0500
Subject: [none]
|
ftp://platan.vc.cvut.cz/pub/linux/ncpfs/Changes-2.2.6
> ChangeSet@1.306, 2005-01-27 18:25:25+01:00
> Fix CAN-2005-0013 and CAN-2005-0014.
>
> Fix CAN-2005-0013: Run with euid == uid for most of time, and switch
> to euid == 0 only when really needed.
>
> And although previous change decreases impact of CAN-2005-0014, let's
> fix random small static character arrays too.
|
|
