Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » eSO 2406-CDE dtprintinfo Help search buffer overflow vulnerability

eSO 2406-CDE dtprintinfo Help search buffer overflow vulnerability

by Nikola Strahija on May 1st, 2002 Impact: Local attackers can gain root level access Affected Technology: Solaris 2.4, 2.5, 2.5.1, 2.6, 7, 8 SPARC and x86 HP-UX 10.10, 10.20, 10.24, 11.00, 11.04, 11.11 IBM AIX 4.3, 4.3.1, 4.3.2, 4.3.3 Compaq Tru64 5.1A, 5.1, 5.0A, 4.0G, 4.0F CDE Vendor Status: Patches are available Discovered By: Kevin Kotas of the eSecurityOnline Research and Development Team CVE Reference: CAN-2001-0551


Advisory Location:
http://www.eSecurityOnline.com/advisories/eSO2406.asp

Description:
The CDE dtprintinfo program is vulnerable to a buffer overflow
condition that allows a local attacker to gain root access. The
problem occurs due to insufficient bounds checking in the Volume
search field from the Help section. An attacker can insert a specially
crafted string for the search parameter and gain root privileges.

In the dtprintinfo Help, an Index search function permits querying by
keyword. If a string of appropriate length is inserted into the
'Entries with' field and a single Help Volume is selected for the
search, an exploitable buffer overflow will occur.

Technical Recommendation:
Upgrade with the following patches.

Solaris 2.4, 2.5, 2.5.1 SPARC:
105076-04

Solaris 2.4, 2.5, 2.5.1 x86:
105354-04

Solaris 2.6 SPARC:
106242-03

Solaris 2.6 x86:
106243-03

Solaris 7 SPARC:
107178-02

Solaris 7 x86:
107179-02

Solaris 8 SPARC:
108949-04

Solaris 8 x86:
108950-04

IBM AIX:

AIX 4.3.x:
APAR #IY21539

AIX 5.1:
APAR #IY20917

Compaq:
SSRT1-78U
SSRT0788U
SSRT0757U
SSRT-541

HP-UX:
10.10: PHSS_23355
10.20: PHSS_23796
10.24: PHSS_24097
11.00: PHSS_23797
11.04: PHSS_24098
11.11: PHSS_24087, PHSS_24091

Acknowledgements:
eSecurityOnline would like to thank Sun Microsystems and the Sun
security team for their cooperation in resolving the issue.

Copyright 2002 eSecurityOnline LLC. All rights reserved.

THE INFORMATION IN THIS VULNERABILITY ALERT IS PROVIDED BY
ESECURITYONLINE LLC "AS IS", "WHERE IS", WITH NO WARRANTY OF ANY KIND,
AND ESECURITYONLINE LLC HEREBY DISCLAIMS THE IMPLIED WARRANTIES OF
NON-INFRINGEMENT, MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. ESECURITYONLINE LLC SHALL HAVE NO LIABILITY FOR ANY DAMAGE,
CLAIM OR LOSS RESULTING FROM YOUR USE OF THE INFORMATION CONTAINED IN
THIS VULNERABILITY ALERT.


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »