lpstat su Solaris
Esiste un problema di buffer overflow nel programma /usr/bin/lpstat su
Solaris 2.6 e 2.7 che permetterebbe ad un utente locale di acquisire
privilegi di root. il rimedio e' di togliere il bit SUID dall'eseguibile
in attesa di una patch ufficiale dalla Sun.
- -------------------------------------------------------------
HERT - Hacker Emergency Response Team
alert@hert.org - http://www.hert.org
Advisory: #00001
Title: lpstat
Date: 26 January 1999
Summary: Buffer overflow in Solaris /usr/bin/lpstat
System affected: Solaris 2.6, 2.6_x86, 2.7, 2.7_x86
IMPACT: Local users may obtain root priviledge.
- --------------------------------------------------------------
Copyright (C) 1999 Hacker Emergency Response Team
Permission is granted to reproduce and distribute HERT advisories in
their
entirety, provided the HERT PGP signature is included and provided the
alert is used for noncommercial purposes and with the intent of
increasing the aware-
ness of the Internet community.
This advisory is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
1. Background:
The lpstat command prints information about the current
status of the LP print service.
On Solaris 2.6 and 2.7, /usr/bin/lpstat is suid root and we've found
it
to be vulnerable to a buffer overflow.
Exploit code for this vulnerability is in circulation.
2. Affected Supported versions
Solaris versions: 2.7, 2.7_x86, 2.6, 2.6_x86
3. Recommendations
Temporary fix:
chmod -s /usr/bin/lpstat
chmod -s /usr/bin/lpq
Wait for Sun to issue a patch that will correct this problem.
To subscribe to the HERT Alert mailing list, email alert@hert.org
with subscribe in the body of the message.
Contact hert@hert.org for more information.
The HERT PGP public key is available at
ftp://ftp.hert.org/pub/HERT_PGP.key
To report a vulnerability: http://www.hert.org/vul_reporting_form
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: latin1
iQCVAwUBNq82VbiV3oeHg1NdAQH9MAQAtEDQxHaDdlDNP/B8Bl785Y4nDidgJYyR
TZwJl/QD/0g/Q0IoX80muxw8fR2+XKnyq7qqhaI1EhC+1z0ScPjPWWOa12oKTKAG
hFGpLdq5WdVrmHf1X9b90ZD5ov9KIsDuVxSTpUv0dPCCvxfSJb4Zdbr2+lQDjks/
orxjIwo5jgY=
=NG0f
-----END PGP SIGNATURE-----