|
Brought to you by:
Suppliers of:
|
|
|
| |
HP-UX 11.00 ships with a vulnerable version of the elm MUA, it contains a buffer overflow vulnerability in the -s (subject) argument. This enables local attackers to execute code with the privileges of the mail user.
Note that all systems with the vulnerable version of elm are affected, not just HP-UX. |
| |
Credit:
The information has been provided by Flatline.
|
| |
Vulnerable systems:
elm version 2.5.alpha3
Immune systems:
elm version 2.5.0
Elm is setgid mail, so an attacker could gain egid mail on the system and read/modify other users' mail.
Example:
$ uname -a
HP-UX oege B.11.00 D 9000/887 1948791292 64-user license
$ elm -s `perl -e '{print "A"x5376}'`
some_recipient
Segmentation fault
$
A buffer of 5376 characters seems to work, although you might need a bit more or a bit less to accomplish the same effect on your system.
Problematic code:
In args.c, function 'parse_arguments':
to_whom[0] = '\0';
batch_subject[0] = '\0';
included_file[0] = '\0';
while ((c = getopt(argc, argv, "?acd:f:hi:kKms:tVvz")) != EOF) {
switch (c) {
case 'a' : arrow_cursor++; break;
case 'c' : check_only++; use_tite = 0; break;
case 'd' : debug = atoi(optarg); break;
case 'f' : strcpy(req_mfile, optarg); break;
case '?' :
case 'h' : args_help();
case 'i' : strcpy(included_file, optarg); break;
case 'k' : hp_terminal++; break;
case 'K' : hp_terminal++; hp_softkeys++; break;
case 'm' : mini_menu = 0; break;
case 's' : strcpy(batch_subject, optarg); break;
case 't' : use_tite = 0; break;
case 'V' : sendmail_verbose++; break;
case 'v' : args_version();
case 'z' : check_size++; break;
}
}
All vulnerable strcpy() statements copy a user supplied string into a buffer of SLEN (256) bytes.
Feeding the argument a string of more than 256 characters in length will crash it.
hdrs/defs.h:#define SLEN 256 /* long for ensuring no overwrites... */
It's interesting to see that the author thought his buffers were safe by using a seemingly large buffer length.
Fix:
HP-UX 11.00 ships with an older version of the elm MUA so to fix the problem you just need to download the latest stable version (2.5.3) from:
http://www.instinct.org/elm/files/tarballs/elm2.5.3.tar.gz
You could also remove the setgid bit and wait for HP to officially issue a patch.
|
|
|
|
|
