-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>>                                                      CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl.  Links  <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>>                                                                           <<
>> CERT-NL also has stopped the CERT-CC-Mirror service.  Due to this the     <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the  <<
>> complete CERT-CC advisory texts:                     http://www.cert.org  <<
===============================================================================
===============================================================================
Security Advisory                                                       CERT-NL
===============================================================================
Author/Source : Nico de Koo                                 Index  :    S-97-16
Distribution  : World                                       Page   :          1
Classification: External                                    Version:          2
Subject       : Solaris 2.x passwd buffer Overrun Vuln.     Date   :  06-mar-97
===============================================================================
This advisory is a revision for S-97-16 released on 27-feb-97.
Revision includes:
  Fixed information regarding versions prior to Solaris 2.5.
  Added information on getting binary versions of the wrapper.

- --------------------------------------------------------------------------------
By courtesy of AUSCERT we received information on a vulnerability in
Solaris 2.x passwd. It is a buffer overrun vulnarability again.
Using this vulnerability local users may gain root privileges.

CERT-NL recommends, due to lack of adequate vendor pathches, to apply the
workarounds provided in section 3.

==============================================================================

AA-97.09                        AUSCERT Advisory
===========================================================================
AA-97.09                        AUSCERT Advisory
                 Solaris 2.x passwd buffer Overrun Vulnerability
                                26 February 1997

Last Revised:   3 March 1997
    Fixed information regarding versions prior to Solaris 2.5.
    Added information on getting binary versions of the wrapper.

CERT-NL thanks AUSCERT for supplying additional information.
- ------------------------------------------------------------------------------
AUSCERT has received information that a vulnerability exists in the
passwd(1) program under Solaris 2.x.

This vulnerability may allow local users to gain root privileges.

Exploit information involving this vulnerability has been made
publicly available.

Currently there are no vendor patches available that address this
vulnerability.  AUSCERT recommends that sites take the steps outlined in
section 3 as soon as possible.

This advisory will be updated as more information becomes available.
- -----------------------------------------------------------------------------

1.  Description

    AUSCERT has received information that a vulnerability exists in the
    Solaris 2.x passwd(1) program.  Under Solaris 2.5, yppasswd(1) and
    nispasswd(1) are hard links to the passwd program, and as such are
    also vulnerable.  Under Solaris 2.3 and 2.4, passwd, yppasswd and
    nispasswd are separate programs.  Of these, only passwd is known to
    be exploitable.

    Due to insufficient bounds checking on arguments which are supplied
    by users, it is possible to overwrite the internal stack space of the
    passwd program while it is executing.  By supplying a carefully
    designed argument to the passwd program, intruders may be able to
    force passwd to execute arbitrary commands.  As passwd is setuid
    root, it may allow intruders to run arbitrary commands with root
    privileges.

    Exploit information involving this vulnerability has been made
    publicly available.

    passwd, yppasswd and nispasswd under Solaris 2.x are located by
    default in /usr/bin/.

2.  Impact

    Local users may gain root privileges.

3.  Workarounds/Solution

    AUSCERT recommends that sites limit the possible exploitation of
    this vulnerability by immediately applying the workaround given in
    Section 3.1.

    Currently there are no vendor patches available that address this
    vulnerability.  AUSCERT recommends that official vendor patches be
    installed when they are made available.

3.1 Install passwd wrapper

    AUSCERT has developed a wrapper to help prevent programs from being
    exploited using the vulnerability described in this advisory.  Sites
    which have a C compiler can obtain the source, compile and install
    the wrapper as described in Section 3.1.1.  For sites without a C
    compiler, AUSCERT has made pre-compiled binaries available for Solaris
    2.4, 2.5 and 2.5.1 (Section 3.1.2).

3.1.1 Installing the wrapper from source

    The source for the wrapper, including installation instructions, can
    be found at:

        ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper.c

    This wrapper replaces the passwd program and checks the length of the
    command line arguments which are passed to it.  If an argument exceeds
    a certain predefined value (MAXARGLEN), the wrapper exits without
    executing the passwd command.  The wrapper program can also be
    configured to syslog any failed attempts to execute passwd with
    arguments exceeding MAXARGLEN.  For further instructions on using this
    wrapper, please read the comments at the top of overflow_wrapper.c.

    Applying this wrapper program to passwd, following the instructions
    given in the comments at the start of the wrapper program, will also
    fix the overflow problems with yppasswd and nispasswd under Solaris
    2.5, since these programs are merely hard links to passwd.

    When compiling overflow_wrapper.c for use with passwd, AUSCERT
    recommends defining MAXARGLEN to be 32.

    The MD5 checksum for Version 1.0 of overflow_wrapper.c is:

        MD5 (overflow_wrapper.c) = f7f83af7f3f0ec1188ed26cf9280f6db

3.1.2 Installing the wrapper binaries

    Pre-compiled wrapper binaries are provided for sites that wish to
    install the wrapper but do not have a C compiler available.  AUSCERT
    has compiled the wrapper on Solaris 2.4, 2.5 and 2.5.1.  The following
    compile time options have been used to the create the binaries:

        REAL_PROG='"/usr/bin/passwd.real"'
        MAXARGLEN=32
        SYSLOG

    More information on these options can be found in Section 3.1.1 and
    in the overflow_wrapper.c source code.

    The pre-compiled binaries for the wrapper program can be retrieved from:

  ftp://ftp.auscert.org.au/pub/auscert/tools/passwd_wrapper.tar.Z

    The MD5 checksum for passwd_wrapper.tar.Z is:

        MD5 (passwd_wrapper.tar.Z) = 9b49f5522ef4a481c7e4b4c1fb4f816f

    passwd_wrapper.tar.Z contains a README file with installation
    instructions, as well as pre-compiled binaries for Solaris 2.4, 2.5
    and 2.5.1.

    Sites are encouraged to carefully read the installation notes in
    the README file before installation.

- -----------------------------------------------------------------------------
AUSCERT thanks Jim Gifford (Board of Regents of the University System of
Georgia) for supplying additional information and Sun Microsystems for
their assistance in this matter.
- -----------------------------------------------------------------------------
==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
  http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL  (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

   Email:     cert-nl@surfnet.nl     ATTENDED REGULARLY ALL DAYS
   Phone:     +31 302 305 305        BUSINESS HOURS ONLY
   Fax:       +31 302 305 329        BUSINESS HOURS ONLY
   Snailmail: SURFnet bv
              Attn. CERT-NL
              P.O. Box 19035
              NL - 3501 DA  UTRECHT
              The Netherlands

NOODGEVALLEN:    06 22 92 35 64      ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64      ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6ITzSYjBqwfc9jEQLJMwCePjXZo/yp/W7SEbxuvioFCAYkcrkAnRYE
rCfCeODOkDk10nvuI2LbQQ4B
=TplC
-----END PGP SIGNATURE-----