The full version of this advisory can be found at. http://www.secnetops.com/research/advisories/SRT2003-09-11-1200.txt Quick Summary: ************************************************************************ Advisory Number : SRT2003-09-11-1200 Product : Andries Brouwer man Version : Version <=1.5m1 Vendor : ftp://ftp.win.tue.nl/pub/linux-local/utils/man Class : Local High Level Explanation ************************************************************************ High Level Description : MANPL variable suffers from overflow What to do : upgrade to man-1.5m2.tar.gz Technical Details ************************************************************************ Proof Of Concept Status : SNO has working Poc code. Low Level Description : In efforts to keep man secure most vendors include a variant of the patch "man-1.5l-redhat-patches.patch" . This patch provides a length check on several variables used in getenv() calls and in turn it stops at least one overflow. This patch has been left out of vendor supplied packages on occasion while man was still sgid. If you have compiled man yourself or have set the sgid bit on a vendor supplied man (RH9) you may be vulnerable. + char *s; +#define CHECK(p, l) s=getenv(p); if(s && (strlen(s)>l)) { fprintf(stderr, "ERROR: Environment variable %s too long!\n", p); exit(1); } + + CHECK("LANG", 32); + CHECK("MANPAGER", 128); + CHECK("PAGER", 128); + CHECK("SYSTEM", 64); + CHECK("MANROFFSEQ", 128); + CHECK("MANSECT", 128); + CHECK("MANPL", 128); + CHECK("MAN_HP_DIREXT", 128); + CHECK("LANGUAGE", 128); + CHECK("LC_MESSAGES", 128); in the default man-1.5x code these checks are not present which causes an exploitable condition. -KF
This archive was generated by hypermail 2b30 : Fri Sep 12 2003 - 02:33:59 PDT