*******************************************************************
Subject : IBM Tivoli Firewall Security Toolbox (TFST) remote buffer
overflow vulnerability
Version : Tivoli Firewall Toolbox version 1.2
Platform: All supported platforms
*******************************************************************
0o Overview
-----------
The Tivoli Firewall Toolbox is an optional component of the Tivoli
management environment and provides the underlying communication
for the framework-based applications within a firewall environment.
A vulnerability was discovered in the Tivoli relay daemon, which is
part of this communication layer.
0o Impact
---------
The vulnerability may allow a Tivoli endpoint to execute arbitrary
code on an affected system.
0o Technical description
------------------------
The TFST relay daemon, which listens on a TCP network socket,
performs no bounds checking while storing data from Tivoli nodes
into a memory buffer. Due to this it is possible for Tivoli nodes
to cause a buffer overflow in the relay daemon.
The buffer overflow can be used to overwrite critical program control
data on the stack and may therefore be used to inject malicious code
in the relay daemon process. This code can then be executed with the
privileges of this process.
On Unix platforms, abuse of this vulnerability can initially allow
remote attackers to penetrate affected systems with user 'nobody'
privileges. Due to insecure permissions on the relay.sh script,
which is executed at boot time, it is possible to elevate the user
'nobody' privileges to those of the 'root' user on these systems.
It should be noted that the relay daemon, under normal circumstances,
is configured to only accept connections from trusted Tivoli nodes.
0o Solution
-----------
Affected Tivoli customers should upgrade to the IBM Tivoli Firewall
Toolbox version 1.3, which can be found at:
http://www-3.ibm.com/software/sysmgmt/products/support/IBMTivoliManagementFramework.html
(Entitled Customers only)
ftp://ftp.software.ibm.com/software/tivoli_support/patches/patches_1.3
(anonymous access)
0o Disclaimer
-------------
**********************************************************************
All information, advice and statements are provided "AS IS", without
any warranty of any kind, express or implied, including but not
limited to, warranties of accuracy, timeliness, non-infringement
or fitness for a particular purpose. Ubizen assumes no liability
for any loss or damage whatsoever (direct, indirect, consequential
or otherwise). The use of and/or reliance on any of the information,
advice or statements provided will be at the sole risk of the
using/relying party.
Copyright (c) 2003 by Ubizen N.V. All rights reserved. All trademarks
or registered trademarks are the property of their respective owners.
**********************************************************************
This archive was generated by hypermail 2b30 : Thu Mar 20 2003 - 10:01:50 PST