Server NewsBugtraq: Vulnerability in Solaris mailtool(1)

Bugtraq: Vulnerability in Solaris mailtool(1)

ServerWatch content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.




The mailtool program is installed setgid mail by default in Solaris,
a buffer overrun exists in the OPENWINHOME environment variable. By
specifying a long environment buffer containing machine executable code,
it is possible to execute arbitrary command(s) as gid mail.

Date: Mon, 28 May 2001 11:46:13 +0200 (CEST)
From: dethy 
Subject: [synnergy] - Solaris mailtool(1) buffer overflow vulnerability

Vulnerability in Solaris mailtool(1)

Date Published: May 29, 2001

Advisory ID: N/A

Bugtraq ID: N/A

Sun Bug ID: 4458476

CVE CAN: Non currently assigned.

Title: Solaris mailtool(1) Buffer Overflow Vulnerability

Class: Boundary Error Condition

Remotely Exploitable: No

Locally Exploitable: Yes

Vulnerable Packages/Systems:

Solaris 8       x86
Solaris 8       sparc
[possibly others]

Discovery: dethy@synnergy.net

Synopsis:

The mailtool program is installed setgid mail by default in Solaris,
a buffer overrun exists in the OPENWINHOME environment variable. By
specifying a long environment buffer containing machine executable code,
it is possible to execute arbitrary command(s) as gid mail.

Analysis:

The vulnerability in mailtool incorrectly handles data from the
OPENWINHOME environment variable, if this variable exceeds a predefined
length a stack overflow can occur.


 bash-2.03# export OPENWINHOME='perl -e 'print "A"x1010''
 bash-2.03# mailtool
 Segmentation Fault

 'truss' output:
    Incurred fault #6, FLTBOUNDS  %pc = 0xDF8BD448
    siginfo: SIGSEGV SEGV_MAPERR addr=0x4141414D
    Received signal #11, SIGSEGV [default]
    siginfo: SIGSEGV SEGV_MAPERR addr=0x4141414D
    *** process killed ***


Quick Fix:

Clear the sgid bit off the /usr/openwin/bin/mailtool program.
chmod -s 'which mailtool'

Solution/Vendor:

Sun Microsystems was notified on May 14, 2001 and verified the
vulnerability. Patches/fixes are shortly to be released.

Related Links:

This vulnerability is unrelated to the Solaris 7/8 ximp40 shared library
overflow discovered earlier in the year:
http://www.securityfocus.com/archive/1/159586

Credits :

Vulnerability discovered by dethy (dethy@synnergy.net)

Synnergy Networks http://www.synnergy.net

Get the Free Newsletter!

Subscribe to Daily Tech Insider for top news, trends & analysis

Latest Posts

Related Stories