Davide Del Vecchio
29/04/03, 22:05
================================================== =====
HPUX rexec buffer overflow vulnerability
================================================== =====
Davide Del Vecchio Adv#5
Discovered in: 19/02/2003
Date: 29/04/2003
Tested on HP-UX B.10.20
Description:
The rexec command works the same as remsh except that it uses the
rexec() library routine and rexecd for command execution
and does not support Kerberos authentication.
The "-l" option is used to specify a different remote username.
$ ls -al rexec
-r-sr-xr-x 1 root bin 20480 Oct 27 1997 rexec
Using rexec with "-l" with a long option string:
$ rexec 127.0.0.1 -l `perl -e 'printf "A" x 9777'` -n something
Memory fault
Solution:
I'm in contact with HP's Security staff, especially with John Morris,
and I would like to thanks him and all his staff for the interest
demonstrated during this period of research on HP-UX.
He assured me a patch has been written and an Official Security Bullettin
will follow my advisory.
Credits:
Davide Del Vecchio would like to thank all the people supporting him
and his research, his coworkers of the security and monitoring staff @ Banca
Mediolanum,
and obvious, the HP-UX security staff, impersonified in this case in John
Morris.
Disclaimer:
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^
Please send suggestions, updates, and comments to:
Davide Del Vecchio , Dante Alighieri - dante@alighieri.org / security@phx.it
www.alighieri.org
HPUX rexec buffer overflow vulnerability
================================================== =====
Davide Del Vecchio Adv#5
Discovered in: 19/02/2003
Date: 29/04/2003
Tested on HP-UX B.10.20
Description:
The rexec command works the same as remsh except that it uses the
rexec() library routine and rexecd for command execution
and does not support Kerberos authentication.
The "-l" option is used to specify a different remote username.
$ ls -al rexec
-r-sr-xr-x 1 root bin 20480 Oct 27 1997 rexec
Using rexec with "-l" with a long option string:
$ rexec 127.0.0.1 -l `perl -e 'printf "A" x 9777'` -n something
Memory fault
Solution:
I'm in contact with HP's Security staff, especially with John Morris,
and I would like to thanks him and all his staff for the interest
demonstrated during this period of research on HP-UX.
He assured me a patch has been written and an Official Security Bullettin
will follow my advisory.
Credits:
Davide Del Vecchio would like to thank all the people supporting him
and his research, his coworkers of the security and monitoring staff @ Banca
Mediolanum,
and obvious, the HP-UX security staff, impersonified in this case in John
Morris.
Disclaimer:
The information within this paper may change without notice. Use of this
information constitutes acceptance for use in an AS IS condition.
There are NO warranties with regard to this information. In no event shall
the author be liable for any damages whatsoever arising out of or in
connection with the use or spread of this information. Any use of this
information is at the user's own risk.
^^^^^^^^
Please send suggestions, updates, and comments to:
Davide Del Vecchio , Dante Alighieri - dante@alighieri.org / security@phx.it
www.alighieri.org