what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SRT2003-09-11-1200.txt

SRT2003-09-11-1200.txt
Posted Sep 13, 2003
Authored by Kevin Finisterre

Secure Network Operations, Inc. Advisory SRT2003-09-11-1200 - In the man-1.5x code, some checks may not be present upon compile time that keep man from not being vulnerable. RedHat 9 is one such installation that ships man setgid and vulnerable to attack if the vendor supplied binary is utilized. http://www.secnetops.com.

tags | advisory, web
systems | linux, redhat
SHA-256 | 743603b784eb340ce003d68fe7310d77a3cf4938a9b7ae14aee5b8377252c813

SRT2003-09-11-1200.txt

Change Mirror Download
The full version of this advisory can be found at.
http://www.secnetops.com/research/advisories/SRT2003-09-11-1200.txt


Quick Summary:
************************************************************************
Advisory Number : SRT2003-09-11-1200
Product : Andries Brouwer man
Version : Version <=1.5m1
Vendor : ftp://ftp.win.tue.nl/pub/linux-local/utils/man
Class : Local

High Level Explanation
************************************************************************
High Level Description : MANPL variable suffers from overflow
What to do : upgrade to man-1.5m2.tar.gz

Technical Details
************************************************************************
Proof Of Concept Status : SNO has working Poc code.
Low Level Description :

In efforts to keep man secure most vendors include a variant of the patch
"man-1.5l-redhat-patches.patch" . This patch provides a length check on
several variables used in getenv() calls and in turn it stops at least one
overflow. This patch has been left out of vendor supplied packages on
occasion while man was still sgid. If you have compiled man yourself or
have set the sgid bit on a vendor supplied man (RH9) you may be vulnerable.

+ char *s;
+#define CHECK(p, l) s=getenv(p); if(s && (strlen(s)>l)) { fprintf(stderr,
"ERROR: Environment variable %s too long!\n", p); exit(1); }
+
+ CHECK("LANG", 32);
+ CHECK("MANPAGER", 128);
+ CHECK("PAGER", 128);
+ CHECK("SYSTEM", 64);
+ CHECK("MANROFFSEQ", 128);
+ CHECK("MANSECT", 128);
+ CHECK("MANPL", 128);
+ CHECK("MAN_HP_DIREXT", 128);
+ CHECK("LANGUAGE", 128);
+ CHECK("LC_MESSAGES", 128);

in the default man-1.5x code these checks are not present which causes an
exploitable condition.

-KF

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    0 Files
  • 7
    Feb 7th
    0 Files
  • 8
    Feb 8th
    0 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close