exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

iDEFENSE Security Advisory 2007-08-07.1

iDEFENSE Security Advisory 2007-08-07.1
Posted Aug 8, 2007
Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 08.07.07 - Remote exploitation of a buffer overflow vulnerability in ldcconn allows attackers to execute arbitrary code with root privileges. By sending a long string to the TCP port that ldcconn listens on, a buffer overflow is triggered. No authentication or data validation is performed. iDefense confirmed the existence of this vulnerability in HP-UX 11.11i. It is suspected that other versions are also vulnerable.

tags | advisory, remote, overflow, arbitrary, root, tcp
systems | hpux
SHA-256 | 6a40f61622abf67fb1152d6b4a99faa9cfeaa866e4d77c4a1f18a5861021c829

iDEFENSE Security Advisory 2007-08-07.1

Change Mirror Download
Hewlett-Packard HP-UX Remote ldcconn Buffer Overflow Vulnerability

iDefense Security Advisory 08.07.07
http://labs.idefense.com/intelligence/vulnerabilities/
Aug 07, 2007

I. BACKGROUND

Cisco Local Director is a load-balancing, connection fail-over device
used to help manage large enterprise networks. HP-UX allows for easy
interfacing with Cisco Local Director using the HP Controller for Cisco
Local Director package. In this package is ldcconn, which is configured
to run via inetd on TCP port 17781.

II. DESCRIPTION

Remote exploitation of a buffer overflow vulnerability in ldcconn allows
attackers to execute arbitrary code with root privileges.

By sending a long string to the TCP port that ldcconn listens on, a
buffer overflow is triggered. No authentication or data validation is
performed.

III. ANALYSIS

Exploitation allows unauthenticated remote attackers to gain root access
on affected machines.

The seriousness of this vulnerability is increased by the fact that in
most cases an attacker will have unlimited attempts at successful
exploitation due to the fact that inetd will continue to launch the
service for each new connection.

IV. DETECTION

iDefense confirmed the existence of this vulnerability in HP-UX 11.11i.
It is suspected that other versions are also vulnerable.

To determine if ldcconn is installed on your specific install, use the
command:

# swlist -l file | grep ldcconn

If this command returns anything, it means it is installed. To tell if
it is currently configured to run from inetd, use the command:

# grep ldcconn /etc/inetd.conf

If it returns an entry, that means it is currently configured to run
from inetd.

V. WORKAROUND

Firewall rules should be set to only allow Cisco equipment to access the
service (port 17781).

If the service is not being used, simply remove, or comment out, the
entry in /etc/inetd.conf and restart inetd.

VI. VENDOR RESPONSE

Hewlett-Packard states that this product is obsolete and no longer
supported. They have no plans to release a patch or advisory. They
further stated that the version of HP-UX used to verify this
vulnerability is also obsolete.

"HP simply recommends that customers upgrade to a currently supported OS
release and to some other tool, if one is available."

VII. CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not
been assigned yet.

VIII. DISCLOSURE TIMELINE

11/02/2004 Initial vendor notification
11/03/2004 Initial vendor response
12/19/2005 Second vendor notification
01/30/2007 Third vendor notification
01/30/2007 Third vendor response
04/25/2007 Status update requested
06/08/2007 Status update requested
07/24/2007 Status update requested
07/30/2007 Vendor stated product's support ended in 2002
08/06/2007 Vendor communicated their response
08/07/2007 Coordinated public disclosure

IX. CREDIT

This vulnerability was discovered by iDefense Labs.

Get paid for vulnerability research
http://labs.idefense.com/methodology/vulnerability/vcp.php

Free tools, research and upcoming events
http://labs.idefense.com/

X. LEGAL NOTICES

Copyright © 2007 iDefense, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDefense. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically,
please e-mail customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.
Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    16 Files
  • 18
    Jun 18th
    26 Files
  • 19
    Jun 19th
    15 Files
  • 20
    Jun 20th
    18 Files
  • 21
    Jun 21st
    8 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    19 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close