|
Brought to you by:
Suppliers of:
|
|
|
| |
| The Solaris runtime linker, ld.so.1(1), processes dynamic executables and shared objects at runtime, binding them to create a executable process. When LD_PRELOAD is set, the dynamic linker will use the specified library before any other when searching for shared libraries. |
| |
Credit:
The original advisory can be downloaded from: http://www.idefense.com/advisory/07.29.03.txt
The information has been provided by iDEFENSE Labs, the vulnerability was discovered by Jouko Pynnonen.
|
| |
Vulnerable systems:
SPARC Platform
* Solaris 2.6 with patch 107733-10 and without patch 107733-11
* Solaris 7 with patches 106950-14 through 106950-22 and without patch 106950-23
* Solaris 8 with patches 109147-07 through 109147-24 and without patch 109147-25
* Solaris 9 without patch 112963-09
x86 Platform
* Solaris 2.6 with patch 107734-10 and without patch 107734-11
* Solaris 7 with patches 106951-14 through 106951-22 and without patch 106951-23
* Solaris 8 with patches 109148-07 through 109148-24 and without patch 109148-25
* Solaris 9 without patch 113986-05
A locally exploitable buffer overflow exists in the ld.so.1 dynamic runtime linker in Sun's Solaris operating system. The LD_PRELOAD variable can be passed a large value, which will cause the runtime linker to overflow a stack based buffer. The overflow occurs on a non-executable stack making command execution more difficult than normal, but not impossible.
Vendor fix:
Sun has provided a fix for this issue available from: http://sunsolve.sun.com/pub-cgi/retrieve.pl?doc=fsalert/55680
Recreation:
It is possible to recreate the issue by issuing the following command line:
LD_PRELOAD=/`perl -e 'print "A"x2000'`/ passwd
Disclosure timeline:
01 JUN 2003 Issue disclosed to security-alert@sun.com
02 JUN 2003 Response from Sun Security Coordination Team
03 JUN 2003 Email to Sun Security Coordination Team
04 JUN 2003 Issue disclosed to iDEFENSE
16 JUL 2003 Status Request to Sun Security Coordination Team
22 JUL 2003 Response from Sun Security Coordination Team
28 JUL 2003 iDEFENSE clients notified
29 JUL 2003 Coordinated Public Disclosure
|
|
|
|
|
