what you don't know can hurt you

S-97-41.asc

S-97-41.asc
Posted Jan 10, 2000

Subject SGI IRIX pset Buffer Overrun Vulnerability Date 30-May-97

tags | overflow
systems | irix
MD5 | eb2f1039eaf27c3b2fef12498a63b993

S-97-41.asc

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===============================================================================
>> CERT-NL, 01-Mar-2000 <<
>> All CERT-NL information has been moved to http://cert.surfnet.nl. Links <<
>> to CERT-NL information contained in this advisory are therefore outdated. <<
>> <<
>> CERT-NL also has stopped the CERT-CC-Mirror service. Due to this the <<
>> links to the CERT-CC mirror are obsolete. Visit the CERT-CC site for the <<
>> complete CERT-CC advisory texts: http://www.cert.org <<
===============================================================================
Content-Type: text/plain; charset=us-ascii


===============================================================================
Security Advisory CERT-NL
===============================================================================
Author/Source : Don Stikvoort Index : S-97-41
Distribution : World Page : 1
Classification: External Version: 1
Subject : SGI IRIX pset Buffer Overrun Vulnerability Date : 30-May-97
===============================================================================

By courtesy of AUSCERT we received
information on an SGI IRIX pset Buffer Overrun vulnerability.

This can lead to root compromises.

CERT-NL recommends taking action 3.1 mentioned below and wait for the
official SGI patches. SGI acknowledged this problem on May 28th:

<QUOTE -with error mended- >
Silicon Graphics Inc. acknowledges the pset buffer overrun vulnerability
publically reported by several individuals and in AUSCERT Advisory AA-97.19.

Currently, Silicon Graphics Inc. is investigating and no further information
is available for public release at this time.

As further information becomes available, additional advisories will be
issued via the normal SGI security information distribution methods
including the wiretap mailing list.
<UNQUOTE>

==============================================================================

AA-97.20 AUSCERT Advisory
SGI IRIX pset Buffer Overrun Vulnerability
27 May 1997

Last Revised: --

----------------------------------------------------------------------------

AUSCERT has received information that a vulnerability exists in pset(1M),
distributed under IRIX 5.3 and 6.2. Other versions may also be
vulnerable.

This vulnerability may allow local users to gain the privileges of group
sys. These privileges may then be leveraged to gain root privileges.

Exploit information involving this vulnerability has been made publicly
available.

At this stage, AUSCERT is unaware of any official vendor patches. AUSCERT
recommends that sites apply the workaround given in Section 3 until vendor
patches are made available.

This advisory will be updated as more information becomes available.

-----------------------------------------------------------------------------

1. Description

pset(1M) is a program used to display and modify information concerning
the use of processor sets in the current system. The pset command is
used on multi-processor systems to restrict the execution of different
classes of jobs.

Due to insufficient bounds checking on arguments which are supplied
by users, it is possible to overwrite the internal stack space of the
pset program while it is executing. By supplying a carefully designed
argument to the pset program, intruders may be able to force pset to
execute arbitrary commands. As pset is setgid sys, this may allow
intruders to run arbitrary commands with the privileges of group sys.
This may then be leveraged to gain root privileges.

Sites can determine if this program is installed by using:

% ls -l /sbin/pset

pset is installed by default in /sbin. Sites are encouraged to check
for the presence of this program regardless of the version of IRIX
installed.

Exploit information involving this vulnerability has been made publicly
available.

2. Impact

This vulnerability may allow local users to gain the privileges of group
sys. These privileges may then be leveraged to gain root privileges.

3. Workarounds/Solution

AUSCERT recommends that sites prevent the exploitation of this
vulnerability in pset by immediately applying the workaround given in
Section 3.1.

If the pset functionality is required by non-root users, AUSCERT
recommends applying the workaround given in Section 3.2.

Currently there are no vendor patches available that address this
vulnerability. AUSCERT recommends that official vendor patches be
installed when they are made available.

3.1 Remove setgid and non-root execute permissions

To prevent the exploitation of the vulnerability described in this
advisory, AUSCERT recommends that the setgid permissions be removed
from the pset program immediately. As pset will no longer work for
non-root users, it is recommended that the execute permissions for
them also be removed.

# ls -l /sbin/pset
-rwsr-sr-x 1 root sys 31704 Nov 22 1994 /sbin/pset

# chmod 500 /sbin/pset
# ls -l /sbin/pset
-r-x------ 1 root sys 31704 Nov 22 1994 /sbin/pset

3.2 Install pset wrapper

AUSCERT has developed a wrapper to help prevent programs from being
exploited using the vulnerability described in this advisory. Sites
which have a C compiler can obtain the source, compile and install
the wrapper as described in Section 3.2.1. For sites without a C
compiler, AUSCERT has made pre-compiled binaries available
(Section 3.2.2).

3.2.1 Installing the wrapper from source

The source for the wrapper, including installation instructions, can
be found at:

ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/
overflow_wrapper.c

This wrapper replaces the pset program and checks the length of the
command line arguments which are passed to it. If an argument exceeds
a certain predefined value (MAXARGLEN), the wrapper exits without
executing the pset command. The wrapper program can also be configured
to syslog any failed attempts to execute pset with arguments exceeding
MAXARGLEN. For further instructions on using this wrapper, please
read the comments at the top of overflow_wrapper.c.

When compiling overflow_wrapper.c for use with pset, AUSCERT recommends
defining MAXARGLEN to be 32.

The MD5 checksum for the current version of overflow_wrapper.c can be
retrieved from:

ftp://ftp.auscert.org.au/pub/auscert/tools/overflow_wrapper/CHECKSUM

The CHECKSUM file has been digitally signed using the AUSCERT PGP key.

3.2.2 Installing the wrapper binaries

Pre-compiled wrapper binary is provided for sites that wish to install
the wrapper but do not have a C compiler available. AUSCERT has
compiled the wrapper on IRIX 5.3, however later versions of IRIX should
be able to use the wrapper binary without recompilation. The following
compile time options have been used to create the binaries:

REAL_PROG='"/sbin/pset.real"'
MAXARGLEN=32
SYSLOG

More information on these options can be found in Section 3.2.1 and
in the overflow_wrapper.c source code.

The pre-compiled binaries for the wrapper program can be retrieved from:

ftp://ftp.auscert.org.au/pub/auscert/tools/AA-97.20-pset_wrapper.tar.Z

The MD5 checksum for AA-97.20-pset_wrapper.tar.Z is:

MD5 (AA-97.20-pset_wrapper.tar.Z) = 875367aec70936fc5f4531b0ba8ebc03

AA-97.20-pset_wrapper.tar.Z contains a README file with installation
instructions, as well as a pre-compiled binary.

Sites are encouraged to carefully read the installation notes in the
README file before installation.

4. Additional measures

Most Unix systems ship with numerous programs which have setuid or
setgid privileges. Often the functionality supplied by these privileged
programs is not required by many sites. The large number of privileged
programs that are shipped by default are to cater for all possible
uses of the system.

AUSCERT encourages sites to examine all the setuid/setgid programs
and determine the necessity of each program. If a program does not
absolutely require the setuid/setgid privileges to operate (for example,
it is only run by the root user), the setuid/setgid privileges should
be removed. Furthermore, if a program is not required at your site,
then all execute permissions should be removed.

A sample command to find all setuid/setgid programs is (run as root):

# find / \( -perm -4000 -o -perm -2000 \) -type f -exec ls -l {} \;

It is AUSCERT's experience that many vulnerabilities are being discovered
in setuid/setgid programs which are not necessary for the correct
operation of most systems. Sites can increase their security by
removing unnecessary setuid/setgid programs.

For example, the functionality provided by the pset program is not
needed by many sites. If sites had previously disabled this program,
they would not have been susceptible to this latest vulnerability.

==============================================================================
CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet
is the Dutch network for educational, research and related institutes. CERT-NL
is a member of the Forum of Incident Response and Security Teams (FIRST).

All CERT-NL material is available under:
http://cert.surfnet.nl/

In case of computer or network security problems please contact your local
CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer
please address the appropriate (local) CERT/security-team).

CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer,
i.e. UTC+0100 in winter and UTC+0200 in summer (DST).

Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS
Phone: +31 302 305 305 BUSINESS HOURS ONLY
Fax: +31 302 305 329 BUSINESS HOURS ONLY
Snailmail: SURFnet bv
Attn. CERT-NL
P.O. Box 19035
NL - 3501 DA UTRECHT
The Netherlands

NOODGEVALLEN: 06 22 92 35 64 ALTIJD BEREIKBAAR
EMERGENCIES : +31 6 22 92 35 64 ATTENDED AT ALL TIMES
CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES:
THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED*
PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT
TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU.
===============================================================================

-----BEGIN PGP SIGNATURE-----
Version: PGP 6.5.1i

iQA/AwUBOL6IXDSYjBqwfc9jEQJchACgiwhiTFgx+vG1eou9wsEgSe2qAz0AoOm3
uxeBwzC90D4Y5LygBADpVRjX
=X8UR
-----END PGP SIGNATURE-----

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

February 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    1 Files
  • 2
    Feb 2nd
    2 Files
  • 3
    Feb 3rd
    17 Files
  • 4
    Feb 4th
    15 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    16 Files
  • 7
    Feb 7th
    19 Files
  • 8
    Feb 8th
    1 Files
  • 9
    Feb 9th
    2 Files
  • 10
    Feb 10th
    15 Files
  • 11
    Feb 11th
    20 Files
  • 12
    Feb 12th
    12 Files
  • 13
    Feb 13th
    18 Files
  • 14
    Feb 14th
    17 Files
  • 15
    Feb 15th
    4 Files
  • 16
    Feb 16th
    4 Files
  • 17
    Feb 17th
    34 Files
  • 18
    Feb 18th
    15 Files
  • 19
    Feb 19th
    19 Files
  • 20
    Feb 20th
    20 Files
  • 21
    Feb 21st
    15 Files
  • 22
    Feb 22nd
    2 Files
  • 23
    Feb 23rd
    2 Files
  • 24
    Feb 24th
    16 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files
  • 29
    Feb 29th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close